Amberbase Backend

.gitignore

@@ -3,6 +3,8 @@ node_modules
 dist
 Thumbs.db
 deploy.sh
+backend/migration/*.json
+backend/migration/*.sql
 
 # local env files
 .env

README.md

@@ -6,18 +6,15 @@
 [![License](https://img.shields.io/badge/license-MIT-88b544.svg?style=flat-square)](./LICENSE)
 [![Contribution Guidlines](https://img.shields.io/badge/contributions-welcome-88b544.svg?style=flat-square)](./.github/CONTRIBUTING.md)
 
-A song management web application to store, sync and present songs and setlists, based on [Vue.js](//vuejs.org) and [Firebase](//firebase.google.com). Head over to the docs ([EN](https://github.com/devmount/SongDrive/blob/main/frontend/src/docs/docs.en.md), [DE](https://github.com/devmount/SongDrive/blob/main/frontend/src/docs/docs.en.md)) for more information about SongDrive and how to get started.
-
-> [!NOTE]
-> SongDrive is currently being restructured to have its own backend with database, authentication and API endpoints for the frontend. Find more information about this in <https://github.com/devmount/SongDrive/issues/213>.
+A song management web application to store, sync and present songs and setlists, based on [Vue.js](//vuejs.org) and [Amberbase](https://github.com/amberbase/amberbase). Head over to the docs ([EN](https://github.com/devmount/SongDrive/blob/main/frontend/src/docs/docs.en.md), [DE](https://github.com/devmount/SongDrive/blob/main/frontend/src/docs/docs.en.md)) for more information about SongDrive and how to get started.
 
 ## Preview
 
 This is how the SongDrive Dashboard currently looks like.
 
 ![20230725_songdrive_dashboard](https://github.com/devmount/SongDrive/assets/5441654/94df7e1a-3c65-460e-817d-24c1783e7685)
 
-*A demo page is planned.*
+*A demo page is coming soon™.*
 
 ## Features
 
@@ -32,12 +29,12 @@ This is how the SongDrive Dashboard currently looks like.
 - Use Hotkeys for almost anything (hotkey cheatsheet included)
 - Analyze general, setlist and user specific stats
 - UI supports multiple languages (currently: EN, DE)
-- Users can [manage their own profile](https://github.com/devmount/SongDrive/blob/main/frontend/src/docs/docs.en.md#account), change email and password or delete their account.
+- Users can [manage their own profile](https://github.com/devmount/SongDrive/blob/main/frontend/src/docs/docs.en.md#account) and change their password.
 - Many admin functions including export and Import of complete SongDrive data and managing users with [different roles](https://github.com/devmount/SongDrive/blob/main/frontend/src/docs/docs.en.md#user-roles)
 
 ## Code structure
 
-SongDrive is divided into frontend and backend. The goal is to make both parts independent from each other. The restructuring is still work in progress. You can find documentation in the corresponding directory:
+SongDrive is divided into frontend and backend. Both parts operate independent from each other. You can find documentation in the corresponding directory:
 
 - [Frontend docs](./frontend/README.md)
 - [Backend docs](./backend/README.md)

backend/README.md

@@ -1,9 +1,15 @@
-# ![SongDrive Logo Title](https://github.com/devmount/SongDrive/assets/5441654/77b68e2d-a877-4855-bece-c067f2219e71)   backend
+# ![SongDrive Logo Title](https://github.com/devmount/SongDrive/assets/5441654/77b68e2d-a877-4855-bece-c067f2219e71) :: Backend
 
-This directory contains all backend functionality of SongDrive.
+This directory contains all backend functionality of SongDrive. It is build with [Amberbase](https://github.com/amberbase/amberbase).
 
