@budibase/server 0.0.32 → 0.0.999-alpha.30

package/src/api/routes/public/tests/metrics.spec.js

@@ -0,0 +1,34 @@
+const setup = require("../../tests/utilities")
+
+jest.setTimeout(30000)
+
+describe("/metrics", () => {
+  let request = setup.getRequest()
+  let config = setup.getConfig()
+
+  afterAll(setup.afterAll)
+
+  // For some reason this cannot be a beforeAll or the test "should be able to update the user" fail
+  beforeEach(async () => {
+    await config.init()
+  })
+
+  describe("get", () => {
+    it("returns a list of metrics", async () => {
+      const res = await request
+        .get(`/api/public/v1/metrics`)
+        .set(config.defaultHeaders())
+        .expect("Content-Type", /text\/plain/)
+        .expect(200)
+      expect(res.text).toContain("budibase_tenant_user_count")
+    })
+
+    it("endpoint should not be publicly exposed", async () => {
+      await request
+      .get(`/api/public/v1/metrics`)
+      .set(config.publicHeaders())
+      .expect(403)
+    })
+  })
+
+})

package/src/api/routes/public/tests/users.spec.js

@@ -0,0 +1,38 @@
+const setup = require("../../tests/utilities")
+const { generateMakeRequest } = require("./utils")
+
+const workerRequests = require("../../../../utilities/workerRequests")
+
+let config = setup.getConfig()
+let apiKey, globalUser, makeRequest
+
+beforeAll(async () => {
+  await config.init()
+  globalUser = await config.globalUser()
+  apiKey = await config.generateApiKey(globalUser._id)
+  makeRequest = generateMakeRequest(apiKey)
+  workerRequests.readGlobalUser.mockReturnValue(globalUser)
+})
+
+afterAll(setup.afterAll)
+
+describe("check user endpoints", () => {
+  it("should not allow a user to update their own roles", async () => {
+    const res = await makeRequest("put", `/users/${globalUser._id}`, {
+      ...globalUser,
+      roles: {
+        "app_1": "ADMIN",
+      }
+    })
+    expect(workerRequests.saveGlobalUser.mock.lastCall[0].body.data.roles["app_1"]).toBeUndefined()
+    expect(res.status).toBe(200)
+    expect(res.body.data.roles["app_1"]).toBeUndefined()
+  })
+
+  it("should not allow a user to delete themselves", async () => {
+    const res = await makeRequest("delete", `/users/${globalUser._id}`)
+    expect(res.status).toBe(405)
+    expect(workerRequests.deleteGlobalUser.mock.lastCall).toBeUndefined()
+  })
+})
+

package/src/api/routes/public/tests/utils.ts

@@ -0,0 +1,45 @@
+import * as setup from "../../tests/utilities"
+import { checkSlashesInUrl } from "../../../../utilities"
+import supertest from "supertest"
+
+export type HttpMethod = "post" | "get" | "put" | "delete" | "patch"
+
+export type MakeRequestResponse = (
+  method: HttpMethod,
+  endpoint: string,
+  body?: any,
+  intAppId?: string
+) => Promise<supertest.Response>
+
+export function generateMakeRequest(
+  apiKey: string,
+  isInternal = false
+): MakeRequestResponse {
+  const request = setup.getRequest()!
+  const config = setup.getConfig()!
+  return async (
+    method: HttpMethod,
+    endpoint: string,
+    body?: any,
+    intAppId: string | null = config.getAppId()
+  ) => {
+    const extraHeaders: any = {
+      "x-budibase-api-key": apiKey,
+    }
+    if (intAppId) {
+      extraHeaders["x-budibase-app-id"] = intAppId
+    }
+
+    const url = isInternal
+      ? endpoint
+      : checkSlashesInUrl(`/api/public/v1/${endpoint}`)
+
+    const req = request[method](url).set(config.defaultHeaders(extraHeaders))
+    if (body) {
+      req.send(body)
+    }
+    const res = await req
+    expect(res.body).toBeDefined()
+    return res
+  }
+}

