@budibase/server 0.0.32 → 0.0.999-alpha.31

package/src/api/controllers/dev.ts

@@ -0,0 +1,129 @@
+import fetch from "node-fetch"
+import env from "../../environment"
+import { checkSlashesInUrl } from "../../utilities"
+import { request } from "../../utilities/workerRequests"
+import { clearLock as redisClearLock } from "../../utilities/redis"
+import { DocumentType } from "../../db/utils"
+import { context } from "@budibase/backend-core"
+import { events, db as dbCore, cache } from "@budibase/backend-core"
+
+async function redirect(ctx: any, method: string, path: string = "global") {
+  const { devPath } = ctx.params
+  const queryString = ctx.originalUrl.split("?")[1] || ""
+  const response = await fetch(
+    checkSlashesInUrl(
+      `${env.WORKER_URL}/api/${path}/${devPath}?${queryString}`
+    ),
+    request(ctx, {
+      method,
+      body: ctx.request.body,
+    })
+  )
+  if (response.status !== 200) {
+    const err = await response.text()
+    ctx.throw(400, err)
+  }
+  const cookie = response.headers.get("set-cookie")
+  if (cookie) {
+    ctx.set("set-cookie", cookie)
+  }
+  let body
+  try {
+    body = await response.json()
+  } catch (err) {
+    // don't worry about errors, likely no JSON
+  }
+  ctx.status = response.status
+  if (body) {
+    ctx.body = body
+  }
+  ctx.cookies
+}
+
+export function buildRedirectGet(path: string) {
+  return async (ctx: any) => {
+    await redirect(ctx, "GET", path)
+  }
+}
+
+export function buildRedirectPost(path: string) {
+  return async (ctx: any) => {
+    await redirect(ctx, "POST", path)
+  }
+}
+
+export function buildRedirectDelete(path: string) {
+  return async (ctx: any) => {
+    await redirect(ctx, "DELETE", path)
+  }
+}
+
+export async function clearLock(ctx: any) {
+  const { appId } = ctx.params
+  try {
+    await redisClearLock(appId, ctx.user)
+  } catch (err) {
+    ctx.throw(400, `Unable to remove lock. ${err}`)
+  }
+  ctx.body = {
+    message: "Lock released successfully.",
+  }
+}
+
+export async function revert(ctx: any) {
+  const { appId } = ctx.params
+  const productionAppId = dbCore.getProdAppID(appId)
+
+  // App must have been deployed first
+  try {
+    const db = context.getProdAppDB({ skip_setup: true })
+    const exists = await db.exists()
+    if (!exists) {
+      throw new Error("App must be deployed to be reverted.")
+    }
+    const deploymentDoc = await db.get(DocumentType.DEPLOYMENTS)
+    if (
+      !deploymentDoc.history ||
+      Object.keys(deploymentDoc.history).length === 0
+    ) {
+      throw new Error("No deployments for app")
+    }
+  } catch (err) {
+    return ctx.throw(400, "App has not yet been deployed")
+  }
+
+  const replication = new dbCore.Replication({
+    source: productionAppId,
+    target: appId,
+  })
+  try {
+    if (env.COUCH_DB_URL) {
+      // in-memory db stalls on rollback
+      await replication.rollback()
+    }
+
+    // update appID in reverted app to be dev version again
+    const db = context.getAppDB()
+    const appDoc = await db.get(DocumentType.APP_METADATA)
+    appDoc.appId = appId
+    appDoc.instance._id = appId
+    await db.put(appDoc)
+    await cache.app.invalidateAppMetadata(appId)
+    ctx.body = {
+      message: "Reverted changes successfully.",
+    }
+    await events.app.reverted(appDoc)
+  } catch (err) {
+    ctx.throw(400, `Unable to revert. ${err}`)
+  } finally {
+    await replication.close()
+  }
+}
+
+export async function getBudibaseVersion(ctx: any) {
+  const version = require("../../../package.json").version
+  ctx.body = {
+    version,
+  }
+  await events.installation.versionChecked(version)
+}

package/src/api/controllers/integration.ts

@@ -0,0 +1,13 @@
+import { getDefinitions } from "../../integrations"
+import { BBContext } from "@budibase/types"
+
+export async function fetch(ctx: BBContext) {
+  ctx.status = 200
+  ctx.body = await getDefinitions()
+}
+
+export async function find(ctx: BBContext) {
+  const defs = await getDefinitions()
+  ctx.status = 200
+  ctx.body = defs[ctx.params.type]
+}

package/src/api/controllers/layout.ts

@@ -0,0 +1,47 @@
+import { EMPTY_LAYOUT } from "../../constants/layouts"
+import { generateLayoutID, getScreenParams } from "../../db/utils"
+import { events, context } from "@budibase/backend-core"
+import { BBContext } from "@budibase/types"
+
+export async function save(ctx: BBContext) {
+  const db = context.getAppDB()
+  let layout = ctx.request.body
+
+  if (!layout.props) {
+    layout = {
+      ...EMPTY_LAYOUT,
+      ...layout,
+    }
+    layout.props._instanceName = layout.name
+  }
+
+  layout._id = layout._id || generateLayoutID()
+  const response = await db.put(layout)
+  await events.layout.created(layout)
+  layout._rev = response.rev
+
+  ctx.body = layout
+  ctx.status = 200
+}
+
+export async function destroy(ctx: BBContext) {
+  const db = context.getAppDB()
+  const layoutId = ctx.params.layoutId,
+    layoutRev = ctx.params.layoutRev
+
+  const layoutsUsedByScreens = (
+    await db.allDocs(
+      getScreenParams(null, {
+        include_docs: true,
+      })
+    )
+  ).rows.map(element => element.doc.layoutId)
+  if (layoutsUsedByScreens.includes(layoutId)) {
+    ctx.throw(400, "Cannot delete a layout that's being used by a screen")
+  }
+
+  await db.remove(layoutId, layoutRev)
+  await events.layout.deleted(layoutId)
+  ctx.body = { message: "Layout deleted successfully" }
+  ctx.status = 200
+}

