@budibase/server 0.0.32 → 0.0.999-alpha.30

package/dist/integrations/snowflake.js

@@ -0,0 +1,99 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const types_1 = require("@budibase/types");
+const snowflake_promise_1 = require("snowflake-promise");
+const SCHEMA = {
+    docs: "https://developers.snowflake.com/",
+    description: "Snowflake is a solution for data warehousing, data lakes, data engineering, data science, data application development, and securely sharing and consuming shared data.",
+    friendlyName: "Snowflake",
+    type: "Relational",
+    datasource: {
+        account: {
+            type: "string",
+            required: true,
+        },
+        username: {
+            type: "string",
+            required: true,
+        },
+        password: {
+            type: "password",
+            required: true,
+        },
+        warehouse: {
+            type: "string",
+            required: true,
+        },
+        database: {
+            type: "string",
+            required: true,
+        },
+        schema: {
+            type: "string",
+            required: true,
+        },
+    },
+    query: {
+        create: {
+            type: types_1.QueryType.SQL,
+        },
+        read: {
+            type: types_1.QueryType.SQL,
+        },
+        update: {
+            type: types_1.QueryType.SQL,
+        },
+        delete: {
+            type: types_1.QueryType.SQL,
+        },
+    },
+};
+class SnowflakeIntegration {
+    constructor(config) {
+        this.client = new snowflake_promise_1.Snowflake(config);
+    }
+    internalQuery(query) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.client.connect();
+            try {
+                return yield this.client.execute(query.sql);
+            }
+            catch (err) {
+                throw (err === null || err === void 0 ? void 0 : err.message.split(":")[1]) || (err === null || err === void 0 ? void 0 : err.message);
+            }
+        });
+    }
+    create(query) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.internalQuery(query);
+        });
+    }
+    read(query) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.internalQuery(query);
+        });
+    }
+    update(query) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.internalQuery(query);
+        });
+    }
+    delete(query) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.internalQuery(query);
+        });
+    }
+}
+exports.default = {
+    schema: SCHEMA,
+    integration: SnowflakeIntegration,
+};

package/dist/integrations/utils.js

@@ -0,0 +1,295 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.finaliseExternalTables = exports.shouldCopySpecialColumn = exports.shouldCopyRelationship = exports.isIsoDateString = exports.isSQL = exports.getSqlQuery = exports.convertSqlType = exports.breakRowIdField = exports.convertRowId = exports.isRowId = exports.generateRowIdField = exports.breakExternalTableId = exports.buildExternalTableId = exports.isExternalTable = exports.SqlClient = void 0;
+const types_1 = require("@budibase/types");
+const utils_1 = require("../db/utils");
+const constants_1 = require("../constants");
+const DOUBLE_SEPARATOR = `${utils_1.SEPARATOR}${utils_1.SEPARATOR}`;
+const ROW_ID_REGEX = /^\[.*]$/g;
+const ENCODED_SPACE = encodeURIComponent(" ");
+const SQL_NUMBER_TYPE_MAP = {
+    integer: constants_1.FieldTypes.NUMBER,
+    int: constants_1.FieldTypes.NUMBER,
+    decimal: constants_1.FieldTypes.NUMBER,
+    smallint: constants_1.FieldTypes.NUMBER,
+    real: constants_1.FieldTypes.NUMBER,
+    float: constants_1.FieldTypes.NUMBER,
+    numeric: constants_1.FieldTypes.NUMBER,
+    mediumint: constants_1.FieldTypes.NUMBER,
+    dec: constants_1.FieldTypes.NUMBER,
+    double: constants_1.FieldTypes.NUMBER,