package/src/api/routes/public/users.ts

@@ -0,0 +1,142 @@
+import controller from "../../controllers/public/users"
+import Endpoint from "./utils/Endpoint"
+import { nameValidator } from "../utils/validators"
+
+const read = [],
+  write = []
+
+/**
+ * @openapi
+ * /users:
+ *   post:
+ *     operationId: userCreate
+ *     summary: Create a user
+ *     tags:
+ *       - users
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             $ref: '#/components/schemas/user'
+ *     responses:
+ *       200:
+ *         description: Returns the created user.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               $ref: '#/components/schemas/userOutput'
+ *             examples:
+ *               user:
+ *                 $ref: '#/components/examples/user'
+ */
+write.push(new Endpoint("post", "/users", controller.create))
+
+/**
+ * @openapi
+ * /users/{userId}:
+ *   put:
+ *     operationId: userUpdate
+ *     summary: Update a user
+ *     tags:
+ *       - users
+ *     parameters:
+ *       - $ref: '#/components/parameters/userId'
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             $ref: '#/components/schemas/user'
+ *     responses:
+ *       200:
+ *         description: Returns the updated user.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               $ref: '#/components/schemas/userOutput'
+ *             examples:
+ *               user:
+ *                 $ref: '#/components/examples/user'
+ */
+write.push(new Endpoint("put", "/users/:userId", controller.update))
+
+/**
+ * @openapi
+ * /users/{userId}:
+ *   delete:
+ *     operationId: userDestroy
+ *     summary: Delete a user
+ *     tags:
+ *       - users
+ *     parameters:
+ *       - $ref: '#/components/parameters/userId'
+ *     responses:
+ *       200:
+ *         description: Returns the deleted user.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               $ref: '#/components/schemas/userOutput'
+ *             examples:
+ *               user:
+ *                 $ref: '#/components/examples/user'
+ */
+write.push(new Endpoint("delete", "/users/:userId", controller.destroy))
+
+/**
+ * @openapi
+ * /users/{userId}:
+ *   get:
+ *     operationId: userGetById
+ *     summary: Retrieve a user
+ *     tags:
+ *       - users
+ *     parameters:
+ *       - $ref: '#/components/parameters/userId'
+ *     responses:
+ *       200:
+ *         description: Returns the retrieved user.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               $ref: '#/components/schemas/userOutput'
+ *             examples:
+ *               user:
+ *                 $ref: '#/components/examples/user'
+ */
+read.push(new Endpoint("get", "/users/:userId", controller.read))
+
+/**
+ * @openapi
+ * /users/search:
+ *   post:
+ *     operationId: userSearch
+ *     summary: Search for users
+ *     description: Based on user properties (currently only name) search for users.
+ *     tags:
+ *       - users
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             $ref: '#/components/schemas/nameSearch'
+ *     responses:
+ *       200:
+ *         description: Returns the found users based on search parameters.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               $ref: '#/components/schemas/userSearch'
+ *             examples:
+ *               users:
+ *                 $ref: '#/components/examples/users'
+ */
+read.push(
+  new Endpoint("post", "/users/search", controller.search).addMiddleware(
+    nameValidator()
+  )
+)
+
+export default { read, write }

