From 72ea05cc059951b8311ff4383844878995ec837e Mon Sep 17 00:00:00 2001
From: Martin McKeaveney <martin@shogunsystems.co.uk>
Date: Mon, 11 Jan 2021 21:01:21 +0000
Subject: [PATCH] type safe schema validation

---
 .../src/components/integration/Query.js       |  9 ++-
 .../components/integration/QueryViewer.svelte |  2 +-
 .../src/components/integration/index.svelte   |  6 +-
 packages/server/src/api/controllers/query.js  | 20 -------
 packages/server/src/api/routes/query.js       | 60 ++++++++++++++++++-
 packages/server/src/integrations/postgres.js  | 38 ++++++++++--
 .../src/utilities/security/permissions.js     |  3 +
 7 files changed, 106 insertions(+), 32 deletions(-)

diff --git a/packages/builder/src/components/integration/Query.js b/packages/builder/src/components/integration/Query.js
index 4057da508b..25e9bb2745 100644
--- a/packages/builder/src/components/integration/Query.js
+++ b/packages/builder/src/components/integration/Query.js
@@ -1,9 +1,14 @@
+const handlebars = require("handlebars")
+
 class Query {
-  constructor(source, schema, type) {
+  constructor(source, schema, type, queryString) {
     this.source = source
     this.schema = schema
     this.type = type
+    this.queryString = queryString
   }
 
-  build(parameters) {}
+  build(parameters) {
+    this.queryStr
+  }
 }
diff --git a/packages/builder/src/components/integration/QueryViewer.svelte b/packages/builder/src/components/integration/QueryViewer.svelte
index 246bfaf4cc..a77e0cc211 100644
--- a/packages/builder/src/components/integration/QueryViewer.svelte
+++ b/packages/builder/src/components/integration/QueryViewer.svelte
@@ -136,7 +136,7 @@
     <Select secondary bind:value={query.queryType}>
       <option value={''}>Select an option</option>
       {#each Object.keys(config) as queryType}
-        <option value={queryType}>{queryType}</option>
+        <option value={config[queryType].type}>{queryType}</option>
       {/each}
     </Select>
 
diff --git a/packages/builder/src/components/integration/index.svelte b/packages/builder/src/components/integration/index.svelte
index 9b9b7e5d11..3876df5a09 100644
--- a/packages/builder/src/components/integration/index.svelte
+++ b/packages/builder/src/components/integration/index.svelte
@@ -5,6 +5,8 @@
 
   const QueryTypes = {
     SQL: "sql",
+    JSON: "json",
+    FIELDS: "fields",
   }
 
   export let query
@@ -19,4 +21,6 @@
   <Spacer large />
   <TextArea bind:value={query.queryString} />
   <!-- <Editor label="Query" on:change={updateQuery} value={query.queryString} /> -->
-{/if}
+{:else if query.queryType === QueryTypes.JSON}
+
+{:else if query.queryType === QueryTypes.FIELDS}{/if}
diff --git a/packages/server/src/api/controllers/query.js b/packages/server/src/api/controllers/query.js
index 30c0943126..f1e3201681 100644
--- a/packages/server/src/api/controllers/query.js
+++ b/packages/server/src/api/controllers/query.js
@@ -1,20 +1,7 @@
 const handlebars = require("handlebars")
-const Joi = require("joi")
 const CouchDB = require("../../db")
 const { generateQueryID, getQueryParams } = require("../../db/utils")
 const { integrations } = require("../../integrations")
-const joiValidator = require("../../middleware/joi-validator")
-
-function generateQueryValidation() {
-  // prettier-ignore
-  return joiValidator.body(Joi.object({
-    name: Joi.string().required(),
-    queryString: Joi.string().required(),
-    datasourceId: Joi.string().required(),
-    queryType: Joi.string().required(),
-    schema: Joi.object({}).required().unknown(true)
-  }))
-}
 
 exports.fetch = async function(ctx) {
   const db = new CouchDB(ctx.user.appId)
@@ -31,13 +18,6 @@ exports.save = async function(ctx) {
   const db = new CouchDB(ctx.user.appId)
   const query = ctx.request.body
 
-  //
-  // {
-  //   type: "",
-  //   query: "",
-  //   otherStuff: ""
-  // }
-
   if (!query._id) {
     query._id = generateQueryID(query.datasourceId)
   }
diff --git a/packages/server/src/api/routes/query.js b/packages/server/src/api/routes/query.js
index ed25b47263..35f1f31f12 100644
--- a/packages/server/src/api/routes/query.js
+++ b/packages/server/src/api/routes/query.js
@@ -2,15 +2,69 @@ const Router = require("@koa/router")
 const queryController = require("../controllers/query")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("../../utilities/security/permissions")
+const Joi = require("joi")
+const {
+  PermissionLevels,
+  PermissionTypes,
+} = require("../../utilities/security/permissions")
+const joiValidator = require("../../middleware/joi-validator")
 
 const router = Router()
 