+    fixed: constants_1.FieldTypes.NUMBER,
+    "double precision": constants_1.FieldTypes.NUMBER,
+    number: constants_1.FieldTypes.NUMBER,
+    binary_float: constants_1.FieldTypes.NUMBER,
+    binary_double: constants_1.FieldTypes.NUMBER,
+    money: constants_1.FieldTypes.NUMBER,
+    smallmoney: constants_1.FieldTypes.NUMBER,
+};
+const SQL_DATE_TYPE_MAP = {
+    timestamp: constants_1.FieldTypes.DATETIME,
+    time: constants_1.FieldTypes.DATETIME,
+    datetime: constants_1.FieldTypes.DATETIME,
+    smalldatetime: constants_1.FieldTypes.DATETIME,
+    date: constants_1.FieldTypes.DATETIME,
+};
+const SQL_DATE_ONLY_TYPES = ["date"];
+const SQL_TIME_ONLY_TYPES = ["time"];
+const SQL_STRING_TYPE_MAP = {
+    varchar: constants_1.FieldTypes.STRING,
+    char: constants_1.FieldTypes.STRING,
+    nchar: constants_1.FieldTypes.STRING,
+    nvarchar: constants_1.FieldTypes.STRING,
+    ntext: constants_1.FieldTypes.STRING,
+    enum: constants_1.FieldTypes.STRING,
+    blob: constants_1.FieldTypes.STRING,
+    long: constants_1.FieldTypes.STRING,
+    text: constants_1.FieldTypes.STRING,
+    bigint: constants_1.FieldTypes.STRING,
+};
+const SQL_BOOLEAN_TYPE_MAP = {
+    boolean: constants_1.FieldTypes.BOOLEAN,
+    bit: constants_1.FieldTypes.BOOLEAN,
+    tinyint: constants_1.FieldTypes.BOOLEAN,
+};
+const SQL_MISC_TYPE_MAP = {
+    json: constants_1.FieldTypes.JSON,
+};
+const SQL_TYPE_MAP = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, SQL_NUMBER_TYPE_MAP), SQL_DATE_TYPE_MAP), SQL_STRING_TYPE_MAP), SQL_BOOLEAN_TYPE_MAP), SQL_MISC_TYPE_MAP);
+var SqlClient;
+(function (SqlClient) {
+    SqlClient["MS_SQL"] = "mssql";
+    SqlClient["POSTGRES"] = "pg";
+    SqlClient["MY_SQL"] = "mysql2";
+    SqlClient["ORACLE"] = "oracledb";
+})(SqlClient = exports.SqlClient || (exports.SqlClient = {}));
+function isExternalTable(tableId) {
+    return tableId.includes(utils_1.DocumentType.DATASOURCE);
+}
+exports.isExternalTable = isExternalTable;
+function buildExternalTableId(datasourceId, tableName) {
+    // encode spaces
+    if (tableName.includes(" ")) {
+        tableName = encodeURIComponent(tableName);
+    }
+    return `${datasourceId}${DOUBLE_SEPARATOR}${tableName}`;
+}
+exports.buildExternalTableId = buildExternalTableId;
+function breakExternalTableId(tableId) {
+    if (!tableId) {
+        return {};
+    }
+    const parts = tableId.split(DOUBLE_SEPARATOR);
+    let datasourceId = parts.shift();
+    // if they need joined
+    let tableName = parts.join(DOUBLE_SEPARATOR);
+    // if contains encoded spaces, decode it
+    if (tableName.includes(ENCODED_SPACE)) {
+        tableName = decodeURIComponent(tableName);
+    }
+    return { datasourceId, tableName };
+}
+exports.breakExternalTableId = breakExternalTableId;
+function generateRowIdField(keyProps = []) {
+    if (!Array.isArray(keyProps)) {
+        keyProps = [keyProps];
+    }
+    // this conserves order and types
+    // we have to swap the double quotes to single quotes for use in HBS statements
+    // when using the literal helper the double quotes can break things
+    return encodeURIComponent(JSON.stringify(keyProps).replace(/"/g, "'"));
+}
+exports.generateRowIdField = generateRowIdField;
+function isRowId(field) {
+    return (Array.isArray(field) ||
+        (typeof field === "string" && field.match(ROW_ID_REGEX) != null));
+}
+exports.isRowId = isRowId;
+function convertRowId(field) {
+    if (Array.isArray(field)) {
+        return field[0];
+    }
+    if (typeof field === "string" && field.match(ROW_ID_REGEX) != null) {
+        return field.substring(1, field.length - 1);
+    }
+    return field;
+}
+exports.convertRowId = convertRowId;
+// should always return an array
+function breakRowIdField(_id) {
+    if (!_id) {
+        return [];
