@budibase/backend-core 2.9.19 → 2.9.20

package/src/security/encryption.ts

@@ -1,179 +0,0 @@
-import crypto from "crypto"
-import fs from "fs"
-import zlib from "zlib"
-import env from "../environment"
-import { join } from "path"
-
-const ALGO = "aes-256-ctr"
-const SEPARATOR = "-"
-const ITERATIONS = 10000
-const STRETCH_LENGTH = 32
-
-const SALT_LENGTH = 16
-const IV_LENGTH = 16
-
-export enum SecretOption {
-  API = "api",
-  ENCRYPTION = "encryption",
-}
-
-export function getSecret(secretOption: SecretOption): string {
-  let secret, secretName
-  switch (secretOption) {
-    case SecretOption.ENCRYPTION:
-      secret = env.ENCRYPTION_KEY
-      secretName = "ENCRYPTION_KEY"
-      break
-    case SecretOption.API:
-    default:
-      secret = env.API_ENCRYPTION_KEY
-      secretName = "API_ENCRYPTION_KEY"
-      break
-  }
-  if (!secret) {
-    throw new Error(`Secret "${secretName}" has not been set in environment.`)
-  }
-  return secret
-}
-
-function stretchString(secret: string, salt: Buffer) {
-  return crypto.pbkdf2Sync(secret, salt, ITERATIONS, STRETCH_LENGTH, "sha512")
-}
-
-export function encrypt(
-  input: string,
-  secretOption: SecretOption = SecretOption.API
-) {
-  const salt = crypto.randomBytes(SALT_LENGTH)
-  const stretched = stretchString(getSecret(secretOption), salt)
-  const cipher = crypto.createCipheriv(ALGO, stretched, salt)
-  const base = cipher.update(input)
-  const final = cipher.final()
-  const encrypted = Buffer.concat([base, final]).toString("hex")
-  return `${salt.toString("hex")}${SEPARATOR}${encrypted}`
-}
-
-export function decrypt(
-  input: string,
-  secretOption: SecretOption = SecretOption.API
-) {
-  const [salt, encrypted] = input.split(SEPARATOR)
-  const saltBuffer = Buffer.from(salt, "hex")
-  const stretched = stretchString(getSecret(secretOption), saltBuffer)
-  const decipher = crypto.createDecipheriv(ALGO, stretched, saltBuffer)
-  const base = decipher.update(Buffer.from(encrypted, "hex"))
-  const final = decipher.final()
-  return Buffer.concat([base, final]).toString()
-}
-
-export async function encryptFile(
-  { dir, filename }: { dir: string; filename: string },
-  secret: string
-) {
-  const outputFileName = `${filename}.enc`
-
-  const filePath = join(dir, filename)
-  const inputFile = fs.createReadStream(filePath)
-  const outputFile = fs.createWriteStream(join(dir, outputFileName))
-
-  const salt = crypto.randomBytes(SALT_LENGTH)
-  const iv = crypto.randomBytes(IV_LENGTH)
-  const stretched = stretchString(secret, salt)
-  const cipher = crypto.createCipheriv(ALGO, stretched, iv)
-
-  outputFile.write(salt)
-  outputFile.write(iv)
-
-  inputFile.pipe(zlib.createGzip()).pipe(cipher).pipe(outputFile)
-
-  return new Promise<{ filename: string; dir: string }>(r => {
-    outputFile.on("finish", () => {
-      r({
-        filename: outputFileName,
-        dir,
-      })
-    })
-  })
-}
-
-async function getSaltAndIV(path: string) {
-  const fileStream = fs.createReadStream(path)
-
-  const salt = await readBytes(fileStream, SALT_LENGTH)
-  const iv = await readBytes(fileStream, IV_LENGTH)
-  fileStream.close()
-  return { salt, iv }
-}
-
-export async function decryptFile(
-  inputPath: string,
-  outputPath: string,
-  secret: string
-) {
-  const { salt, iv } = await getSaltAndIV(inputPath)
-  const inputFile = fs.createReadStream(inputPath, {
-    start: SALT_LENGTH + IV_LENGTH,
-  })
-
-  const outputFile = fs.createWriteStream(outputPath)
-
-  const stretched = stretchString(secret, salt)
-  const decipher = crypto.createDecipheriv(ALGO, stretched, iv)
-
-  const unzip = zlib.createGunzip()
-
-  inputFile.pipe(decipher).pipe(unzip).pipe(outputFile)
-
-  return new Promise<void>((res, rej) => {
-    outputFile.on("finish", () => {
-      outputFile.close()
-      res()
-    })
-
-    inputFile.on("error", e => {
-      outputFile.close()
-      rej(e)
-    })
-
-    decipher.on("error", e => {
-      outputFile.close()
-      rej(e)
-    })
-
-    unzip.on("error", e => {
-      outputFile.close()
-      rej(e)
-    })
-
-    outputFile.on("error", e => {
-      outputFile.close()
-      rej(e)
-    })
-  })
-}
-
-function readBytes(stream: fs.ReadStream, length: number) {
-  return new Promise<Buffer>((resolve, reject) => {
-    let bytesRead = 0
-    const data: Buffer[] = []
-
-    stream.on("readable", () => {
-      let chunk
-
-      while ((chunk = stream.read(length - bytesRead)) !== null) {
-        data.push(chunk)
-        bytesRead += chunk.length
-      }
-
-      resolve(Buffer.concat(data))
-    })
-
-    stream.on("end", () => {
-      reject(new Error("Insufficient data in the stream."))
-    })
-
-    stream.on("error", error => {
-      reject(error)
-    })
-  })
-}

