Bump js-yaml from 4.3.0 to 4.3.1

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.3.0...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

package-lock.json

@@ -70,7 +70,7 @@
                 "input-otp": "1.4.2",
                 "ioredis": "5.11.0",
                 "jmespath": "0.16.0",
-                "js-yaml": "4.3.0",
+                "js-yaml": "4.3.1",
                 "jsonwebtoken": "9.0.3",
                 "lucide-react": "1.17.0",
                 "maxmind": "5.0.6",
@@ -13633,9 +13633,9 @@
             "license": "MIT"
         },
         "node_modules/js-yaml": {
-            "version": "4.3.0",
-            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-            "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+            "version": "4.3.1",
+            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+            "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
             "funding": [
                 {
                     "type": "github",
@@ -17072,9 +17072,9 @@
             }
         },
         "node_modules/socket.io-parser": {
-            "version": "4.2.7",
-            "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.7.tgz",
-            "integrity": "sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg==",
+            "version": "4.2.6",
+            "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.6.tgz",
+            "integrity": "sha512-asJqbVBDsBCJx0pTqw3WfesSY0iRX+2xzWEWzrpcH7L6fLzrhyF8WPI8UaeM4YCuDfpwA/cgsdugMsmtz8EJeg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {

package.json

@@ -93,7 +93,7 @@
         "input-otp": "1.4.2",
         "ioredis": "5.11.0",
         "jmespath": "0.16.0",
-        "js-yaml": "4.3.0",
+        "js-yaml": "4.3.1",
         "jsonwebtoken": "9.0.3",
         "lucide-react": "1.17.0",
         "maxmind": "5.0.6",

server/routers/role/createRole.ts

@@ -34,7 +34,9 @@ const createRoleSchema = z.strictObject({
 export const defaultRoleAllowedActions: ActionsEnum[] = [
     ActionsEnum.getOrg,
     ActionsEnum.getResource,
-    ActionsEnum.listResources
+    ActionsEnum.listResources,
+    ActionsEnum.getSiteResource,
+    ActionsEnum.listSiteResources
 ];
 
 export type CreateRoleBody = z.infer<typeof createRoleSchema>;

server/routers/siteResource/listAllSiteResourcesByOrg.ts

@@ -3,11 +3,13 @@ import {
     DB_TYPE,
     Label,
     SiteResource,
+    roleSiteResources,
     siteNetworks,
     siteResourceLabels,
     siteResources,
     sites,
-    labels
+    labels,
+    userSiteResources
 } from "@server/db";
 import response from "@server/lib/response";
 import logger from "@server/logger";
@@ -323,7 +325,48 @@ export async function listAllSiteResourcesByOrg(
             labels: labelFilter
         } = parsedQuery.data;
 
-        const conditions = [and(eq(siteResources.orgId, orgId))];
+        let accessibleSiteResourceIds: number[];
+        if (req.user) {
+            const accessibleSiteResources = await db
+                .select({
+                    siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
+                })
+                .from(userSiteResources)
+                .fullJoin(
+                    roleSiteResources,
+                    eq(
+                        userSiteResources.siteResourceId,
+                        roleSiteResources.siteResourceId
+                    )
+                )
+                .where(
+                    or(
+                        eq(userSiteResources.userId, req.user.userId),
+                        inArray(
+                            roleSiteResources.roleId,
+                            req.userOrgRoleIds ?? []
+                        )
+                    )
+                );
+            accessibleSiteResourceIds = accessibleSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        } else {
+            const allOrgSiteResources = await db
+                .select({ siteResourceId: siteResources.siteResourceId })
+                .from(siteResources)
+                .where(eq(siteResources.orgId, orgId));
+            accessibleSiteResourceIds = allOrgSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        }
+
+        const conditions = [
+            and(
+                eq(siteResources.orgId, orgId),
+                inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
+            )
+        ];
 
         if (siteId != null) {
             // Keep inner joins here: filtering by a specific site implies the

server/routers/siteResource/listSiteResources.ts

@@ -1,11 +1,17 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, networks, siteNetworks } from "@server/db";
+import {
+    db,
+    networks,
+    roleSiteResources,
+    siteNetworks,
+    userSiteResources
+} from "@server/db";
 import { siteResources, sites, SiteResource } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
-import { and, asc, desc, eq } from "drizzle-orm";
+import { and, asc, desc, eq, inArray, or, sql } from "drizzle-orm";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -159,10 +165,47 @@ export async function listSiteResources(
             return next(createHttpError(HttpCode.NOT_FOUND, "Site not found"));
         }
 