-> <picture>
-> <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/Mqxx/GitHub-Markdown/main/blockquotes/badge/light-theme/info.svg">
-> <img alt="Info" src="https://raw.githubusercontent.com/Mqxx/GitHub-Markdown/main/blockquotes/badge/dark-theme/info.svg">
-> </picture><br>
-> This is currently work in progress.
+## Get started
+
+Make sure, MariaDB is installed.
+
+```bash
+cd backend
+npm run build
+npm run start
+```
+
+Now, the backend UI can be accessed via <http://localhost:3000/amber/ui/login>.

backend/definitions.ts

@@ -0,0 +1,139 @@
+/**
+ * Available song tags
+ */
+export enum SongTag {
+  Adoration = 'adoration',
+  Assurance = 'assurance',
+  Beauty = 'beauty',
+  Blessing = 'blessing',
+  Celebration = 'celebration',
+  Children = 'children',
+  Christmas = 'christmas',
+  Comfort = 'comfort',
+  Commitment = 'commitment',
+  Communion = 'communion',
+  Creation = 'creation',
+  Cross = 'cross',
+  Declaration = 'declaration',
+  Desire = 'desire',
+  Easter = 'easter',
+  Encouragement = 'encouragement',
+  Evangelism = 'evangelism',
+  Faith = 'faith',
+  Faithfulness = 'faithfulness',
+  Father = 'father',
+  Forgiveness = 'forgiveness',
+  Freedom = 'freedom',
+  Glory = 'glory',
+  Grace = 'grace',
+  Greatness = 'greatness',
+  Guidance = 'guidance',
+  Healing = 'healing',
+  Holiness = 'holiness',
+  HolySpirit = 'holyspirit',
+  Hope = 'hope',
+  Humility = 'humility',
+  Jesus = 'jesus',
+  Joy = 'joy',
+  Kingship = 'kingship',
+  Life = 'life',
+  Light = 'light',
+  Longing = 'longing',
+  Love = 'love',
+  Obedience = 'obedience',
+  Peace = 'peace',
+  Petition = 'petition',
+  Power = 'power',
+  Praise = 'praise',
+  Prayer = 'prayer',
+  Presence = 'presence',
+  Rest = 'rest',
+  Resurrection = 'resurrection',
+  Revival = 'revival',
+  Sacrifice = 'sacrifice',
+  Salvation = 'salvation',
+  Strength = 'strength',
+  Surrender = 'surrender',
+  Thankfulness = 'thankfulness',
+  Trust = 'trust',
+  Truth = 'truth',
+  Unity = 'unity',
+  Victory = 'victory',
+  Worship = 'worship',
+}
+
+/**
+ * Available song languges
+ */
+export enum SongLanguage {
+  DE = 'de',
+  EN = 'en',
+  FR = 'fr',
+  HE = 'he',
+  LI = 'li',
+}
+
+/**
+ * Supported user permission roles
+ */
+export enum UserRole {
+	Admin = 'admin',
+	Editor = 'editor',
+	Performer = 'performer',
+	Reader = 'reader',
+};
+
+/**
+ * Ownership/visibility context for actions whose access depends on a
+ * specific document rather than just the user's role (e.g. setlist
+ * update/delete, which the backend also gates by ownership and isPublic
+ * per the setlists collection's accessRights in backend/index.ts).
+ */
+export type CanContext = {
+  userId?: string;
+  ownerId?: string;
+  isPublic?: boolean;
+};
+
+/**
+ * Ruleset to check of a given roles list
+ */
+export const can = (action: string, roles: UserRole[], context?: CanContext): boolean => {
+  // Check valid input
+  if (!action || !roles) return false;
+
+  // Get the highes role from the given list of roles
+  const level = {
+    [UserRole.Admin]: 8,
+	  [UserRole.Editor]: 4,
+	  [UserRole.Performer]: 2,
+	  [UserRole.Reader]: 1,
+  };
+  const highestRole = roles.toSorted((a, b) => level[a] - level[b])[0];
+
+  // Admins are allowed in general
+  if (highestRole === UserRole.Admin) {
+    return true;
+  }
+
+  // All others are assigned as defined here
+  switch (action) {
+    case 'createSetlists':
+      return [UserRole.Editor, UserRole.Performer].includes(highestRole);
+    case 'updateSetlists':
+      // owned by the current user, or public and editor/performer
+      if (!context) return false;
+      if (context.userId && context.userId === context.ownerId) return true;
+      return !!context.isPublic && [UserRole.Editor, UserRole.Performer].includes(highestRole);
+    case 'deleteSetlists':
+      // editors may delete any setlist, others only their own
+      if (highestRole === UserRole.Editor) return true;
+      return !!context && !!context.userId && context.userId === context.ownerId;
+    case 'createSongs':
+    case 'updateSongs':
+    case 'deleteSongs':
+      return [UserRole.Editor].includes(highestRole);
+    default:
+      return false;
+  }
+}

