@budibase/backend-core 3.2.4 → 3.2.6

package/src/security/sessions.ts

@@ -1,123 +0,0 @@
-import * as redis from "../redis/init"
-import { v4 as uuidv4 } from "uuid"
-import { logWarn } from "../logging"
-import env from "../environment"
-import { Duration } from "../utils"
-import {
-  Session,
-  ScannedSession,
-  SessionKey,
-  CreateSession,
-} from "@budibase/types"
-
-// a week expiry is the default
-const EXPIRY_SECONDS = env.SESSION_EXPIRY_SECONDS
-  ? parseInt(env.SESSION_EXPIRY_SECONDS)
-  : Duration.fromDays(7).toSeconds()
-
-function makeSessionID(userId: string, sessionId: string) {
-  return `${userId}/${sessionId}`
-}
-
-export async function getSessionsForUser(userId: string): Promise<Session[]> {
-  if (!userId) {
-    console.trace("Cannot get sessions for undefined userId")
-    return []
-  }
-  const client = await redis.getSessionClient()
-  const sessions: ScannedSession[] = await client.scan(userId)
-  return sessions.map(session => session.value)
-}
-
-export async function invalidateSessions(
-  userId: string,
-  opts: { sessionIds?: string[]; reason?: string } = {}
-) {
-  try {
-    const reason = opts?.reason || "unknown"
-    let sessionIds: string[] = opts.sessionIds || []
-    let sessionKeys: SessionKey[]
-
-    // If no sessionIds, get all the sessions for the user
-    if (sessionIds.length === 0) {
-      const sessions = await getSessionsForUser(userId)
-      sessionKeys = sessions.map(session => ({
-        key: makeSessionID(session.userId, session.sessionId),
-      }))
-    } else {
-      // use the passed array of sessionIds
-      sessionIds = Array.isArray(sessionIds) ? sessionIds : [sessionIds]
-      sessionKeys = sessionIds.map(sessionId => ({
-        key: makeSessionID(userId, sessionId),
-      }))
-    }
-
-    if (sessionKeys && sessionKeys.length > 0) {
-      const client = await redis.getSessionClient()
-      const promises = []
-      for (let sessionKey of sessionKeys) {
-        promises.push(client.delete(sessionKey.key))
-      }
-      if (!env.isTest()) {
-        logWarn(
-          `Invalidating sessions for ${userId} (reason: ${reason}) - ${sessionKeys
-            .map(sessionKey => sessionKey.key)
-            .join(", ")}`
-        )
-      }
-      await Promise.all(promises)
-    }
-  } catch (err) {
-    console.error(`Error invalidating sessions: ${err}`)
-  }
-}
-
-export async function createASession(
-  userId: string,
-  createSession: CreateSession
-) {
-  // invalidate all other sessions
-  await invalidateSessions(userId, { reason: "creation" })
-
-  const client = await redis.getSessionClient()
-  const sessionId = createSession.sessionId
-  const csrfToken = createSession.csrfToken ? createSession.csrfToken : uuidv4()
-  const key = makeSessionID(userId, sessionId)
-
-  const session: Session = {
-    ...createSession,
-    csrfToken,
-    createdAt: new Date().toISOString(),
-    lastAccessedAt: new Date().toISOString(),
-    userId,
-  }
-  await client.store(key, session, EXPIRY_SECONDS)
-  return session
-}
-
-export async function updateSessionTTL(session: Session) {
-  const client = await redis.getSessionClient()
-  const key = makeSessionID(session.userId, session.sessionId)
-  session.lastAccessedAt = new Date().toISOString()
-  await client.store(key, session, EXPIRY_SECONDS)
-}
-
-export async function endSession(userId: string, sessionId: string) {
-  const client = await redis.getSessionClient()
-  await client.delete(makeSessionID(userId, sessionId))
-}
-
-export async function getSession(
-  userId: string,
-  sessionId: string
-): Promise<Session> {
-  if (!userId || !sessionId) {
-    throw new Error(`Invalid session details - ${userId} - ${sessionId}`)
-  }
-  const client = await redis.getSessionClient()
-  const session = await client.get(makeSessionID(userId, sessionId))
-  if (!session) {
-    throw new Error(`Session not found - ${userId} - ${sessionId}`)
-  }
-  return session
-}

