@budibase/backend-core 2.9.39-alpha.8 → 2.9.39

package/dist/src/middleware/csrf.js

@@ -1,60 +1,81 @@
 "use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var csrf_exports = {};
-__export(csrf_exports, {
-  default: () => csrf_default
-});
-module.exports = __toCommonJS(csrf_exports);
-var import_constants = require("../constants");
-var import_matchers = require("./matchers");
+Object.defineProperty(exports, "__esModule", { value: true });
+const constants_1 = require("../constants");
+const matchers_1 = require("./matchers");
+/**
+ * GET, HEAD and OPTIONS methods are considered safe operations
+ *
+ * POST, PUT, PATCH, and DELETE methods, being state changing verbs,
+ * should have a CSRF token attached to the request
+ */
 const EXCLUDED_METHODS = ["GET", "HEAD", "OPTIONS"];
+/**
+ * There are only three content type values that can be used in cross domain requests.
+ * If any other value is used, e.g. application/json, the browser will first make a OPTIONS
+ * request which will be protected by CORS.
+ */
 const INCLUDED_CONTENT_TYPES = [
-  "application/x-www-form-urlencoded",
-  "multipart/form-data",
-  "text/plain"
+    "application/x-www-form-urlencoded",
+    "multipart/form-data",
+    "text/plain",
 ];
-function csrf_default(opts = { noCsrfPatterns: [] }) {
-  const noCsrfOptions = (0, import_matchers.buildMatcherRegex)(opts.noCsrfPatterns);
-  return async (ctx, next) => {
-    const found = (0, import_matchers.matches)(ctx, noCsrfOptions);
-    if (found) {
-      return next();
-    }
-    if (EXCLUDED_METHODS.indexOf(ctx.method) !== -1) {
-      return next();
-    }
-    let contentType = ctx.get("content-type") ? ctx.get("content-type").toLowerCase() : "";
-    if (!INCLUDED_CONTENT_TYPES.filter((type) => contentType.includes(type)).length) {
-      return next();
-    }
-    if (ctx.internal) {
-      return next();
-    }
-    const userToken = ctx.user?.csrfToken;
-    if (!userToken) {
-      return next();
-    }
-    const requestToken = ctx.get(import_constants.Header.CSRF_TOKEN);
-    if (!requestToken || requestToken !== userToken) {
-      ctx.throw(403, "Invalid CSRF token");
-    }
-    return next();
-  };
+/**
+ * Validate the CSRF token generated aganst the user session.
+ * Compare the token with the x-csrf-token header.
+ *
+ * If the token is not found within the request or the value provided
+ * does not match the value within the user session, the request is rejected.
+ *
+ * CSRF protection provided using the 'Synchronizer Token Pattern'
+ * https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#synchronizer-token-pattern
+ *
+ */
+function default_1(opts = { noCsrfPatterns: [] }) {
+    const noCsrfOptions = (0, matchers_1.buildMatcherRegex)(opts.noCsrfPatterns);
+    return (ctx, next) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        // don't apply for excluded paths
+        const found = (0, matchers_1.matches)(ctx, noCsrfOptions);
+        if (found) {
+            return next();
+        }
+        // don't apply for the excluded http methods
+        if (EXCLUDED_METHODS.indexOf(ctx.method) !== -1) {
+            return next();
+        }
+        // don't apply when the content type isn't supported
+        let contentType = ctx.get("content-type")
+            ? ctx.get("content-type").toLowerCase()
+            : "";
+        if (!INCLUDED_CONTENT_TYPES.filter(type => contentType.includes(type)).length) {
+            return next();
+        }
+        // don't apply csrf when the internal api key has been used
+        if (ctx.internal) {
+            return next();
+        }
+        // apply csrf when there is a token in the session (new logins)
