This change allows each route to express policies for interpreting and parsing
the request body. Before this change uploads to entries or treatments api
would error if they were larger than 100Kb due to the preference being set for
the whole server. This change removes the global preference in favor of
allowing each route to choose it's own request size limit.
We also refactor usage of body-parser to be more consistent throughout the code
base. Most routes can use jsonParser, rawPraser, and urlencodedParser provided
by the common wares component. Anything doing something else should be called
out as such. For example, treatments, activity, and entries allow uploads up
to 50Mb. Other v1 endpoints are using the common configuration set to 1Mb.
* Adds a new method for the server to push notifies to the client, which require administration privileges from the user. If there are messages in queue but user is not privileged, she is notified of pending messages
* Fix unit tests
* Increase timeouts on tests
* Add translations
* * Aggregate admin messages
* Send admin message on auth fail
* Sending messages over bus
* XSS filtering of objects sent over the REST API
* Warn users if their instance is world readable
* Fix adminnotifies init()
* Fix couple issues from Codacy
* On periodic polls, only load delta for CGM data, treatments and device statuses
* Serve basic CGM data API queries from in-memory cache. Increases the Nightscout memory footprint but should significantly reduce the Mongo load
* Serve device status, CGM and treatment records from memory cache
* Support count parameter in /profile
* upgrade mocha from 3.5.3 to 5.0.5
This resolves these security issues
Low Regular Expression Denial of Service
Package debug
Dependency of mocha [dev]
Path mocha > debug
More info https://nodesecurity.io/advisories/534
Critical Command Injection
Package growl
Dependency of mocha [dev]
Path mocha > growl
More info https://nodesecurity.io/advisories/146
* upgrade mocha and start modularizing lodash to make sure tests pass
* more lodash modularization
* upgrade mqtt to 2.18.3
* allow npm 6.2
* upgrade share2nightscout-bridge
* incorporate express-extension-to-accept into Nightscout
the packages seems not maintained (github page is 404) and has a security issue with mime package. so upgraded and included into Nightscout code.
if somebody knows a more efficient way of programming this with express4 please PR
* update jsdom for security fixes
* prevent wrapping of hour labels by removing the space
* Revert "update jsdom for security fixes"
This reverts commit 04f1f39d636d8d79c6b01b5f298f9a6cea3dc645.
* Revert "more lodash modularization"
This reverts commit c4fa5304db9f16b94f15c2b44793a5a11d595885.
* remove forever dependency
* Revert "Revert "more lodash modularization""
This reverts commit b13c274ebff0b5c3a48ffc0e610ca85a9f8d25bc.
* fix report.test.js with newer packages
sometimes a fix is very easy. This is to prevent:
```
Deprecation warning: value provided is not in a recognized RFC2822 or ISO format. moment construction falls back to js Date(), which is not reliable across all browsers and versions. Non RFC2822/ISO date formats are discouraged and will be removed in an upcoming major release. Please refer to http://momentjs.com/guides/#/warnings/js-date/ for more info.
Arguments:
[0] _isAMomentObject: true, _isUTC: true, _useUTC: true, _l: undefined, _i: T00:00:00, _f: undefined, _strict: undefined, _locale: [object Object]
Error
at Function.createFromInputFallback (XXX\cgm-remote-monitor\tmp\js\bundle.js:117408:98)
at configFromString (XXX\cgm-remote-monitor\tmp\js\bundle.js:119456:15)
```
We must use ISO8601 formatted strings and not use slashes in dates, see https://github.com/moment/moment/issues/1407#issuecomment-155630060
* upgrade webpack to 4.16.2
* Update package.json
Using all(...) in this manner allows middleware from router A to
not affect router B.
As a result, sendJSONStatus and ability to optionally end in
.json disappeared, which this patch also restores.
CC: @jasoncalabrese
With this change, I can successfully restrict reads to entries
vs status vs other things without the middleware leakage we
observed earlier.
* try again
* try with compression
* fix export
* try 1MB limit
* try with different version of body-parser
* try limits again
* try setting limit AGAIN
* keep trying
* try harder-er
* try alternate verisno
None of these attempts appeared fruitful, but hard to tell if they were
required or not.
This allows a query such as this to search for events of hypoglycemia for
example:
curl -g localhost:3434 \
/api/v1/entries \
'?find[sgv][$lte]=70&find[sgv][$gte]=20&count=1000
It's possible to construct most mongo queries by url encoding the query string.
In this instance, mongo performs poorly when searching for lte/gte for strings.
In order for ranged queries to perform properly, the query parameters must be
set to integer type. There is a quick and ugly helper to ensure that some sgv
queries will be respected as integer searches.
Ben West
JakobandSulka Haro
Jeremy Cunningham
PieterGitandSulka Haro
Pete Schwamb
Jason Calabrese
MilosKozak
Jason Calabrese