@budibase/backend-core 2.9.40-alpha.6 → 2.10.1

package/src/security/encryption.ts

@@ -0,0 +1,179 @@
+import crypto from "crypto"
+import fs from "fs"
+import zlib from "zlib"
+import env from "../environment"
+import { join } from "path"
+
+const ALGO = "aes-256-ctr"
+const SEPARATOR = "-"
+const ITERATIONS = 10000
+const STRETCH_LENGTH = 32
+
+const SALT_LENGTH = 16
+const IV_LENGTH = 16
+
+export enum SecretOption {
+  API = "api",
+  ENCRYPTION = "encryption",
+}
+
+export function getSecret(secretOption: SecretOption): string {
+  let secret, secretName
+  switch (secretOption) {
+    case SecretOption.ENCRYPTION:
+      secret = env.ENCRYPTION_KEY
+      secretName = "ENCRYPTION_KEY"
+      break
+    case SecretOption.API:
+    default:
+      secret = env.API_ENCRYPTION_KEY
+      secretName = "API_ENCRYPTION_KEY"
+      break
+  }
+  if (!secret) {
+    throw new Error(`Secret "${secretName}" has not been set in environment.`)
+  }
+  return secret
+}
+
+function stretchString(secret: string, salt: Buffer) {
+  return crypto.pbkdf2Sync(secret, salt, ITERATIONS, STRETCH_LENGTH, "sha512")
+}
+
+export function encrypt(
+  input: string,
+  secretOption: SecretOption = SecretOption.API
+) {
+  const salt = crypto.randomBytes(SALT_LENGTH)
+  const stretched = stretchString(getSecret(secretOption), salt)
+  const cipher = crypto.createCipheriv(ALGO, stretched, salt)
+  const base = cipher.update(input)
+  const final = cipher.final()
+  const encrypted = Buffer.concat([base, final]).toString("hex")
+  return `${salt.toString("hex")}${SEPARATOR}${encrypted}`
+}
+
+export function decrypt(
+  input: string,
+  secretOption: SecretOption = SecretOption.API
+) {
+  const [salt, encrypted] = input.split(SEPARATOR)
+  const saltBuffer = Buffer.from(salt, "hex")
+  const stretched = stretchString(getSecret(secretOption), saltBuffer)
+  const decipher = crypto.createDecipheriv(ALGO, stretched, saltBuffer)
+  const base = decipher.update(Buffer.from(encrypted, "hex"))
+  const final = decipher.final()
+  return Buffer.concat([base, final]).toString()
+}
+
+export async function encryptFile(
+  { dir, filename }: { dir: string; filename: string },
+  secret: string
+) {
+  const outputFileName = `${filename}.enc`
+
+  const filePath = join(dir, filename)
+  const inputFile = fs.createReadStream(filePath)
+  const outputFile = fs.createWriteStream(join(dir, outputFileName))
+
+  const salt = crypto.randomBytes(SALT_LENGTH)
+  const iv = crypto.randomBytes(IV_LENGTH)
+  const stretched = stretchString(secret, salt)
+  const cipher = crypto.createCipheriv(ALGO, stretched, iv)
+
+  outputFile.write(salt)
+  outputFile.write(iv)
+
+  inputFile.pipe(zlib.createGzip()).pipe(cipher).pipe(outputFile)
+
+  return new Promise<{ filename: string; dir: string }>(r => {
+    outputFile.on("finish", () => {
+      r({
+        filename: outputFileName,
+        dir,
+      })
+    })
+  })
+}
+
+async function getSaltAndIV(path: string) {
+  const fileStream = fs.createReadStream(path)
+
+  const salt = await readBytes(fileStream, SALT_LENGTH)
+  const iv = await readBytes(fileStream, IV_LENGTH)
+  fileStream.close()
+  return { salt, iv }
+}
+
+export async function decryptFile(
+  inputPath: string,
+  outputPath: string,
+  secret: string
+) {
+  const { salt, iv } = await getSaltAndIV(inputPath)
+  const inputFile = fs.createReadStream(inputPath, {
+    start: SALT_LENGTH + IV_LENGTH,
+  })
+
+  const outputFile = fs.createWriteStream(outputPath)
+
+  const stretched = stretchString(secret, salt)
+  const decipher = crypto.createDecipheriv(ALGO, stretched, iv)
+
+  const unzip = zlib.createGunzip()
+
+  inputFile.pipe(decipher).pipe(unzip).pipe(outputFile)
+
+  return new Promise<void>((res, rej) => {
+    outputFile.on("finish", () => {
+      outputFile.close()
+      res()
+    })
+
+    inputFile.on("error", e => {
+      outputFile.close()
+      rej(e)
+    })
+
+    decipher.on("error", e => {
+      outputFile.close()
+      rej(e)
+    })
+
+    unzip.on("error", e => {
+      outputFile.close()
+      rej(e)
+    })
+
+    outputFile.on("error", e => {
+      outputFile.close()
+      rej(e)
+    })
+  })
+}
+
+function readBytes(stream: fs.ReadStream, length: number) {
+  return new Promise<Buffer>((resolve, reject) => {
+    let bytesRead = 0
+    const data: Buffer[] = []
+
+    stream.on("readable", () => {
+      let chunk
+
+      while ((chunk = stream.read(length - bytesRead)) !== null) {
+        data.push(chunk)
+        bytesRead += chunk.length
+      }
+
+      resolve(Buffer.concat(data))
+    })
+
+    stream.on("end", () => {
+      reject(new Error("Insufficient data in the stream."))
+    })
+
+    stream.on("error", error => {
+      reject(error)
+    })
+  })
+}