+        // in future there should be a hard requirement that the token is present
+        const userToken = (_a = ctx.user) === null || _a === void 0 ? void 0 : _a.csrfToken;
+        if (!userToken) {
+            return next();
+        }
+        // reject if no token in request or mismatch
+        const requestToken = ctx.get(constants_1.Header.CSRF_TOKEN);
+        if (!requestToken || requestToken !== userToken) {
+            ctx.throw(403, "Invalid CSRF token");
+        }
+        return next();
+    });
 }
-//# sourceMappingURL=csrf.js.map
+exports.default = default_1;
+//# sourceMappingURL=csrf.js.map

package/dist/src/middleware/csrf.js.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../../../src/middleware/csrf.ts"],
-  "sourcesContent": ["import { Header } from \"../constants\"\nimport { buildMatcherRegex, matches } from \"./matchers\"\nimport { BBContext, EndpointMatcher } from \"@budibase/types\"\n\n/**\n * GET, HEAD and OPTIONS methods are considered safe operations\n *\n * POST, PUT, PATCH, and DELETE methods, being state changing verbs,\n * should have a CSRF token attached to the request\n */\nconst EXCLUDED_METHODS = [\"GET\", \"HEAD\", \"OPTIONS\"]\n\n/**\n * There are only three content type values that can be used in cross domain requests.\n * If any other value is used, e.g. application/json, the browser will first make a OPTIONS\n * request which will be protected by CORS.\n */\nconst INCLUDED_CONTENT_TYPES = [\n  \"application/x-www-form-urlencoded\",\n  \"multipart/form-data\",\n  \"text/plain\",\n]\n\n/**\n * Validate the CSRF token generated aganst the user session.\n * Compare the token with the x-csrf-token header.\n *\n * If the token is not found within the request or the value provided\n * does not match the value within the user session, the request is rejected.\n *\n * CSRF protection provided using the 'Synchronizer Token Pattern'\n * https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#synchronizer-token-pattern\n *\n */\nexport default function (\n  opts: { noCsrfPatterns: EndpointMatcher[] } = { noCsrfPatterns: [] }\n) {\n  const noCsrfOptions = buildMatcherRegex(opts.noCsrfPatterns)\n  return async (ctx: BBContext | any, next: any) => {\n    // don't apply for excluded paths\n    const found = matches(ctx, noCsrfOptions)\n    if (found) {\n      return next()\n    }\n\n    // don't apply for the excluded http methods\n    if (EXCLUDED_METHODS.indexOf(ctx.method) !== -1) {\n      return next()\n    }\n\n    // don't apply when the content type isn't supported\n    let contentType = ctx.get(\"content-type\")\n      ? ctx.get(\"content-type\").toLowerCase()\n      : \"\"\n    if (\n      !INCLUDED_CONTENT_TYPES.filter(type => contentType.includes(type)).length\n    ) {\n      return next()\n    }\n\n    // don't apply csrf when the internal api key has been used\n    if (ctx.internal) {\n      return next()\n    }\n\n    // apply csrf when there is a token in the session (new logins)\n    // in future there should be a hard requirement that the token is present\n    const userToken = ctx.user?.csrfToken\n    if (!userToken) {\n      return next()\n    }\n\n    // reject if no token in request or mismatch\n    const requestToken = ctx.get(Header.CSRF_TOKEN)\n    if (!requestToken || requestToken !== userToken) {\n      ctx.throw(403, \"Invalid CSRF token\")\n    }\n\n    return next()\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAAuB;AACvB,sBAA2C;AAS3C,MAAM,mBAAmB,CAAC,OAAO,QAAQ,SAAS;AAOlD,MAAM,yBAAyB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AACF;AAae,SAAR,aACL,OAA8C,EAAE,gBAAgB,CAAC,EAAE,GACnE;AACA,QAAM,oBAAgB,mCAAkB,KAAK,cAAc;AAC3D,SAAO,OAAO,KAAsB,SAAc;AAEhD,UAAM,YAAQ,yBAAQ,KAAK,aAAa;AACxC,QAAI,OAAO;AACT,aAAO,KAAK;AAAA,IACd;AAGA,QAAI,iBAAiB,QAAQ,IAAI,MAAM,MAAM,IAAI;AAC/C,aAAO,KAAK;AAAA,IACd;AAGA,QAAI,cAAc,IAAI,IAAI,cAAc,IACpC,IAAI,IAAI,cAAc,EAAE,YAAY,IACpC;AACJ,QACE,CAAC,uBAAuB,OAAO,UAAQ,YAAY,SAAS,IAAI,CAAC,EAAE,QACnE;AACA,aAAO,KAAK;AAAA,IACd;AAGA,QAAI,IAAI,UAAU;AAChB,aAAO,KAAK;AAAA,IACd;AAIA,UAAM,YAAY,IAAI,MAAM;AAC5B,QAAI,CAAC,WAAW;AACd,aAAO,KAAK;AAAA,IACd;AAGA,UAAM,eAAe,IAAI,IAAI,wBAAO,UAAU;AAC9C,QAAI,CAAC,gBAAgB,iBAAiB,WAAW;AAC/C,UAAI,MAAM,KAAK,oBAAoB;AAAA,IACrC;AAEA,WAAO,KAAK;AAAA,EACd;AACF;",