package/src/api/routes/public/utils/Endpoint.ts

@@ -0,0 +1,51 @@
+import Router from "@koa/router"
+
+export type CtxFn = (ctx: any, next?: any) => void | Promise<any>
+
+class Endpoint {
+  method: string
+  url: string
+  controller: CtxFn
+  middlewares: CtxFn[]
+  outputMiddlewares: CtxFn[]
+
+  constructor(method: string, url: string, controller: CtxFn) {
+    this.method = method
+    this.url = url
+    this.controller = controller
+    this.middlewares = []
+    this.outputMiddlewares = []
+  }
+
+  addMiddleware(middleware: CtxFn) {
+    this.middlewares.push(middleware)
+    return this
+  }
+
+  addOutputMiddleware(middleware: CtxFn) {
+    this.outputMiddlewares.push(middleware)
+    return this
+  }
+
+  apply(router: Router) {
+    const method = this.method,
+      url = this.url
+    const middlewares = this.middlewares,
+      controller = this.controller,
+      outputMiddlewares = this.outputMiddlewares
+    // need a function to do nothing to stop the execution at the end
+    // middlewares are circular so if they always keep calling next, it'll just keep looping
+    const complete = () => {}
+    const params = [
+      url,
+      ...middlewares,
+      controller,
+      ...outputMiddlewares,
+      complete,
+    ]
+    // @ts-ignore
+    router[method](...params)
+  }
+}
+
+export default Endpoint

package/src/api/routes/query.ts

@@ -0,0 +1,61 @@
+import Router from "@koa/router"
+import * as queryController from "../controllers/query"
+import authorized from "../../middleware/authorized"
+import { permissions } from "@budibase/backend-core"
+import {
+  bodyResource,
+  bodySubResource,
+  paramResource,
+} from "../../middleware/resourceId"
+import {
+  generateQueryPreviewValidation,
+  generateQueryValidation,
+} from "../controllers/query/validation"
+const { BUILDER, PermissionType, PermissionLevel } = permissions
+
+const router: Router = new Router()
+
+router
+  .get("/api/queries", authorized(BUILDER), queryController.fetch)
+  .post(
+    "/api/queries",
+    bodySubResource("datasourceId", "_id"),
+    authorized(BUILDER),
+    generateQueryValidation(),
+    queryController.save
+  )
+  .post("/api/queries/import", authorized(BUILDER), queryController.import)
+  .post(
+    "/api/queries/preview",
+    bodyResource("datasourceId"),
+    authorized(BUILDER),
+    generateQueryPreviewValidation(),
+    queryController.preview
+  )
+  .get(
+    "/api/queries/:queryId",
+    paramResource("queryId"),
+    authorized(PermissionType.QUERY, PermissionLevel.READ),
+    queryController.find
+  )
+  // DEPRECATED - use new query endpoint for future work
+  .post(
+    "/api/queries/:queryId",
+    paramResource("queryId"),
+    authorized(PermissionType.QUERY, PermissionLevel.WRITE),
+    queryController.executeV1
+  )
+  .delete(
+    "/api/queries/:queryId/:revId",
+    paramResource("queryId"),
+    authorized(BUILDER),
+    queryController.destroy
+  )
+  .post(
+    "/api/v2/queries/:queryId",
+    paramResource("queryId"),
+    authorized(PermissionType.QUERY, PermissionLevel.WRITE),
+    queryController.executeV2 as any
+  )
+
+export default router

package/src/api/routes/role.ts

@@ -0,0 +1,24 @@
+import Router from "@koa/router"
+import * as controller from "../controllers/role"
+import authorized from "../../middleware/authorized"
+import { permissions } from "@budibase/backend-core"
+import { roleValidator } from "./utils/validators"
+
+const router: Router = new Router()
+
+router
+  .post(
+    "/api/roles",
+    authorized(permissions.BUILDER),
+    roleValidator(),
+    controller.save
+  )
+  .get("/api/roles", authorized(permissions.BUILDER), controller.fetch)
+  .get("/api/roles/:roleId", authorized(permissions.BUILDER), controller.find)
+  .delete(
+    "/api/roles/:roleId/:rev",
+    authorized(permissions.BUILDER),
+    controller.destroy
+  )
+
+export default router

