Fix No admin access issue

model/access.js

@@ -53,6 +53,13 @@ AccessModel.prototype.createOrUpdateBase = async function(dbHelper) {
         grant TINYINT NOT NULL
         )`);
     try { await dbHelper.runSql("ALTER TABLE 'access' ADD COLUMN typeLabel STRING"); } catch (err) {}
+    if (!((await dbHelper.fetch(AccessModel, { accessTo: ACCESS_TO.admin }) || []).length)) {
+        let freeAdminAccess = new AccessModel();
+        freeAdminAccess.type = ACCESS_TYPE.everyOne;
+        freeAdminAccess.accessTo = ACCESS_TO.admin;
+        await dbHelper.insertOne(freeAdminAccess);
+        console.log("No Admin access detected ! Creating open admin access");
+    }
 }
 
 AccessModel.prototype.describe = function() {

router/api.js

@@ -34,17 +34,26 @@ function accessToJson(access) {
     };
 }
 
+async function accessListToJson(app, req) {
+    let result = {
+        ...(req.sessionObj?.accessList || {})
+    };
+    result.isAdmin = await req.sessionObj?.accessList?.isAdmin?.(app, result) || false;
+    delete result.isAdmin_;
+    return result;
+}
+
 module.exports = { register: app => {
-    app.router.post("/api/database/reload", (req, res) => {
+    app.router.post("/api/database/reload", async (req, res) => {
         app.routerUtils.onApiRequest(req, res);
-        if (!req.sessionObj?.accessList?.isAdmin)
+        if (!await req.sessionObj?.accessList?.isAdmin(app, req.sessionObj?.accessList))
             return app.routerUtils.onBadRequest(res);
         app.libraryManager.updateLibraries(app.databaseHelper).finally(x => { require('../src/autotagBuilder').rebuildPathTags(app); });
         app.routerUtils.jsonResponse(res, {});
     });
-    app.router.get("/api/access/list", (req, res) => {
+    app.router.get("/api/access/list", async (req, res) => {
         app.routerUtils.onApiRequest(req, res);
-        app.routerUtils.jsonResponse(res, req.sessionObj?.accessList || {});
+        app.routerUtils.jsonResponse(res, await accessListToJson(app, req));
     });
     app.router.post("/api/access/link", async (req, res) => { // /api/access/link, post: { linkIds: [string] (JSON) }
         app.routerUtils.onApiRequest(req, res);
@@ -64,7 +73,7 @@ module.exports = { register: app => {
             console.error(err);
             return app.routerUtils.onBadRequest(res);
         }
-        app.routerUtils.jsonResponse(res, req.sessionObj.accessList);
+        app.routerUtils.jsonResponse(res, await accessListToJson(app, req));
     });
     app.router.del("/api/access/:id", async (req, res) => {
         app.routerUtils.onApiRequest(req, res);
@@ -75,7 +84,7 @@ module.exports = { register: app => {
     });
     app.router.post("/api/accessAdmin/create", async (req, res) => {
         app.routerUtils.onApiRequest(req, res);
-        if (!req.sessionObj?.accessList?.isAdmin || !req.body)
+        if (!await req.sessionObj?.accessList?.isAdmin(app, req.sessionObj?.accessList) || !req.body)
             return app.routerUtils.onBadRequest(res);
         let access = new AccessModel();
         access.type = parseInt(req.body.typeId);
@@ -95,14 +104,14 @@ module.exports = { register: app => {
     });
     app.router.del("/api/accessAdmin/:id", async (req, res) => {
         app.routerUtils.onApiRequest(req, res);
-        if (!req.sessionObj?.accessList?.isAdmin || !req.params.id)
+        if (!await req.sessionObj?.accessList?.isAdmin(app, req.sessionObj?.accessList) || !req.params.id)
             return app.routerUtils.onBadRequest(res);
         app.databaseHelper.remove(AccessModel, { id: parseInt(req.params.id) });
         app.routerUtils.jsonResponse(res, {});
     });
     app.router.post("/api/accessAdmin/:id", async (req, res) => {
         app.routerUtils.onApiRequest(req, res);
-        if (!req.sessionObj?.accessList?.isAdmin || !req.params.id || !req.body)
+        if (!await req.sessionObj?.accessList?.isAdmin(app, req.sessionObj?.accessList) || !req.params.id || !req.body)
             return app.routerUtils.onBadRequest(res);
         const access = (await app.databaseHelper.fetch(AccessModel, { id: parseInt(req.params.id) }))?.[0];
         if (!access)
@@ -123,7 +132,7 @@ module.exports = { register: app => {
     });
     app.router.get("/api/accessAdmin/list", async (req, res) => {
         app.routerUtils.onApiRequest(req, res);
-        if (!req.sessionObj?.accessList?.isAdmin)
+        if (!await req.sessionObj?.accessList?.isAdmin(app, req.sessionObj?.accessList))
             return app.routerUtils.onBadRequest(res);
         app.routerUtils.jsonResponse(res, (await app.databaseHelper.fetch(AccessModel)).map(accessToJson));
     });

src/filetype/imagemagick.js

@@ -55,7 +55,7 @@ function readMeta(path) {
             }
             ok(meta);
         } catch (err) {
-            console.error("readMeta from Imagemagick: ", err);
+            console.error("readMeta", path, "from Imagemagick:", err);
             ko(err);
         }
     });

src/security.js

@@ -1,6 +1,7 @@
 
 const crypto = require('crypto');
 const MD5 = require('craftlabhttpserver/src/md5sum.js').string;
+const { AccessModel, ACCESS_TO, ACCESS_TYPE } = require('../model/access.js');
 
 module.exports = require('craftlabhttpserver/src/security.js');
 
@@ -35,7 +36,12 @@ module.exports.createSession = req => {
         ipAddress: module.exports.getRequestIp(req),
         data: {
             accessList: {
-                isAdmin: false
+                isAdmin: async (app, accessList) => {
+                    if (accessList.isAdmin_)
+                        return true;
+                    return ((await app.databaseHelper.fetch(AccessModel, { accessTo: ACCESS_TO.admin, type: ACCESS_TYPE.everyOne })) || []).length > 0;
+                },
+                isAdmin_: false
             }
         }
     };
@@ -49,7 +55,7 @@ module.exports.setAdmin = (req, val) => {
     let session = module.exports.getSessionObj(req.cookies);
     if (!session)
         return;
-    session.accessList.isAdmin = val;
+    session.accessList.isAdmin_ = val;
     return session.accessList;
 };
 module.exports.addLinkToSession = (req, dbId, linkId, linkLabel) => {
@@ -70,6 +76,6 @@ module.exports.removeFromSession = (req, accessId) => {
 };
 
 module.exports.setAdminFlat = () => {
-    session.accessList.isAdmin = true;
+    session.accessList.isAdmin_ = true;
 }
 

static/public/js/uiShare.js

@@ -145,6 +145,8 @@ function buildShareItemHeader(htmlId, data, accordionBody) {
     headerButton.textContent = data.typeLabel || data.typeData;
     headerButton.ariaExpanded = false;
     headerButton.ariaControls = htmlId;
+    if (data.typeId === 4)
+        headerButton.textContent = "Everyone"
     let accordionBodyContainer = document.createElement("div");
     accordionBodyContainer.className = "accordion-collapse collapse row";
     accordionBodyContainer.dataset.bsParent = "#pch-share-container";