package/src/security/tests/auth.spec.ts

@@ -1,45 +0,0 @@
-import { generator } from "../../../tests"
-import { PASSWORD_MAX_LENGTH, validatePassword } from "../auth"
-
-describe("auth", () => {
-  describe("validatePassword", () => {
-    it("a valid password returns successful", () => {
-      expect(validatePassword("password123!")).toEqual({ valid: true })
-    })
-
-    it.each([
-      ["undefined", undefined],
-      ["null", null],
-      ["empty", ""],
-    ])("%s returns unsuccessful", (_, password) => {
-      expect(validatePassword(password as string)).toEqual({
-        valid: false,
-        error: "Password invalid. Minimum 12 characters.",
-      })
-    })
-
-    it.each([
-      generator.word({ length: PASSWORD_MAX_LENGTH }),
-      generator.paragraph().substring(0, PASSWORD_MAX_LENGTH),
-    ])(`can use passwords up to 512 characters in length`, password => {
-      expect(validatePassword(password)).toEqual({
-        valid: true,
-      })
-    })
-
-    it.each([
-      generator.word({ length: PASSWORD_MAX_LENGTH + 1 }),
-      generator
-        .paragraph({ sentences: 50 })
-        .substring(0, PASSWORD_MAX_LENGTH + 1),
-    ])(
-      `passwords cannot have more than ${PASSWORD_MAX_LENGTH} characters`,
-      password => {
-        expect(validatePassword(password)).toEqual({
-          valid: false,
-          error: "Password invalid. Maximum 512 characters.",
-        })
-      }
-    )
-  })
-})

package/src/security/tests/encryption.spec.ts

@@ -1,31 +0,0 @@
-import { encrypt, decrypt, SecretOption, getSecret } from "../encryption"
-import env from "../../environment"
-
-describe("encryption", () => {
-  it("should throw an error if API encryption key is not set", () => {
-    const jwt = getSecret(SecretOption.API)
-    expect(jwt).toBe(env.JWT_SECRET?.export().toString())
-  })
-
-  it("should throw an error if encryption key is not set", () => {
-    expect(() => getSecret(SecretOption.ENCRYPTION)).toThrow(
-      'Secret "ENCRYPTION_KEY" has not been set in environment.'
-    )
-  })
-
-  it("should encrypt and decrypt a string using API encryption key", () => {
-    env._set("API_ENCRYPTION_KEY", "api_secret")
-    const plaintext = "budibase"
-    const apiEncrypted = encrypt(plaintext, SecretOption.API)
-    const decrypted = decrypt(apiEncrypted, SecretOption.API)
-    expect(decrypted).toEqual(plaintext)
-  })
-
-  it("should encrypt and decrypt a string using encryption key", () => {
-    env._set("ENCRYPTION_KEY", "normal_secret")
-    const plaintext = "budibase"
-    const encryptionEncrypted = encrypt(plaintext, SecretOption.ENCRYPTION)
-    const decrypted = decrypt(encryptionEncrypted, SecretOption.ENCRYPTION)
-    expect(decrypted).toEqual(plaintext)
-  })
-})

package/src/security/tests/permissions.spec.ts

@@ -1,146 +0,0 @@
-import cloneDeep from "lodash/cloneDeep"
-import * as permissions from "../permissions"
-import { BUILTIN_ROLE_IDS } from "../roles"
-import { BuiltinPermissionID } from "@budibase/types"
-
-describe("levelToNumber", () => {
-  it("should return 0 for EXECUTE", () => {
-    expect(permissions.levelToNumber(permissions.PermissionLevel.EXECUTE)).toBe(
-      0
-    )
-  })
-
-  it("should return 1 for READ", () => {
-    expect(permissions.levelToNumber(permissions.PermissionLevel.READ)).toBe(1)
-  })
-
-  it("should return 2 for WRITE", () => {
-    expect(permissions.levelToNumber(permissions.PermissionLevel.WRITE)).toBe(2)
-  })
-
-  it("should return 3 for ADMIN", () => {
-    expect(permissions.levelToNumber(permissions.PermissionLevel.ADMIN)).toBe(3)
-  })
-
-  it("should return -1 for an unknown permission level", () => {
-    expect(
-      permissions.levelToNumber("unknown" as permissions.PermissionLevel)
-    ).toBe(-1)
-  })
-})
-describe("getAllowedLevels", () => {
-  it('should return ["execute"] for EXECUTE', () => {
-    expect(
-      permissions.getAllowedLevels(permissions.PermissionLevel.EXECUTE)
-    ).toEqual([permissions.PermissionLevel.EXECUTE])
-  })
-
-  it('should return ["execute", "read"] for READ', () => {
-    expect(
-      permissions.getAllowedLevels(permissions.PermissionLevel.READ)
-    ).toEqual([
-      permissions.PermissionLevel.EXECUTE,
-      permissions.PermissionLevel.READ,
-    ])
-  })
-
-  it('should return ["execute", "read", "write"] for WRITE', () => {
-    expect(
-      permissions.getAllowedLevels(permissions.PermissionLevel.WRITE)
-    ).toEqual([
-      permissions.PermissionLevel.EXECUTE,
-      permissions.PermissionLevel.READ,
-      permissions.PermissionLevel.WRITE,
-    ])
-  })
-
-  it('should return ["execute", "read", "write"] for ADMIN', () => {
-    expect(
-      permissions.getAllowedLevels(permissions.PermissionLevel.ADMIN)
-    ).toEqual([
-      permissions.PermissionLevel.EXECUTE,
-      permissions.PermissionLevel.READ,
-      permissions.PermissionLevel.WRITE,
-    ])
-  })
-
-  it("should return [] for an unknown permission level", () => {
-    expect(
-      permissions.getAllowedLevels("unknown" as permissions.PermissionLevel)
-    ).toEqual([])
-  })
-})
-
-describe("doesHaveBasePermission", () => {
-  it("should return true if base permission has the required level", () => {
-    const permType = permissions.PermissionType.USER
-    const permLevel = permissions.PermissionLevel.READ
-    const rolesHierarchy = [
-      {
-        roleId: BUILTIN_ROLE_IDS.ADMIN,
-        permissionId: BuiltinPermissionID.ADMIN,
-      },
-    ]
-    expect(
-      permissions.doesHaveBasePermission(permType, permLevel, rolesHierarchy)
-    ).toBe(true)
-  })
-
-  it("should return false if base permission does not have the required level", () => {
-    const permType = permissions.PermissionType.APP
-    const permLevel = permissions.PermissionLevel.READ
-    const rolesHierarchy = [
-      {
-        roleId: BUILTIN_ROLE_IDS.PUBLIC,
-        permissionId: BuiltinPermissionID.PUBLIC,
-      },
-    ]
-    expect(
-      permissions.doesHaveBasePermission(permType, permLevel, rolesHierarchy)
-    ).toBe(false)
-  })
-})
-
-describe("isPermissionLevelHigherThanRead", () => {
-  it("should return true if level is higher than read", () => {
-    expect(
-      permissions.isPermissionLevelHigherThanRead(
-        permissions.PermissionLevel.WRITE
-      )
-    ).toBe(true)
-  })
-
-  it("should return false if level is read or lower", () => {
-    expect(
-      permissions.isPermissionLevelHigherThanRead(
-        permissions.PermissionLevel.READ
-      )
-    ).toBe(false)
-  })
-})
-
-describe("getBuiltinPermissions", () => {
-  it("returns a clone of the builtin permissions", () => {
-    const builtins = permissions.getBuiltinPermissions()
-    expect(builtins).toEqual(cloneDeep(permissions.BUILTIN_PERMISSIONS))
-    expect(builtins).not.toBe(permissions.BUILTIN_PERMISSIONS)
-  })
-})
-
-describe("getBuiltinPermissionByID", () => {
-  it("returns correct permission object for valid ID", () => {
-    const expectedPermission = {
-      _id: BuiltinPermissionID.PUBLIC,
-      name: "Public",
-      permissions: [
-        new permissions.Permission(
-          permissions.PermissionType.WEBHOOK,
-          permissions.PermissionLevel.EXECUTE
-        ),
-      ],
-    }
-    expect(permissions.getBuiltinPermissionByID("public")).toEqual(
-      expectedPermission
-    )
-  })
-})