-  "names": []
-}
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../../src/middleware/csrf.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,4CAAqC;AACrC,yCAAuD;AAGvD;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;AAEnD;;;;GAIG;AACH,MAAM,sBAAsB,GAAG;IAC7B,mCAAmC;IACnC,qBAAqB;IACrB,YAAY;CACb,CAAA;AAED;;;;;;;;;;GAUG;AACH,mBACE,OAA8C,EAAE,cAAc,EAAE,EAAE,EAAE;IAEpE,MAAM,aAAa,GAAG,IAAA,4BAAiB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IAC5D,OAAO,CAAO,GAAoB,EAAE,IAAS,EAAE,EAAE;;QAC/C,iCAAiC;QACjC,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QACzC,IAAI,KAAK,EAAE;YACT,OAAO,IAAI,EAAE,CAAA;SACd;QAED,4CAA4C;QAC5C,IAAI,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE;YAC/C,OAAO,IAAI,EAAE,CAAA;SACd;QAED,oDAAoD;QACpD,IAAI,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE;YACvC,CAAC,CAAC,EAAE,CAAA;QACN,IACE,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EACzE;YACA,OAAO,IAAI,EAAE,CAAA;SACd;QAED,2DAA2D;QAC3D,IAAI,GAAG,CAAC,QAAQ,EAAE;YAChB,OAAO,IAAI,EAAE,CAAA;SACd;QAED,+DAA+D;QAC/D,yEAAyE;QACzE,MAAM,SAAS,GAAG,MAAA,GAAG,CAAC,IAAI,0CAAE,SAAS,CAAA;QACrC,IAAI,CAAC,SAAS,EAAE;YACd,OAAO,IAAI,EAAE,CAAA;SACd;QAED,4CAA4C;QAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAM,CAAC,UAAU,CAAC,CAAA;QAC/C,IAAI,CAAC,YAAY,IAAI,YAAY,KAAK,SAAS,EAAE;YAC/C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAA;SACrC;QAED,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAA,CAAA;AACH,CAAC;AA9CD,4BA8CC"}

package/dist/src/middleware/errorHandling.js

@@ -1,62 +1,64 @@
 "use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var errorHandling_exports = {};
-__export(errorHandling_exports, {
-  default: () => errorHandling_default,
-  errorHandling: () => errorHandling
-});
-module.exports = __toCommonJS(errorHandling_exports);
-var errors = __toESM(require("../errors"));
-async function errorHandling(ctx, next) {
-  try {
-    await next();
-  } catch (err) {
-    const status = err.status || err.statusCode || 500;
-    ctx.status = status;
-    if (status >= 400 && status < 500) {
-      console.warn(err);
-    } else {
-      console.error(err);
-    }
-    const error = errors.getPublicError(err);
-    const body = {
-      message: err.message,
-      status,
-      validationErrors: err.validation,
-      error
-    };
-    ctx.body = body;
-  }
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.errorHandling = void 0;
+const errors = __importStar(require("../errors"));
+function errorHandling(ctx, next) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            yield next();
+        }
+        catch (err) {
+            const status = err.status || err.statusCode || 500;
+            ctx.status = status;
+            if (status >= 400 && status < 500) {
+                console.warn(err);
+            }
+            else {
+                console.error(err);
+            }
+            const error = errors.getPublicError(err);
+            const body = {
+                message: err.message,
+                status: status,
+                validationErrors: err.validation,
+                error,
+            };
+            ctx.body = body;
+        }
+    });
 }