package/src/security/permissions.ts

@@ -1,159 +0,0 @@
-import { PermissionType, PermissionLevel } from "@budibase/types"
-export { PermissionType, PermissionLevel } from "@budibase/types"
-import flatten from "lodash/flatten"
-import cloneDeep from "lodash/fp/cloneDeep"
-
-export type RoleHierarchy = {
-  permissionId: string
-}[]
-
-export class Permission {
-  type: PermissionType
-  level: PermissionLevel
-
-  constructor(type: PermissionType, level: PermissionLevel) {
-    this.type = type
-    this.level = level
-  }
-}
-
-export function levelToNumber(perm: PermissionLevel) {
-  switch (perm) {
-    // not everything has execute privileges
-    case PermissionLevel.EXECUTE:
-      return 0
-    case PermissionLevel.READ:
-      return 1
-    case PermissionLevel.WRITE:
-      return 2
-    case PermissionLevel.ADMIN:
-      return 3
-    default:
-      return -1
-  }
-}
-
-/**
- * Given the specified permission level for the user return the levels they are allowed to carry out.
- * @param {string} userPermLevel The permission level of the user.
- * @return {string[]} All the permission levels this user is allowed to carry out.
- */
-export function getAllowedLevels(userPermLevel: PermissionLevel): string[] {
-  switch (userPermLevel) {
-    case PermissionLevel.EXECUTE:
-      return [PermissionLevel.EXECUTE]
-    case PermissionLevel.READ:
-      return [PermissionLevel.EXECUTE, PermissionLevel.READ]
-    case PermissionLevel.WRITE:
-    case PermissionLevel.ADMIN:
-      return [
-        PermissionLevel.EXECUTE,
-        PermissionLevel.READ,
-        PermissionLevel.WRITE,
-      ]
-    default:
-      return []
-  }
-}
-
-export enum BuiltinPermissionID {
-  PUBLIC = "public",
-  READ_ONLY = "read_only",
-  WRITE = "write",
-  ADMIN = "admin",
-  POWER = "power",
-}
-
-export const BUILTIN_PERMISSIONS = {
-  PUBLIC: {
-    _id: BuiltinPermissionID.PUBLIC,
-    name: "Public",
-    permissions: [
-      new Permission(PermissionType.WEBHOOK, PermissionLevel.EXECUTE),
-    ],
-  },
-  READ_ONLY: {
-    _id: BuiltinPermissionID.READ_ONLY,
-    name: "Read only",
-    permissions: [
-      new Permission(PermissionType.QUERY, PermissionLevel.READ),
-      new Permission(PermissionType.TABLE, PermissionLevel.READ),
-      new Permission(PermissionType.VIEW, PermissionLevel.READ),
-    ],
-  },
-  WRITE: {
-    _id: BuiltinPermissionID.WRITE,
-    name: "Read/Write",
-    permissions: [
-      new Permission(PermissionType.QUERY, PermissionLevel.WRITE),
-      new Permission(PermissionType.TABLE, PermissionLevel.WRITE),
-      new Permission(PermissionType.VIEW, PermissionLevel.READ),
-      new Permission(PermissionType.AUTOMATION, PermissionLevel.EXECUTE),
-    ],
-  },
-  POWER: {
-    _id: BuiltinPermissionID.POWER,
-    name: "Power",
-    permissions: [
-      new Permission(PermissionType.TABLE, PermissionLevel.WRITE),
-      new Permission(PermissionType.USER, PermissionLevel.READ),
-      new Permission(PermissionType.AUTOMATION, PermissionLevel.EXECUTE),
-      new Permission(PermissionType.VIEW, PermissionLevel.READ),
-      new Permission(PermissionType.WEBHOOK, PermissionLevel.READ),
-    ],
-  },
-  ADMIN: {
-    _id: BuiltinPermissionID.ADMIN,
-    name: "Admin",
-    permissions: [
-      new Permission(PermissionType.TABLE, PermissionLevel.ADMIN),
-      new Permission(PermissionType.USER, PermissionLevel.ADMIN),
-      new Permission(PermissionType.AUTOMATION, PermissionLevel.ADMIN),
-      new Permission(PermissionType.VIEW, PermissionLevel.ADMIN),
-      new Permission(PermissionType.WEBHOOK, PermissionLevel.READ),
-      new Permission(PermissionType.QUERY, PermissionLevel.ADMIN),
-    ],
-  },
-}
-
-export function getBuiltinPermissions() {
-  return cloneDeep(BUILTIN_PERMISSIONS)
-}
-
-export function getBuiltinPermissionByID(id: string) {
-  const perms = Object.values(BUILTIN_PERMISSIONS)
-  return perms.find(perm => perm._id === id)
-}
-
-export function doesHaveBasePermission(
-  permType: PermissionType,
-  permLevel: PermissionLevel,
-  rolesHierarchy: RoleHierarchy
-) {
-  const basePermissions = [
-    ...new Set(rolesHierarchy.map(role => role.permissionId)),
-  ]
-  const builtins = Object.values(BUILTIN_PERMISSIONS)
-  let permissions = flatten(
-    builtins
-      .filter(builtin => basePermissions.indexOf(builtin._id) !== -1)
-      .map(builtin => builtin.permissions)
-  )
-  for (let permission of permissions) {
-    if (
-      permission.type === permType &&
-      getAllowedLevels(permission.level).indexOf(permLevel) !== -1
-    ) {
-      return true
-    }
-  }
-  return false
-}
-
-export function isPermissionLevelHigherThanRead(level: PermissionLevel) {
-  return levelToNumber(level) > 1
-}
-
-// utility as a lot of things need simply the builder permission
-export const BUILDER = PermissionType.BUILDER
-export const GLOBAL_BUILDER = PermissionType.GLOBAL_BUILDER