+        let accessibleSiteResourceIds: number[];
+        if (req.user) {
+            const accessibleSiteResources = await db
+                .select({
+                    siteResourceId: sql<number>`COALESCE(${userSiteResources.siteResourceId}, ${roleSiteResources.siteResourceId})`
+                })
+                .from(userSiteResources)
+                .fullJoin(
+                    roleSiteResources,
+                    eq(
+                        userSiteResources.siteResourceId,
+                        roleSiteResources.siteResourceId
+                    )
+                )
+                .where(
+                    or(
+                        eq(userSiteResources.userId, req.user.userId),
+                        inArray(
+                            roleSiteResources.roleId,
+                            req.userOrgRoleIds ?? []
+                        )
+                    )
+                );
+            accessibleSiteResourceIds = accessibleSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        } else {
+            const allOrgSiteResources = await db
+                .select({ siteResourceId: siteResources.siteResourceId })
+                .from(siteResources)
+                .where(eq(siteResources.orgId, orgId));
+            accessibleSiteResourceIds = allOrgSiteResources.map(
+                (row) => row.siteResourceId
+            );
+        }
+
         // Get site resources by joining networks to siteResources via siteNetworks
         const conditions = [
             eq(siteNetworks.siteId, siteId),
-            eq(siteResources.orgId, orgId)
+            eq(siteResources.orgId, orgId),
+            inArray(siteResources.siteResourceId, accessibleSiteResourceIds)
         ];
 
         if (typeof status !== "undefined") {

server/setup/migrationsPg.ts

@@ -28,6 +28,7 @@ import m19 from "./scriptsPg/1.18.4";
 import m20 from "./scriptsPg/1.19.0";
 import m21 from "./scriptsPg/1.20.0";
 import m22 from "./scriptsPg/1.21.0";
+import m23 from "./scriptsPg/1.21.1";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -55,7 +56,8 @@ const migrations = [
     { version: "1.18.4", run: m19 },
     { version: "1.19.0", run: m20 },
     { version: "1.20.0", run: m21 },
-    { version: "1.21.0", run: m22 }
+    { version: "1.21.0", run: m22 },
+    { version: "1.21.1", run: m23 }
     // Add new migrations here as they are created
 ] as {
     version: string;

server/setup/migrationsSqlite.ts

@@ -47,6 +47,7 @@ import m41 from "./scriptsSqlite/1.19.0";
 import m42 from "./scriptsSqlite/1.19.1";
 import m43 from "./scriptsSqlite/1.20.0";
 import m44 from "./scriptsSqlite/1.21.0";
+import m45 from "./scriptsSqlite/1.21.1";
 
 // THIS CANNOT IMPORT ANYTHING FROM THE SERVER
 // EXCEPT FOR THE DATABASE AND THE SCHEMA
@@ -91,7 +92,8 @@ const migrations = [
     { version: "1.19.0", run: m41 },
     { version: "1.19.1", run: m42 },
     { version: "1.20.0", run: m43 },
-    { version: "1.21.0", run: m44 }
+    { version: "1.21.0", run: m44 },
+    { version: "1.21.1", run: m45 }
     // Add new migrations here as they are created
 ] as const;
 

server/setup/scriptsPg/1.21.1.ts

@@ -0,0 +1,37 @@
+import { db } from "@server/db/pg/driver";
+import { sql } from "drizzle-orm";
+
+const version = "1.21.1";
+
+const actionsToGrant = ["getSiteResource", "listSiteResources"] as const;
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    try {
+        await db.execute(sql`BEGIN`);
+
+        for (const actionId of actionsToGrant) {
+            await db.execute(sql`
+                INSERT INTO "roleActions" ("roleId", "actionId", "orgId")
+                SELECT r."roleId", ${actionId}, r."orgId"
+                FROM "roles" r
+                WHERE COALESCE(r."isAdmin", false) = false
+                  AND NOT EXISTS (
+                    SELECT 1 FROM "roleActions" ra
+                    WHERE ra."roleId" = r."roleId"
+                      AND ra."actionId" = ${actionId}
+                      AND ra."orgId" = r."orgId"
+                  );
+            `);
+        }
+
+        await db.execute(sql`COMMIT`);
+        console.log(`Finished setup script ${version}`);
+    } catch (e) {
+        await db.execute(sql`ROLLBACK`);
+        console.log("Unable to migrate database");
+        console.log(e);
+        throw e;
+    }
+}