-var errorHandling_default = errorHandling;
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  errorHandling
-});
-//# sourceMappingURL=errorHandling.js.map
+exports.errorHandling = errorHandling;
+exports.default = errorHandling;
+//# sourceMappingURL=errorHandling.js.map

package/dist/src/middleware/errorHandling.js.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../../../src/middleware/errorHandling.ts"],
-  "sourcesContent": ["import { APIError } from \"@budibase/types\"\nimport * as errors from \"../errors\"\n\nexport async function errorHandling(ctx: any, next: any) {\n  try {\n    await next()\n  } catch (err: any) {\n    const status = err.status || err.statusCode || 500\n    ctx.status = status\n\n    if (status >= 400 && status < 500) {\n      console.warn(err)\n    } else {\n      console.error(err)\n    }\n\n    const error = errors.getPublicError(err)\n    const body: APIError = {\n      message: err.message,\n      status: status,\n      validationErrors: err.validation,\n      error,\n    }\n\n    ctx.body = body\n  }\n}\n\nexport default errorHandling\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,aAAwB;AAExB,eAAsB,cAAc,KAAU,MAAW;AACvD,MAAI;AACF,UAAM,KAAK;AAAA,EACb,SAAS,KAAU;AACjB,UAAM,SAAS,IAAI,UAAU,IAAI,cAAc;AAC/C,QAAI,SAAS;AAEb,QAAI,UAAU,OAAO,SAAS,KAAK;AACjC,cAAQ,KAAK,GAAG;AAAA,IAClB,OAAO;AACL,cAAQ,MAAM,GAAG;AAAA,IACnB;AAEA,UAAM,QAAQ,OAAO,eAAe,GAAG;AACvC,UAAM,OAAiB;AAAA,MACrB,SAAS,IAAI;AAAA,MACb;AAAA,MACA,kBAAkB,IAAI;AAAA,MACtB;AAAA,IACF;AAEA,QAAI,OAAO;AAAA,EACb;AACF;AAEA,IAAO,wBAAQ;",
-  "names": []
-}
+{"version":3,"file":"errorHandling.js","sourceRoot":"","sources":["../../../src/middleware/errorHandling.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,kDAAmC;AAEnC,SAAsB,aAAa,CAAC,GAAQ,EAAE,IAAS;;QACrD,IAAI;YACF,MAAM,IAAI,EAAE,CAAA;SACb;QAAC,OAAO,GAAQ,EAAE;YACjB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAA;YAClD,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;YAEnB,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE;gBACjC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;aAClB;iBAAM;gBACL,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;aACnB;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;YACxC,MAAM,IAAI,GAAa;gBACrB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,MAAM;gBACd,gBAAgB,EAAE,GAAG,CAAC,UAAU;gBAChC,KAAK;aACN,CAAA;YAED,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;SAChB;IACH,CAAC;CAAA;AAvBD,sCAuBC;AAED,kBAAe,aAAa,CAAA"}

package/dist/src/middleware/index.js

@@ -1,95 +1,65 @@
 "use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var middleware_exports = {};
-__export(middleware_exports, {
-  adminOnly: () => import_adminOnly.default,
-  auditLog: () => import_auditLog.default,
-  authError: () => import_utils.authError,
-  authenticated: () => import_authenticated.default,
-  builderOnly: () => import_builderOnly.default,
-  builderOrAdmin: () => import_builderOrAdmin.default,
-  correlation: () => import_middleware2.default,
-  csrf: () => import_csrf.default,
-  datasource: () => datasource,
-  errorHandling: () => import_errorHandling.default,
-  google: () => google,
-  internalApi: () => import_internalApi.default,
-  joiValidator: () => joiValidator,
-  local: () => local,
-  oidc: () => oidc,
-  pino: () => import_middleware.default,
-  querystringToBody: () => import_querystringToBody.default,
-  ssoCallbackUrl: () => import_utils.ssoCallbackUrl,
-  tenancy: () => import_tenancy.default
-});
-module.exports = __toCommonJS(middleware_exports);
-var local = __toESM(require("./passport/local"));
-var google = __toESM(require("./passport/sso/google"));
-var oidc = __toESM(require("./passport/sso/oidc"));