+    }
+    // have to replace on the way back as we swapped out the double quotes
+    // when encoding, but JSON can't handle the single quotes
+    const id = typeof _id === "string" ? _id : _id._id;
+    const decoded = decodeURIComponent(id).replace(/'/g, '"');
+    try {
+        const parsed = JSON.parse(decoded);
+        return Array.isArray(parsed) ? parsed : [parsed];
+    }
+    catch (err) {
+        // wasn't json - likely was handlebars for a many to many
+        return [_id];
+    }
+}
+exports.breakRowIdField = breakRowIdField;
+function convertSqlType(type) {
+    let foundType = constants_1.FieldTypes.STRING;
+    const lcType = type.toLowerCase();
+    let matchingTypes = [];
+    for (let [external, internal] of Object.entries(SQL_TYPE_MAP)) {
+        if (lcType.includes(external)) {
+            matchingTypes.push({ external, internal });
+        }
+    }
+    //Set the foundType based the longest match
+    if (matchingTypes.length > 0) {
+        foundType = matchingTypes.reduce((acc, val) => {
+            return acc.external.length >= val.external.length ? acc : val;
+        }).internal;
+    }
+    const schema = { type: foundType };
+    if (foundType === constants_1.FieldTypes.DATETIME) {
+        schema.dateOnly = SQL_DATE_ONLY_TYPES.includes(lcType);
+        schema.timeOnly = SQL_TIME_ONLY_TYPES.includes(lcType);
+    }
+    return schema;
+}
+exports.convertSqlType = convertSqlType;
+function getSqlQuery(query) {
+    if (typeof query === "string") {
+        return { sql: query };
+    }
+    else {
+        return query;
+    }
+}
+exports.getSqlQuery = getSqlQuery;
+function isSQL(datasource) {
+    if (!datasource || !datasource.source) {
+        return false;
+    }
+    const SQL = [
+        types_1.SourceName.POSTGRES,
+        types_1.SourceName.SQL_SERVER,
+        types_1.SourceName.MYSQL,
+        types_1.SourceName.ORACLE,
+    ];
+    return SQL.indexOf(datasource.source) !== -1;
+}
+exports.isSQL = isSQL;
+function isIsoDateString(str) {
+    if (!/\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{3}Z/.test(str)) {
+        return false;
+    }
+    let d = new Date(str);
+    return d.toISOString() === str;
+}
+exports.isIsoDateString = isIsoDateString;
+/**
+ * This function will determine whether a column is a relationship and whether it
+ * is currently valid. The reason for the validity check is that tables can be deleted
+ * outside of Budibase control and if this is the case it will break Budibase relationships.
+ * The tableIds is a list passed down from the main finalise tables function, which is
+ * based on the tables that have just been fetched. This will only really be used on subsequent
+ * fetches to the first one - if the user is periodically refreshing Budibase knowledge of tables.
+ * @param column The column to check, to see if it is a valid relationship.
+ * @param tableIds The IDs of the tables which currently exist.
+ */
+function shouldCopyRelationship(column, tableIds) {
+    return (column.type === constants_1.FieldTypes.LINK &&
+        column.tableId &&
+        tableIds.includes(column.tableId));
+}
+exports.shouldCopyRelationship = shouldCopyRelationship;
+/**
+ * Similar function to the shouldCopyRelationship function, but instead this looks for options and boolean
+ * types. It is possible to switch a string -> options and a number -> boolean (and vice versus) need to make
+ * sure that these get copied over when tables are fetched. Also checks whether they are still valid, if a
+ * column has changed type in the external database then copying it over may not be possible.
+ * @param column The column to check for options or boolean type.
+ * @param fetchedColumn The fetched column to check for the type in the external database.