package/src/security/permissions.ts

@@ -0,0 +1,158 @@
+import { PermissionType, PermissionLevel } from "@budibase/types"
+export { PermissionType, PermissionLevel } from "@budibase/types"
+import flatten from "lodash/flatten"
+import cloneDeep from "lodash/fp/cloneDeep"
+
+export type RoleHierarchy = {
+  permissionId: string
+}[]
+
+export class Permission {
+  type: PermissionType
+  level: PermissionLevel
+
+  constructor(type: PermissionType, level: PermissionLevel) {
+    this.type = type
+    this.level = level
+  }
+}
+
+export function levelToNumber(perm: PermissionLevel) {
+  switch (perm) {
+    // not everything has execute privileges
+    case PermissionLevel.EXECUTE:
+      return 0
+    case PermissionLevel.READ:
+      return 1
+    case PermissionLevel.WRITE:
+      return 2
+    case PermissionLevel.ADMIN:
+      return 3
+    default:
+      return -1
+  }
+}
+
+/**
+ * Given the specified permission level for the user return the levels they are allowed to carry out.
+ * @param {string} userPermLevel The permission level of the user.
+ * @return {string[]} All the permission levels this user is allowed to carry out.
+ */
+export function getAllowedLevels(userPermLevel: PermissionLevel): string[] {
+  switch (userPermLevel) {
+    case PermissionLevel.EXECUTE:
+      return [PermissionLevel.EXECUTE]
+    case PermissionLevel.READ:
+      return [PermissionLevel.EXECUTE, PermissionLevel.READ]
+    case PermissionLevel.WRITE:
+    case PermissionLevel.ADMIN:
+      return [
+        PermissionLevel.EXECUTE,
+        PermissionLevel.READ,
+        PermissionLevel.WRITE,
+      ]
+    default:
+      return []
+  }
+}
+
+export enum BuiltinPermissionID {
+  PUBLIC = "public",
+  READ_ONLY = "read_only",
+  WRITE = "write",
+  ADMIN = "admin",
+  POWER = "power",
+}
+
+export const BUILTIN_PERMISSIONS = {
+  PUBLIC: {
+    _id: BuiltinPermissionID.PUBLIC,
+    name: "Public",
+    permissions: [
+      new Permission(PermissionType.WEBHOOK, PermissionLevel.EXECUTE),
+    ],
+  },
+  READ_ONLY: {
+    _id: BuiltinPermissionID.READ_ONLY,
+    name: "Read only",
+    permissions: [
+      new Permission(PermissionType.QUERY, PermissionLevel.READ),
+      new Permission(PermissionType.TABLE, PermissionLevel.READ),
+    ],
+  },
+  WRITE: {
+    _id: BuiltinPermissionID.WRITE,
+    name: "Read/Write",
+    permissions: [
+      new Permission(PermissionType.QUERY, PermissionLevel.WRITE),
+      new Permission(PermissionType.TABLE, PermissionLevel.WRITE),
+      new Permission(PermissionType.AUTOMATION, PermissionLevel.EXECUTE),
+      new Permission(PermissionType.LEGACY_VIEW, PermissionLevel.READ),
+    ],
+  },
+  POWER: {
+    _id: BuiltinPermissionID.POWER,
+    name: "Power",
+    permissions: [
+      new Permission(PermissionType.TABLE, PermissionLevel.WRITE),
+      new Permission(PermissionType.USER, PermissionLevel.READ),
+      new Permission(PermissionType.AUTOMATION, PermissionLevel.EXECUTE),
+      new Permission(PermissionType.WEBHOOK, PermissionLevel.READ),
+      new Permission(PermissionType.LEGACY_VIEW, PermissionLevel.READ),
+    ],
+  },
+  ADMIN: {
+    _id: BuiltinPermissionID.ADMIN,
+    name: "Admin",
+    permissions: [
+      new Permission(PermissionType.TABLE, PermissionLevel.ADMIN),
+      new Permission(PermissionType.USER, PermissionLevel.ADMIN),
+      new Permission(PermissionType.AUTOMATION, PermissionLevel.ADMIN),
+      new Permission(PermissionType.WEBHOOK, PermissionLevel.READ),
+      new Permission(PermissionType.QUERY, PermissionLevel.ADMIN),
+      new Permission(PermissionType.LEGACY_VIEW, PermissionLevel.READ),
+    ],
+  },
+}
+
+export function getBuiltinPermissions() {
+  return cloneDeep(BUILTIN_PERMISSIONS)
+}
+
+export function getBuiltinPermissionByID(id: string) {
+  const perms = Object.values(BUILTIN_PERMISSIONS)
+  return perms.find(perm => perm._id === id)
+}
+
+export function doesHaveBasePermission(
+  permType: PermissionType,
+  permLevel: PermissionLevel,
+  rolesHierarchy: RoleHierarchy
+) {
+  const basePermissions = [
+    ...new Set(rolesHierarchy.map(role => role.permissionId)),
+  ]
+  const builtins = Object.values(BUILTIN_PERMISSIONS)
+  let permissions = flatten(
+    builtins
+      .filter(builtin => basePermissions.indexOf(builtin._id) !== -1)
+      .map(builtin => builtin.permissions)
+  )
+  for (let permission of permissions) {
+    if (
+      permission.type === permType &&
+      getAllowedLevels(permission.level).indexOf(permLevel) !== -1
+    ) {
+      return true
+    }
+  }
+  return false
+}
+
+export function isPermissionLevelHigherThanRead(level: PermissionLevel) {
+  return levelToNumber(level) > 1
+}
+
+// utility as a lot of things need simply the builder permission
+export const BUILDER = PermissionType.BUILDER
+export const GLOBAL_BUILDER = PermissionType.GLOBAL_BUILDER