-var datasourceGoogle = __toESM(require("./passport/datasource/google"));
-var import_utils = require("./passport/utils");
-var import_authenticated = __toESM(require("./authenticated"));
-var import_auditLog = __toESM(require("./auditLog"));
-var import_tenancy = __toESM(require("./tenancy"));
-var import_internalApi = __toESM(require("./internalApi"));
-var import_csrf = __toESM(require("./csrf"));
-var import_adminOnly = __toESM(require("./adminOnly"));
-var import_builderOrAdmin = __toESM(require("./builderOrAdmin"));
-var import_builderOnly = __toESM(require("./builderOnly"));
-var import_middleware = __toESM(require("../logging/pino/middleware"));
-var import_middleware2 = __toESM(require("../logging/correlation/middleware"));
-var import_errorHandling = __toESM(require("./errorHandling"));
-var import_querystringToBody = __toESM(require("./querystringToBody"));
-var joiValidator = __toESM(require("./joi-validator"));
-const datasource = {
-  google: datasourceGoogle
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.joiValidator = exports.querystringToBody = exports.errorHandling = exports.correlation = exports.pino = exports.builderOnly = exports.builderOrAdmin = exports.adminOnly = exports.csrf = exports.internalApi = exports.tenancy = exports.auditLog = exports.authenticated = exports.ssoCallbackUrl = exports.authError = exports.datasource = exports.oidc = exports.google = exports.local = void 0;
+exports.local = __importStar(require("./passport/local"));
+exports.google = __importStar(require("./passport/sso/google"));
+exports.oidc = __importStar(require("./passport/sso/oidc"));
+const datasourceGoogle = __importStar(require("./passport/datasource/google"));
+exports.datasource = {
+    google: datasourceGoogle,
 };
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  adminOnly,
-  auditLog,
-  authError,
-  authenticated,
-  builderOnly,
-  builderOrAdmin,
-  correlation,
-  csrf,
-  datasource,
-  errorHandling,
-  google,
-  internalApi,
-  joiValidator,
-  local,
-  oidc,
-  pino,
-  querystringToBody,
-  ssoCallbackUrl,
-  tenancy
-});
-//# sourceMappingURL=index.js.map
+var utils_1 = require("./passport/utils");
+Object.defineProperty(exports, "authError", { enumerable: true, get: function () { return utils_1.authError; } });
+Object.defineProperty(exports, "ssoCallbackUrl", { enumerable: true, get: function () { return utils_1.ssoCallbackUrl; } });
+var authenticated_1 = require("./authenticated");
+Object.defineProperty(exports, "authenticated", { enumerable: true, get: function () { return __importDefault(authenticated_1).default; } });
+var auditLog_1 = require("./auditLog");
+Object.defineProperty(exports, "auditLog", { enumerable: true, get: function () { return __importDefault(auditLog_1).default; } });
+var tenancy_1 = require("./tenancy");
+Object.defineProperty(exports, "tenancy", { enumerable: true, get: function () { return __importDefault(tenancy_1).default; } });
+var internalApi_1 = require("./internalApi");
+Object.defineProperty(exports, "internalApi", { enumerable: true, get: function () { return __importDefault(internalApi_1).default; } });
+var csrf_1 = require("./csrf");
+Object.defineProperty(exports, "csrf", { enumerable: true, get: function () { return __importDefault(csrf_1).default; } });
+var adminOnly_1 = require("./adminOnly");
+Object.defineProperty(exports, "adminOnly", { enumerable: true, get: function () { return __importDefault(adminOnly_1).default; } });
+var builderOrAdmin_1 = require("./builderOrAdmin");
+Object.defineProperty(exports, "builderOrAdmin", { enumerable: true, get: function () { return __importDefault(builderOrAdmin_1).default; } });
+var builderOnly_1 = require("./builderOnly");