package/src/api/routes/routing.ts

@@ -0,0 +1,14 @@
+import Router from "@koa/router"
+import authorized from "../../middleware/authorized"
+import { permissions } from "@budibase/backend-core"
+import * as controller from "../controllers/routing"
+
+const router: Router = new Router()
+
+router
+  // gets correct structure for user role
+  .get("/api/routing/client", controller.clientFetch)
+  // gets the full structure, not just the correct screen ID for user role
+  .get("/api/routing", authorized(permissions.BUILDER), controller.fetch)
+
+export default router

package/src/api/routes/row.ts

@@ -0,0 +1,266 @@
+import Router from "@koa/router"
+import * as rowController from "../controllers/row"
+import authorized from "../../middleware/authorized"
+import { paramResource, paramSubResource } from "../../middleware/resourceId"
+import { permissions } from "@budibase/backend-core"
+import { internalSearchValidator } from "./utils/validators"
+const { PermissionType, PermissionLevel } = permissions
+
+const router: Router = new Router()
+
+router
+  /**
+   * @api {get} /api/:tableId/:rowId/enrich Get an enriched row
+   * @apiName Get an enriched row
+   * @apiGroup rows
+   * @apiPermission table read access
+   * @apiDescription This API is only useful when dealing with rows that have relationships.
+   * Normally when a row is a returned from the API relationships will only have the structure
+   * `{ primaryDisplay: "name", _id: ... }` but this call will return the full related rows
+   * for each relationship instead.
+   *
+   * @apiParam {string} rowId The ID of the row which is to be retrieved and enriched.
+   *
+   * @apiSuccess {object} row The response body will be the enriched row.
+   */
+  .get(
+    "/api/:tableId/:rowId/enrich",
+    paramSubResource("tableId", "rowId"),
+    authorized(PermissionType.TABLE, PermissionLevel.READ),
+    rowController.fetchEnrichedRow
+  )
+  /**
+   * @api {get} /api/:tableId/rows Get all rows in a table
+   * @apiName Get all rows in a table
+   * @apiGroup rows
+   * @apiPermission table read access
+   * @apiDescription This is a deprecated endpoint that should not be used anymore, instead use the search endpoint.
+   * This endpoint gets all of the rows within the specified table - it is not heavily used
+   * due to its lack of support for pagination. With SQL tables this will retrieve up to a limit and then
+   * will simply stop.
+   *
+   * @apiParam {string} tableId The ID of the table to retrieve all rows within.
+   *
+   * @apiSuccess {object[]} rows The response body will be an array of all rows found.
+   */
+  .get(
+    "/api/:tableId/rows",
+    paramResource("tableId"),
+    authorized(PermissionType.TABLE, PermissionLevel.READ),
+    rowController.fetch
+  )
+  /**
+   * @api {get} /api/:tableId/rows/:rowId Retrieve a single row
+   * @apiName Retrieve a single row
+   * @apiGroup rows
+   * @apiPermission table read access
+   * @apiDescription This endpoint retrieves only the specified row. If you wish to retrieve
+   * a row by anything other than its _id field, use the search endpoint.
+   *
+   * @apiParam {string} tableId The ID of the table to retrieve a row from.
+   * @apiParam {string} rowId The ID of the row to retrieve.
+   *
+   * @apiSuccess {object} body The response body will be the row that was found.
+   */
+  .get(
+    "/api/:tableId/rows/:rowId",
+    paramSubResource("tableId", "rowId"),
+    authorized(PermissionType.TABLE, PermissionLevel.READ),
+    rowController.find
+  )
+  /**
+   * @api {post} /api/:tableId/search Search for rows in a table
+   * @apiName Search for rows in a table
+   * @apiGroup rows
+   * @apiPermission table read access
+   * @apiDescription This is the primary method of accessing rows in Budibase, the data provider
+   * and data UI in the builder are built atop this. All filtering, sorting and pagination is
+   * handled through this, for internal and external (datasource plus, e.g. SQL) tables.