+ */
+function shouldCopySpecialColumn(column, fetchedColumn) {
+    const isFormula = column.type === constants_1.FieldTypes.FORMULA;
+    const specialTypes = [
+        constants_1.FieldTypes.OPTIONS,
+        constants_1.FieldTypes.LONGFORM,
+        constants_1.FieldTypes.ARRAY,
+        constants_1.FieldTypes.FORMULA,
+    ];
+    // column has been deleted, remove - formulas will never exist, always copy
+    if (!isFormula && column && !fetchedColumn) {
+        return false;
+    }
+    const fetchedIsNumber = !fetchedColumn || fetchedColumn.type === constants_1.FieldTypes.NUMBER;
+    return (specialTypes.indexOf(column.type) !== -1 ||
+        (fetchedIsNumber && column.type === constants_1.FieldTypes.BOOLEAN));
+}
+exports.shouldCopySpecialColumn = shouldCopySpecialColumn;
+/**
+ * Looks for columns which need to be copied over into the new table definitions, like relationships
+ * and options types.
+ * @param tableName The name of the table which is being checked.
+ * @param table The specific table which is being checked.
+ * @param entities All the tables that existed before - the old table definitions.
+ * @param tableIds The IDs of the tables which exist now, to check if anything has been removed.
+ */
+function copyExistingPropsOver(tableName, table, entities, tableIds) {
+    var _a, _b, _c;
+    if (entities && entities[tableName]) {
+        if ((_a = entities[tableName]) === null || _a === void 0 ? void 0 : _a.primaryDisplay) {
+            table.primaryDisplay = entities[tableName].primaryDisplay;
+        }
+        if ((_b = entities[tableName]) === null || _b === void 0 ? void 0 : _b.created) {
+            table.created = (_c = entities[tableName]) === null || _c === void 0 ? void 0 : _c.created;
+        }
+        const existingTableSchema = entities[tableName].schema;
+        for (let key in existingTableSchema) {
+            if (!existingTableSchema.hasOwnProperty(key)) {
+                continue;
+            }
+            const column = existingTableSchema[key];
+            if (shouldCopyRelationship(column, tableIds) ||
+                shouldCopySpecialColumn(column, table.schema[key])) {
+                table.schema[key] = existingTableSchema[key];
+            }
+        }
+    }
+    return table;
+}
+/**
+ * Look through the final table definitions to see if anything needs to be
+ * copied over from the old and if any errors have occurred mark them so
+ * that the user can be made aware.
+ * @param tables The list of tables that have been retrieved from the external database.
+ * @param entities The old list of tables, if there was any to look for definitions in.
+ */
+function finaliseExternalTables(tables, entities) {
+    const invalidColumns = Object.values(constants_1.InvalidColumns);
+    let finalTables = {};
+    const errors = {};
+    // @ts-ignore
+    const tableIds = Object.values(tables).map(table => table._id);
+    for (let [name, table] of Object.entries(tables)) {
+        const schemaFields = Object.keys(table.schema);
+        // make sure every table has a key
+        if (table.primary == null || table.primary.length === 0) {
+            errors[name] = constants_1.BuildSchemaErrors.NO_KEY;
+            continue;
+        }
+        else if (schemaFields.find(field => invalidColumns.includes(field))) {
+            errors[name] = constants_1.BuildSchemaErrors.INVALID_COLUMN;
+            continue;
+        }
+        // make sure all previous props have been added back
+        finalTables[name] = copyExistingPropsOver(name, table, entities, tableIds);
+    }
+    // sort the tables by name
+    finalTables = Object.entries(finalTables)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .reduce((r, [k, v]) => (Object.assign(Object.assign({}, r), { [k]: v })), {});
+    return { tables: finalTables, errors };
+}
+exports.finaliseExternalTables = finaliseExternalTables;

package/dist/middleware/appInfo.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.middleware = exports.AppType = void 0;
+const utils_1 = require("../db/utils");
+var AppType;
+(function (AppType) {
+    AppType["DEV"] = "dev";
+    AppType["PROD"] = "prod";
+})(AppType = exports.AppType || (exports.AppType = {}));
+function middleware({ appType } = {}) {
+    return (ctx, next) => {
+        const appId = ctx.appId;
+        if (appType === AppType.DEV && appId && !(0, utils_1.isDevAppID)(appId)) {
+            ctx.throw(400, "Only apps in development support this endpoint");
+        }
+        if (appType === AppType.PROD && appId && !(0, utils_1.isProdAppID)(appId)) {
+            ctx.throw(400, "Only apps in production support this endpoint");
+        }
+        return next();
+    };
+}
+exports.middleware = middleware;

package/dist/middleware/authorized.js

@@ -0,0 +1,112 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const backend_core_1 = require("@budibase/backend-core");
+const builder_1 = __importDefault(require("./builder"));
+const utils_1 = require("./utils");
+function hasResource(ctx) {
+    return ctx.resourceId != null;
+}
+const csrf = backend_core_1.auth.buildCsrfMiddleware();
+/**
+ * Apply authorization to the requested resource:
+ * - If this is a builder resource the user must be a builder.