+Object.defineProperty(exports, "builderOnly", { enumerable: true, get: function () { return __importDefault(builderOnly_1).default; } });
+var middleware_1 = require("../logging/pino/middleware");
+Object.defineProperty(exports, "pino", { enumerable: true, get: function () { return __importDefault(middleware_1).default; } });
+var middleware_2 = require("../logging/correlation/middleware");
+Object.defineProperty(exports, "correlation", { enumerable: true, get: function () { return __importDefault(middleware_2).default; } });
+var errorHandling_1 = require("./errorHandling");
+Object.defineProperty(exports, "errorHandling", { enumerable: true, get: function () { return __importDefault(errorHandling_1).default; } });
+var querystringToBody_1 = require("./querystringToBody");
+Object.defineProperty(exports, "querystringToBody", { enumerable: true, get: function () { return __importDefault(querystringToBody_1).default; } });
+exports.joiValidator = __importStar(require("./joi-validator"));
+//# sourceMappingURL=index.js.map

package/dist/src/middleware/index.js.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../../../src/middleware/index.ts"],
-  "sourcesContent": ["export * as local from \"./passport/local\"\nexport * as google from \"./passport/sso/google\"\nexport * as oidc from \"./passport/sso/oidc\"\nimport * as datasourceGoogle from \"./passport/datasource/google\"\nexport const datasource = {\n  google: datasourceGoogle,\n}\nexport { authError, ssoCallbackUrl } from \"./passport/utils\"\nexport { default as authenticated } from \"./authenticated\"\nexport { default as auditLog } from \"./auditLog\"\nexport { default as tenancy } from \"./tenancy\"\nexport { default as internalApi } from \"./internalApi\"\nexport { default as csrf } from \"./csrf\"\nexport { default as adminOnly } from \"./adminOnly\"\nexport { default as builderOrAdmin } from \"./builderOrAdmin\"\nexport { default as builderOnly } from \"./builderOnly\"\nexport { default as pino } from \"../logging/pino/middleware\"\nexport { default as correlation } from \"../logging/correlation/middleware\"\nexport { default as errorHandling } from \"./errorHandling\"\nexport { default as querystringToBody } from \"./querystringToBody\"\nexport * as joiValidator from \"./joi-validator\"\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAAuB;AACvB,aAAwB;AACxB,WAAsB;AACtB,uBAAkC;AAIlC,mBAA0C;AAC1C,2BAAyC;AACzC,sBAAoC;AACpC,qBAAmC;AACnC,yBAAuC;AACvC,kBAAgC;AAChC,uBAAqC;AACrC,4BAA0C;AAC1C,yBAAuC;AACvC,wBAAgC;AAChC,IAAAA,qBAAuC;AACvC,2BAAyC;AACzC,+BAA6C;AAC7C,mBAA8B;AAhBvB,MAAM,aAAa;AAAA,EACxB,QAAQ;AACV;",
-  "names": ["import_middleware"]
-}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,0DAAyC;AACzC,gEAA+C;AAC/C,4DAA2C;AAC3C,+EAAgE;AACnD,QAAA,UAAU,GAAG;IACxB,MAAM,EAAE,gBAAgB;CACzB,CAAA;AACD,0CAA4D;AAAnD,kGAAA,SAAS,OAAA;AAAE,uGAAA,cAAc,OAAA;AAClC,iDAA0D;AAAjD,+HAAA,OAAO,OAAiB;AACjC,uCAAgD;AAAvC,qHAAA,OAAO,OAAY;AAC5B,qCAA8C;AAArC,mHAAA,OAAO,OAAW;AAC3B,6CAAsD;AAA7C,2HAAA,OAAO,OAAe;AAC/B,+BAAwC;AAA/B,6GAAA,OAAO,OAAQ;AACxB,yCAAkD;AAAzC,uHAAA,OAAO,OAAa;AAC7B,mDAA4D;AAAnD,iIAAA,OAAO,OAAkB;AAClC,6CAAsD;AAA7C,2HAAA,OAAO,OAAe;AAC/B,yDAA4D;AAAnD,mHAAA,OAAO,OAAQ;AACxB,gEAA0E;AAAjE,0HAAA,OAAO,OAAe;AAC/B,iDAA0D;AAAjD,+HAAA,OAAO,OAAiB;AACjC,yDAAkE;AAAzD,uIAAA,OAAO,OAAqB;AACrC,gEAA+C"}

package/dist/src/middleware/internalApi.js

@@ -1,39 +1,30 @@
 "use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var internalApi_exports = {};
-__export(internalApi_exports, {
-  default: () => internalApi_default
+Object.defineProperty(exports, "__esModule", { value: true });
+const constants_1 = require("../constants");
+const utils_1 = require("../utils");
+/**
+ * API Key only endpoint.