backend/index.ts

@@ -0,0 +1,116 @@
+import { amber, CollectionAccessAction, UserContext } from 'amberbase';
+import cookieParser from 'cookie-parser';
+import express from 'express';
+import rateLimit from 'express-rate-limit';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+import { SetlistEntity, SongEntity } from './models.js';
+import { UserRole } from './definitions.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const appInit = amber()
+	.withConfig({
+		db_host: 'localhost',
+		db_password: 'root',
+		db_username: 'root',
+		db_name: 'songdrive',
+		db_port: 3306,
+	})
+	.withPath('/amber')
+	.withCollection<SongEntity>('songs', {
+		accessRights: {
+			[UserRole.Editor]: ['create', 'subscribe', 'update', 'delete'],
+			[UserRole.Performer]: ['subscribe'],
+			[UserRole.Reader]: ['subscribe']
+		}
+	})
+	.withCollection<SetlistEntity>('setlists', {
+		accessRights: (user: UserContext, doc: SetlistEntity | null, action: CollectionAccessAction) => {
+			// Public setlists can be created by editors and performers.
+			// Private setlists can be created by everyone.
+			if (action === 'create') {
+				if (user.roles.includes(UserRole.Editor) || user.roles.includes(UserRole.Performer)) {
+					return true;
+				}
+				if (user.roles.includes(UserRole.Reader)) {
+					return doc?.createdBy === user.userId && !doc?.isPublic;
+				}
+				return false;
+			}
+			// Setlists can be subscribed to by all roles, but only public setlists can be read per default.
+			// This is done via access tags below.
+			if (action === 'subscribe') {
+				return user.roles.includes(UserRole.Editor) || user.roles.includes(UserRole.Performer) || user.roles.includes(UserRole.Reader);
+			}
+			// Setlists can be deleted by editors or the corresponding creator.
+			if (action === 'delete') {
+				return user.roles.includes(UserRole.Editor) || doc?.createdBy === user.userId;
+			}
+			// Setlists can be updated by the corresponding creator.
+			// Public setlists can be updated by editors and performers.
+			if (action === 'update') {
+				if (doc?.createdBy === user.userId) {
+					return true;
+				}
+				if (doc?.isPublic && (user.roles.includes(UserRole.Editor) || user.roles.includes(UserRole.Performer))) {
+					return true;
+				}
+				return false;
+			}
+
+			return false;
+		},
+
+		// The owner of a private setlist can share it with other users
+		accessTagsFromDocument: (doc: SetlistEntity) => {
+			const tags = [`o-${doc.createdBy}`];
+			if (doc.isPublic) {
+				tags.push('public');
+			} else {
+				doc.sharedWith.forEach((userId) => {
+					tags.push(`s-${userId}`);
+				});
+			}
+			return tags;
+		},
+		accessTagsFromUser: (user: UserContext) => [
+			'public',
+			`o-${user.userId}`,
+			`s-${user.userId}`,
+		],
+	})
+	.withUi({
+		availableRoles: [UserRole.Editor, UserRole.Performer, UserRole.Reader],
+		theme: 'dark',
+		loginTargetUrl: '/#/tenant={tenant}',
+		title: 'SongDrive Manager',
+	});
+
+const expressApp = express();
+const amberApp = await appInit.create(expressApp);
+
+expressApp.use(cookieParser())
+expressApp.use(express.static(path.join(__dirname, 'static')));
+
+expressApp.get('/version', (_req, res) => {
+	res.send(`Version: 1.2.3`);
+});
+
+// Fallback to the SPA entry point for client-side routes (e.g. /profile) on hard reload.
+// Splat was chosen as conventional default name.
+const spaFallbackLimiter = rateLimit({
+	windowMs: 60 * 1000,
+	limit: 100,
+	standardHeaders: true,
+	legacyHeaders: false,
+});
+expressApp.get('/*splat', spaFallbackLimiter, (_req, res) => {
+	res.sendFile(path.join(__dirname, 'static', 'index.html'));
+});
+
+amberApp.addAdminIfNotExists('admin@songdrive.de', 'Admin', 'password');
+amberApp.addOrUpdateTenant('default', 'Default Tenant', {});
+
+amberApp.listen(3333, '0.0.0.0');