+ * - Builders can access all resources.
+ * - Otherwise the user must have the required role.
+ */
+const checkAuthorized = (ctx, resourceRoles, permType, permLevel) => __awaiter(void 0, void 0, void 0, function* () {
+    // check if this is a builder api and the user is not a builder
+    const isBuilder = ctx.user && ctx.user.builder && ctx.user.builder.global;
+    const isBuilderApi = permType === backend_core_1.permissions.PermissionType.BUILDER;
+    if (isBuilderApi && !isBuilder) {
+        return ctx.throw(403, "Not Authorized");
+    }
+    // check for resource authorization
+    if (!isBuilder) {
+        yield checkAuthorizedResource(ctx, resourceRoles, permType, permLevel);
+    }
+});
+const checkAuthorizedResource = (ctx, resourceRoles, permType, permLevel) => __awaiter(void 0, void 0, void 0, function* () {
+    // get the user's roles
+    const roleId = ctx.roleId || backend_core_1.roles.BUILTIN_ROLE_IDS.PUBLIC;
+    const userRoles = (yield backend_core_1.roles.getUserRoleHierarchy(roleId, {
+        idOnly: false,
+    }));
+    const permError = "User does not have permission";
+    // check if the user has the required role
+    if (resourceRoles.length > 0) {
+        // deny access if the user doesn't have the required resource role
+        const found = userRoles.find((role) => resourceRoles.indexOf(role._id) !== -1);
+        if (!found) {
+            ctx.throw(403, permError);
+        }
+        // fallback to the base permissions when no resource roles are found
+    }
+    else if (!backend_core_1.permissions.doesHaveBasePermission(permType, permLevel, userRoles)) {
+        ctx.throw(403, permError);
+    }
+});
+exports.default = (permType, permLevel = null, opts = { schema: false }) => (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
+    // webhooks don't need authentication, each webhook unique
+    // also internal requests (between services) don't need authorized
+    if ((0, utils_1.isWebhookEndpoint)(ctx) || ctx.internal) {
+        return next();
+    }
+    if (!ctx.user) {
+        return ctx.throw(403, "No user info found");
+    }
+    // get the resource roles
+    let resourceRoles = [];
+    let otherLevelRoles = [];
+    const otherLevel = permLevel === backend_core_1.permissions.PermissionLevel.READ
+        ? backend_core_1.permissions.PermissionLevel.WRITE
+        : backend_core_1.permissions.PermissionLevel.READ;
+    const appId = backend_core_1.context.getAppId();
+    if (appId && hasResource(ctx)) {
+        resourceRoles = yield backend_core_1.roles.getRequiredResourceRole(permLevel, ctx);
+        if (opts && opts.schema) {
+            otherLevelRoles = yield backend_core_1.roles.getRequiredResourceRole(otherLevel, ctx);
+        }
+    }
+    // if the resource is public, proceed
+    if (resourceRoles.includes(backend_core_1.roles.BUILTIN_ROLE_IDS.PUBLIC) ||
+        (otherLevelRoles &&
+            otherLevelRoles.includes(backend_core_1.roles.BUILTIN_ROLE_IDS.PUBLIC))) {
+        return next();
+    }
+    // check authenticated
+    if (!ctx.isAuthenticated) {
+        return ctx.throw(403, "Session not authenticated");
+    }
+    // check general builder stuff, this middleware is a good way
+    // to find API endpoints which are builder focused
+    if (permType === backend_core_1.permissions.PermissionType.BUILDER) {
+        yield (0, builder_1.default)(ctx);
+    }
+    try {
+        // check authorized
+        yield checkAuthorized(ctx, resourceRoles, permType, permLevel);
+    }
+    catch (err) {
+        // this is a schema, check if
+        if (opts && opts.schema && permLevel) {
+            yield checkAuthorized(ctx, otherLevelRoles, permType, otherLevel);