server/setup/scriptsSqlite/1.21.1.ts

@@ -0,0 +1,43 @@
+import { APP_PATH } from "@server/lib/consts";
+import Database from "better-sqlite3";
+import path from "path";
+
+const version = "1.21.1";
+
+const actionsToGrant = ["getSiteResource", "listSiteResources"] as const;
+
+export default async function migration() {
+    console.log(`Running setup script ${version}...`);
+
+    const location = path.join(APP_PATH, "db", "db.sqlite");
+    const db = new Database(location);
+
+    try {
+        db.transaction(() => {
+            const insertRoleAction = db.prepare(`
+                INSERT INTO 'roleActions' ("roleId", "actionId", "orgId")
+                SELECT r."roleId", ?, r."orgId"
+                FROM 'roles' r
+                WHERE COALESCE(r."isAdmin", 0) = 0
+                  AND NOT EXISTS (
+                    SELECT 1 FROM 'roleActions' ra
+                    WHERE ra."roleId" = r."roleId"
+                      AND ra."actionId" = ?
+                      AND ra."orgId" = r."orgId"
+                  );
+            `);
+
+            for (const actionId of actionsToGrant) {
+                insertRoleAction.run(actionId, actionId);
+            }
+        })();
+
+        console.log(`Finished setup script ${version}`);
+    } catch (e) {
+        console.log("Unable to migrate database");
+        console.log(e);
+        throw e;
+    } finally {
+        db.close();
+    }
+}

src/components/ContactSalesBanner.tsx

@@ -24,19 +24,21 @@ export function ContactSalesBanner() {
                             <ExternalLink className="size-3.5 shrink-0" />
                         </Link>
                         {" " + t("contactSalesOr") + " "}
-                        <Link
-                            href="https://pangolin.net/contact"
-                            target="_blank"
-                            rel="noopener noreferrer"
-                            className="inline-flex items-center gap-1 font-medium text-black-600 underline"
-                        >
-                            {t("contactSalesContactUs")}
-                            <ExternalLink className="size-3.5 shrink-0" />
-                        </Link>
-                        .
+                        <span className="whitespace-nowrap">
+                            <Link
+                                href="https://pangolin.net/contact"
+                                target="_blank"
+                                rel="noopener noreferrer"
+                                className="inline-flex items-center gap-1 font-medium text-black-600 underline"
+                            >
+                                {t("contactSalesContactUs")}
+                                <ExternalLink className="size-3.5 shrink-0" />
+                            </Link>
+                            .
+                        </span>
                     </span>
                 </div>
             </div>
         </div>
     );
-}
+}

src/components/MfaInputForm.tsx

@@ -13,7 +13,7 @@ import {
 import { InputOTP, InputOTPGroup, InputOTPSlot } from "./ui/input-otp";
 import { Alert, AlertDescription } from "@app/components/ui/alert";
 import { useTranslations } from "next-intl";
-import { REGEXP_ONLY_DIGITS } from "input-otp";
+import { REGEXP_ONLY_DIGITS_AND_CHARS } from "input-otp";
 
 const MFA_OTP_INPUT_ID = "mfa-otp-code";
 
@@ -82,9 +82,11 @@ export default function MfaInputForm({
                                             maxLength={6}
                                             {...field}
                                             autoComplete="one-time-code"
-                                            inputMode="numeric"
+                                            inputMode="text"
                                             autoFocus
-                                            pattern={REGEXP_ONLY_DIGITS}
+                                            pattern={
+                                                REGEXP_ONLY_DIGITS_AND_CHARS
+                                            }
                                             onChange={(value: string) => {
                                                 field.onChange(value);
                                                 if (value.length === 6) {