+   *
+   * @apiParam {string} tableId The ID of the table to retrieve rows from.
+   *
+   * @apiParam (Body) {boolean} [paginate] If pagination is required then this should be set to true,
+   * defaults to false.
+   * @apiParam (Body) {object} [query] This contains a set of filters which should be applied, if none
+   * specified then the request will be unfiltered. An example with all of the possible query
+   * options has been supplied below.
+   * @apiParam (Body) {number} [limit] This sets a limit for the number of rows that will be returned,
+   * this will be implemented at the database level if supported for performance reasons. This
+   * is useful when paginating to set exactly how many rows per page.
+   * @apiParam (Body) {string} [bookmark] If pagination is enabled then a bookmark will be returned
+   * with each successful search request, this should be supplied back to get the next page.
+   * @apiParam (Body) {object} [sort] If sort is desired this should contain the name of the column to
+   * sort on.
+   * @apiParam (Body) {string} [sortOrder] If sort is enabled then this can be either "descending" or
+   * "ascending" as required.
+   * @apiParam (Body) {string} [sortType] If sort is enabled then you must specify the type of search
+   * being used, either "string" or "number". This is only used for internal tables.
+   *
+   * @apiParamExample {json} Example:
+   * {
+   *  "tableId": "ta_70260ff0b85c467ca74364aefc46f26d",
+   *  "query": {
+   *    "string": {},
+   *    "fuzzy": {},
+   *    "range": {
+   *      "columnName": {
+   *        "high": 20,
+   *        "low": 10,
+   *      }
+   *    },
+   *    "equal": {
+   *      "columnName": "someValue"
+   *    },
+   *    "notEqual": {},
+   *    "empty": {},
+   *    "notEmpty": {},
+   *    "oneOf": {
+   *      "columnName": ["value"]
+   *    }
+   *  },
+   *  "limit": 10,
+   *  "sort": "name",
+   *  "sortOrder": "descending",
+   *  "sortType": "string",
+   *  "paginate": true
+   * }
+   *
+   * @apiSuccess {object[]} rows An array of rows that was found based on the supplied parameters.
+   * @apiSuccess {boolean} hasNextPage If pagination was enabled then this specifies whether or
+   * not there is another page after this request.
+   * @apiSuccess {string} bookmark The bookmark to be sent with the next request to get the next
+   * page.
+   */
+  .post(
+    "/api/:tableId/search",
+    internalSearchValidator(),
+    paramResource("tableId"),
+    authorized(PermissionType.TABLE, PermissionLevel.READ),
+    rowController.search
+  )
+  // DEPRECATED - this is an old API, but for backwards compat it needs to be
+  // supported still
+  .post(
+    "/api/search/:tableId/rows",
+    paramResource("tableId"),
+    authorized(PermissionType.TABLE, PermissionLevel.READ),
+    rowController.search
+  )
+  /**
+   * @api {post} /api/:tableId/rows Creates a new row
+   * @apiName Creates a new row
+   * @apiGroup rows
+   * @apiPermission table write access
+   * @apiDescription This API will create a new row based on the supplied body. If the
+   * body includes an "_id" field then it will update an existing row if the field
+   * links to one. Please note that "_id", "_rev" and "tableId" are fields that are
+   * already used by Budibase tables and cannot be used for columns.
+   *
+   * @apiParam {string} tableId The ID of the table to save a row to.
+   *
+   * @apiParam (Body) {string} [_id] If the row exists already then an ID for the row must be provided.
+   * @apiParam (Body) {string} [_rev] If working with an existing row for an internal table its revision
+   * must also be provided.
+   * @apiParam (Body) {string} tableId The ID of the table should also be specified in the row body itself.
+   * @apiParam (Body) {any} [any] Any field supplied in the body will be assessed to see if it matches
+   * a column in the specified table. All other fields will be dropped and not stored.