+        }
+        else {
+            throw err;
+        }
+    }
+    // csrf protection
+    return csrf(ctx, next);
+});

package/dist/middleware/builder.js

@@ -0,0 +1,93 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("../db/utils");
+const redis_1 = require("../utilities/redis");
+const backend_core_1 = require("@budibase/backend-core");
+const DEBOUNCE_TIME_SEC = 30;
+/************************************************** *
+ * This middleware has been broken out of the       *
+ * "authorized" middleware as it had nothing to do  *
+ * with authorization, but requires the perms       *
+ * imparted by it. This middleware shouldn't        *
+ * be called directly, it should always be called   *
+ * through the authorized middleware                *
+ ****************************************************/
+function checkDevAppLocks(ctx) {
+    var _a, _b;
+    return __awaiter(this, void 0, void 0, function* () {
+        const appId = ctx.appId;
+        // if any public usage, don't proceed
+        if (!((_a = ctx.user) === null || _a === void 0 ? void 0 : _a._id) && !((_b = ctx.user) === null || _b === void 0 ? void 0 : _b.userId)) {
+            return;
+        }
+        // not a development app, don't need to do anything
+        if (!appId || !appId.startsWith(utils_1.APP_DEV_PREFIX)) {
+            return;
+        }
+        if (!(yield (0, redis_1.doesUserHaveLock)(appId, ctx.user))) {
+            ctx.throw(400, "User does not hold app lock.");
+        }
+        // they do have lock, update it
+        yield (0, redis_1.updateLock)(appId, ctx.user);
+    });
+}
+function updateAppUpdatedAt(ctx) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const appId = ctx.appId;
+        // if debouncing skip this update
+        // get methods also aren't updating
+        if (ctx.method === "GET" || (yield (0, redis_1.checkDebounce)(appId))) {
+            return;
+        }
+        yield backend_core_1.db.doWithDB(appId, (db) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const metadata = yield db.get(utils_1.DocumentType.APP_METADATA);
+            metadata.updatedAt = new Date().toISOString();
+            metadata.updatedBy = (0, utils_1.getGlobalIDFromUserMetadataID)((_a = ctx.user) === null || _a === void 0 ? void 0 : _a.userId);
+            const response = yield db.put(metadata);
+            metadata._rev = response.rev;
+            yield backend_core_1.cache.app.invalidateAppMetadata(appId, metadata);
+            // set a new debounce record with a short TTL
+            yield (0, redis_1.setDebounce)(appId, DEBOUNCE_TIME_SEC);
+        }));
+    });
+}
+function builder(ctx) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const appId = ctx.appId;
+        // this only functions within an app context
+        if (!appId) {
+            return;
+        }
+        // check authenticated
+        if (!ctx.isAuthenticated) {
+            return ctx.throw(403, "Session not authenticated");
+        }
+        const referer = ctx.headers["referer"];
+        const overviewPath = "/builder/portal/overview/";
+        const overviewContext = !referer ? false : referer.includes(overviewPath);
+        if (overviewContext) {
+            return;
+        }
+        const hasAppId = !referer ? false : referer.includes(appId);
+        const editingApp = referer ? hasAppId : false;
+        // check this is a builder call and editing
+        if (!editingApp) {
+            return;
+        }
+        // check locks
+        yield checkDevAppLocks(ctx);
+        // set updated at time on app
+        yield updateAppUpdatedAt(ctx);
+    });
+}
+exports.default = builder;