+const QueryVerb = {
+  Create: "CREATE",
+  Read: "READ",
+  Update: "UPDATE",
+  Delete: "DELETE",
+}
+
+function generateQueryValidation() {
+  // prettier-ignore
+  return joiValidator.body(Joi.object({
+    _id: Joi.string(),
+    _rev: Joi.string(),
+    name: Joi.string().required(),
+    queryString: Joi.string().required(),
+    datasourceId: Joi.string().required(),
+    parameters: Joi.array().items(Joi.object({
+      name: Joi.string(),
+      default: Joi.string()
+    })),
+    // queryVerb: Joi.string().allow(...Object.values(QueryVerb)).required(),
+    queryType: Joi.string().required(),
+    schema: Joi.object({}).required().unknown(true)
+  }))
+}
+
+function generateQueryPreviewValidation() {
+  // prettier-ignore
+  return joiValidator.body(Joi.object({
+    query: Joi.string().required(),
+    datasourceId: Joi.string().required(),
+    parameters: Joi.object({}).required().unknown(true)
+  }))
+}
+
 // TODO: sort out auth so apps have the right permissions
 router
   .get("/api/queries", authorized(BUILDER), queryController.fetch)
-  .post("/api/queries", authorized(BUILDER), queryController.save)
-  .post("/api/queries/preview", authorized(BUILDER), queryController.preview)
-  .post("/api/queries/:queryId", authorized(BUILDER), queryController.execute)
+  .post(
+    "/api/queries",
+    authorized(BUILDER),
+    generateQueryValidation(),
+    queryController.save
+  )
+  .post(
+    "/api/queries/preview",
+    authorized(BUILDER),
+    generateQueryPreviewValidation(),
+    queryController.preview
+  )
+  .post(
+    "/api/queries/:queryId",
+    authorized(PermissionTypes.QUERY, PermissionLevels.WRITE),
+    queryController.execute
+  )
   .delete("/api/queries/:queryId", authorized(BUILDER), queryController.destroy)
 
 module.exports = router
diff --git a/packages/server/src/integrations/postgres.js b/packages/server/src/integrations/postgres.js
index 1c28f2f906..2f7eca7fd0 100644
--- a/packages/server/src/integrations/postgres.js
+++ b/packages/server/src/integrations/postgres.js
@@ -29,14 +29,42 @@ const SCHEMA = {
     },
   },
   query: {
-    sql: {
+    SQL: {
       type: "sql",
     },
-    gui: {
-      type: "config",
+    "Simple Query": {
+      type: "fields",
       fields: {
-        something: "",
-        other: "",
+        table: {
+          type: "string",
+        },
+        column: {
+          type: "string",
+        },
+        condition: {
+          type: "options",
+          options: [
+            {
+              name: "Equals",
+              value: "=",
+            },
+            {
+              name: "Not Equals",
+              value: "!=",
+            },
+            {
+              name: "Greater Than",
+              value: ">",
+            },
+            {
+              name: "Less Than",
+              value: "<",
+            },
+          ],
+        },
+        value: {
+          type: "string",
+        },
       },
     },
   },
diff --git a/packages/server/src/utilities/security/permissions.js b/packages/server/src/utilities/security/permissions.js
index 008145cc99..c00f3ce6c7 100644
--- a/packages/server/src/utilities/security/permissions.js
+++ b/packages/server/src/utilities/security/permissions.js
@@ -58,6 +58,7 @@ exports.BUILTIN_PERMISSIONS = {
     _id: exports.BUILTIN_PERMISSION_IDS.READ_ONLY,
     name: "Read only",
     permissions: [
+      new Permission(PermissionTypes.QUERY, PermissionLevels.READ),
       new Permission(PermissionTypes.TABLE, PermissionLevels.READ),
       new Permission(PermissionTypes.VIEW, PermissionLevels.READ),
     ],
@@ -66,6 +67,7 @@ exports.BUILTIN_PERMISSIONS = {
     _id: exports.BUILTIN_PERMISSION_IDS.WRITE,
     name: "Read/Write",
     permissions: [
+      new Permission(PermissionTypes.QUERY, PermissionLevels.WRITE),
       new Permission(PermissionTypes.TABLE, PermissionLevels.WRITE),
       new Permission(PermissionTypes.VIEW, PermissionLevels.READ),
     ],
@@ -90,6 +92,7 @@ exports.BUILTIN_PERMISSIONS = {
       new Permission(PermissionTypes.AUTOMATION, PermissionLevels.ADMIN),
       new Permission(PermissionTypes.VIEW, PermissionLevels.ADMIN),
       new Permission(PermissionTypes.WEBHOOK, PermissionLevels.READ),
+      new Permission(PermissionTypes.QUERY, PermissionLevels.ADMIN),
     ],
   },
 }