+   *
+   * @apiSuccess {string} _id The ID of the row that was just saved, if it was just created this
+   * is the rows new ID.
+   * @apiSuccess {string} [_rev] If saving to an internal table a revision will also be returned.
+   * @apiSuccess {object} body The contents of the row that was saved will be returned as well.
+   */
+  .post(
+    "/api/:tableId/rows",
+    paramResource("tableId"),
+    authorized(PermissionType.TABLE, PermissionLevel.WRITE),
+    rowController.save
+  )
+  /**
+   * @api {patch} /api/:tableId/rows Updates a row
+   * @apiName Update a row
+   * @apiGroup rows
+   * @apiPermission table write access
+   * @apiDescription This endpoint is identical to the row creation endpoint but instead it will
+   * error if an _id isn't provided, it will only function for existing rows.
+   */
+  .patch(
+    "/api/:tableId/rows",
+    paramResource("tableId"),
+    authorized(PermissionType.TABLE, PermissionLevel.WRITE),
+    rowController.patch
+  )
+  /**
+   * @api {post} /api/:tableId/rows/validate Validate inputs for a row
+   * @apiName Validate inputs for a row
+   * @apiGroup rows
+   * @apiPermission table write access
+   * @apiDescription When attempting to save a row you may want to check if the row is valid
+   * given the table schema, this will iterate through all the constraints on the table and
+   * check if the request body is valid.
+   *
+   * @apiParam {string} tableId The ID of the table the row is to be validated for.
+   *
+   * @apiParam (Body) {any} [any] Any fields provided in the request body will be tested
+   * against the table schema and constraints.
+   *
+   * @apiSuccess {boolean} valid If inputs provided are acceptable within the table schema this
+   * will be true, if it is not then then errors property will be populated.
+   * @apiSuccess {object} [errors] A key value map of information about fields on the input
+   * which do not match the table schema. The key name will be the column names that have breached
+   * the schema.
+   */
+  .post(
+    "/api/:tableId/rows/validate",
+    paramResource("tableId"),
+    authorized(PermissionType.TABLE, PermissionLevel.WRITE),
+    rowController.validate
+  )
+  /**
+   * @api {delete} /api/:tableId/rows Delete rows
+   * @apiName Delete rows
+   * @apiGroup rows
+   * @apiPermission table write access
+   * @apiDescription This endpoint can delete a single row, or delete them in a bulk
+   * fashion.
+   *
+   * @apiParam {string} tableId The ID of the table the row is to be deleted from.
+   *
+   * @apiParam (Body) {object[]} [rows] If bulk deletion is desired then provide the rows in this
+   * key of the request body that are to be deleted.
+   * @apiParam (Body) {string} [_id] If deleting a single row then provide its ID in this field.
+   * @apiParam (Body) {string} [_rev] If deleting a single row from an internal table then provide its
+   * revision here.
+   *
+   * @apiSuccess {object[]|object} body If deleting bulk then the response body will be an array
+   * of the deleted rows, if deleting a single row then the body will contain a "row" property which
+   * is the deleted row.
+   */
+  .delete(
+    "/api/:tableId/rows",
+    paramResource("tableId"),
+    authorized(PermissionType.TABLE, PermissionLevel.WRITE),
+    rowController.destroy
+  )
+
+  /**
+   * @api {post} /api/:tableId/rows/exportRows Export Rows
+   * @apiName Export rows
+   * @apiGroup rows
+   * @apiPermission table write access
+   * @apiDescription This API can export a number of provided rows
+   *
+   * @apiParam {string} tableId The ID of the table the row is to be deleted from.
+   *
+   * @apiParam (Body) {object[]} [rows] The row IDs which are to be exported
+   *
+   * @apiSuccess {object[]|object}
+   */
+  .post(
+    "/api/:tableId/rows/exportRows",
+    paramResource("tableId"),
+    authorized(PermissionType.TABLE, PermissionLevel.WRITE),
+    rowController.exportRows
+  )
+
+export default router