package/src/security/tests/secrets.spec.ts

@@ -1,35 +0,0 @@
-import { randomUUID } from "crypto"
-import environment, { SECRETS } from "../../environment"
-import { stringContainsSecret } from "../secrets"
-
-describe("secrets", () => {
-  describe("stringContainsSecret", () => {
-    it.each(SECRETS)("detects that a string contains a secret in: %s", key => {
-      const needle = randomUUID()
-      const haystack = `this is a secret: ${needle}`
-      const old = environment[key]
-      environment._set(key, needle)
-
-      try {
-        expect(stringContainsSecret(haystack)).toBe(true)
-      } finally {
-        environment._set(key, old)
-      }
-    })
-
-    it.each(SECRETS)(
-      "detects that a string does not contain a secret in: %s",
-      key => {
-        const needle = randomUUID()
-        const haystack = `this does not contain a secret`
-        const old = environment[key]
-        environment._set(key, needle)
-        try {
-          expect(stringContainsSecret(haystack)).toBe(false)
-        } finally {
-          environment._set(key, old)
-        }
-      }
-    )
-  })
-})

package/src/security/tests/sessions.spec.ts

@@ -1,12 +0,0 @@
-import * as sessions from "../sessions"
-
-describe("sessions", () => {
-  describe("getSessionsForUser", () => {
-    it("returns empty when user is undefined", async () => {
-      // @ts-ignore - allow the undefined to be passed
-      const results = await sessions.getSessionsForUser(undefined)
-
-      expect(results).toStrictEqual([])
-    })
-  })
-})

package/src/sql/designDoc.ts

@@ -1,17 +0,0 @@
-import { PreSaveSQLiteDefinition } from "@budibase/types"
-import { SQLITE_DESIGN_DOC_ID } from "../constants"
-
-// the table id property defines which property in the document
-// to use when splitting the documents into different sqlite tables
-export function base(tableIdProp: string): PreSaveSQLiteDefinition {
-  return {
-    _id: SQLITE_DESIGN_DOC_ID,
-    language: "sqlite",
-    sql: {
-      tables: {},
-      options: {
-        table_name: tableIdProp,
-      },
-    },
-  }
-}

package/src/sql/index.ts

@@ -1,5 +0,0 @@
-export * as utils from "./utils"
-
-export { default as Sql, COUNT_FIELD_NAME } from "./sql"
-export { default as SqlTable } from "./sqlTable"
-export * as designDoc from "./designDoc"