+ */
+exports.default = (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
+    const apiKey = ctx.request.headers[constants_1.Header.API_KEY];
+    if (!apiKey) {
+        ctx.throw(403, "Unauthorized");
+    }
+    if (Array.isArray(apiKey)) {
+        ctx.throw(403, "Unauthorized");
+    }
+    if (!(0, utils_1.isValidInternalAPIKey)(apiKey)) {
+        ctx.throw(403, "Unauthorized");
+    }
+    return next();
 });
-module.exports = __toCommonJS(internalApi_exports);
-var import_constants = require("../constants");
-var import_utils = require("../utils");
-var internalApi_default = async (ctx, next) => {
-  const apiKey = ctx.request.headers[import_constants.Header.API_KEY];
-  if (!apiKey) {
-    ctx.throw(403, "Unauthorized");
-  }
-  if (Array.isArray(apiKey)) {
-    ctx.throw(403, "Unauthorized");
-  }
-  if (!(0, import_utils.isValidInternalAPIKey)(apiKey)) {
-    ctx.throw(403, "Unauthorized");
-  }
-  return next();
-};
-//# sourceMappingURL=internalApi.js.map
+//# sourceMappingURL=internalApi.js.map

package/dist/src/middleware/internalApi.js.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../../../src/middleware/internalApi.ts"],
-  "sourcesContent": ["import { Header } from \"../constants\"\nimport { BBContext } from \"@budibase/types\"\nimport { isValidInternalAPIKey } from \"../utils\"\n\n/**\n * API Key only endpoint.\n */\nexport default async (ctx: BBContext, next: any) => {\n  const apiKey = ctx.request.headers[Header.API_KEY]\n  if (!apiKey) {\n    ctx.throw(403, \"Unauthorized\")\n  }\n\n  if (Array.isArray(apiKey)) {\n    ctx.throw(403, \"Unauthorized\")\n  }\n\n  if (!isValidInternalAPIKey(apiKey)) {\n    ctx.throw(403, \"Unauthorized\")\n  }\n\n  return next()\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uBAAuB;AAEvB,mBAAsC;AAKtC,IAAO,sBAAQ,OAAO,KAAgB,SAAc;AAClD,QAAM,SAAS,IAAI,QAAQ,QAAQ,wBAAO,OAAO;AACjD,MAAI,CAAC,QAAQ;AACX,QAAI,MAAM,KAAK,cAAc;AAAA,EAC/B;AAEA,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,QAAI,MAAM,KAAK,cAAc;AAAA,EAC/B;AAEA,MAAI,KAAC,oCAAsB,MAAM,GAAG;AAClC,QAAI,MAAM,KAAK,cAAc;AAAA,EAC/B;AAEA,SAAO,KAAK;AACd;",
-  "names": []
-}
+{"version":3,"file":"internalApi.js","sourceRoot":"","sources":["../../../src/middleware/internalApi.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,4CAAqC;AAErC,oCAAgD;AAEhD;;GAEG;AACH,kBAAe,CAAO,GAAc,EAAE,IAAS,EAAE,EAAE;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAM,CAAC,OAAO,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,EAAE;QACX,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;KAC/B;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QACzB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;KAC/B;IAED,IAAI,CAAC,IAAA,6BAAqB,EAAC,MAAM,CAAC,EAAE;QAClC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;KAC/B;IAED,OAAO,IAAI,EAAE,CAAA;AACf,CAAC,CAAA,CAAA"}