package/src/api/controllers/metadata.ts

@@ -0,0 +1,42 @@
+import { MetadataTypes } from "../../constants"
+import { generateMetadataID } from "../../db/utils"
+import { saveEntityMetadata, deleteEntityMetadata } from "../../utilities"
+import { context } from "@budibase/backend-core"
+import { BBContext } from "@budibase/types"
+
+export async function getTypes(ctx: BBContext) {
+  ctx.body = {
+    types: MetadataTypes,
+  }
+}
+
+export async function saveMetadata(ctx: BBContext) {
+  const { type, entityId } = ctx.params
+  if (type === MetadataTypes.AUTOMATION_TEST_HISTORY) {
+    ctx.throw(400, "Cannot save automation history type")
+  }
+  ctx.body = await saveEntityMetadata(type, entityId, ctx.request.body)
+}
+
+export async function deleteMetadata(ctx: BBContext) {
+  const { type, entityId } = ctx.params
+  await deleteEntityMetadata(type, entityId)
+  ctx.body = {
+    message: "Metadata deleted successfully",
+  }
+}
+
+export async function getMetadata(ctx: BBContext) {
+  const { type, entityId } = ctx.params
+  const db = context.getAppDB()
+  const id = generateMetadataID(type, entityId)
+  try {
+    ctx.body = await db.get(id)
+  } catch (err: any) {
+    if (err.status === 404) {
+      ctx.body = {}
+    } else {
+      ctx.throw(err.status, err)
+    }
+  }
+}

package/src/api/controllers/migrations.ts

@@ -0,0 +1,14 @@
+import { migrate as migrationImpl, MIGRATIONS } from "../../migrations"
+import { BBContext } from "@budibase/types"
+
+export async function migrate(ctx: BBContext) {
+  const options = ctx.request.body
+  // don't await as can take a while, just return
+  migrationImpl(options)
+  ctx.status = 200
+}
+
+export async function fetchDefinitions(ctx: BBContext) {
+  ctx.body = MIGRATIONS
+  ctx.status = 200
+}

package/src/api/controllers/ops.ts

@@ -0,0 +1,32 @@
+import { Ctx } from "@budibase/types"
+import { logging } from "@budibase/backend-core"
+
+interface LogRequest {
+  message: string
+  data?: any
+}
+
+interface ErrorRequest {
+  message: string
+}
+
+export async function log(ctx: Ctx<LogRequest>) {
+  const body = ctx.request.body
+  console.trace(body.message, body.data)
+  console.debug(body.message, body.data)
+  console.info(body.message, body.data)
+  console.warn(body.message, body.data)
+  console.error(body.message, body.data)
+  ctx.status = 204
+}
+
+export async function alert(ctx: Ctx<ErrorRequest>) {
+  const body = ctx.request.body
+  logging.logAlert(body.message, new Error(body.message))
+  ctx.status = 204
+}
+
+export async function error(ctx: Ctx<ErrorRequest>) {
+  const body = ctx.request.body
+  throw new Error(body.message)
+}

package/src/api/controllers/permission.ts

@@ -0,0 +1,178 @@
+import { permissions, roles, context } from "@budibase/backend-core"
+import { getRoleParams } from "../../db/utils"
+import {
+  CURRENTLY_SUPPORTED_LEVELS,
+  getBasePermissions,
+} from "../../utilities/security"
+import { removeFromArray } from "../../utilities"
+import { BBContext, Database, Role } from "@budibase/types"
+
+const PermissionUpdateType = {
+  REMOVE: "remove",
+  ADD: "add",
+}
+
+const SUPPORTED_LEVELS = CURRENTLY_SUPPORTED_LEVELS
+
+// utility function to stop this repetition - permissions always stored under roles
+async function getAllDBRoles(db: Database) {
+  const body = await db.allDocs(
+    getRoleParams(null, {
+      include_docs: true,
+    })
+  )
+  return body.rows.map(row => row.doc)
+}
+
+async function updatePermissionOnRole(
+  appId: string,
+  {
+    roleId,
+    resourceId,
+    level,
+  }: { roleId: string; resourceId: string; level: string },
+  updateType: string
+) {
+  const db = context.getAppDB()
+  const remove = updateType === PermissionUpdateType.REMOVE
+  const isABuiltin = roles.isBuiltin(roleId)
+  const dbRoleId = roles.getDBRoleID(roleId)
+  const dbRoles = await getAllDBRoles(db)
+  const docUpdates = []
+
+  // the permission is for a built in, make sure it exists
+  if (isABuiltin && !dbRoles.some(role => role._id === dbRoleId)) {
+    const builtin = roles.getBuiltinRoles()[roleId]
+    builtin._id = roles.getDBRoleID(builtin._id)
+    dbRoles.push(builtin)
+  }
+
+  // now try to find any roles which need updated, e.g. removing the
+  // resource from another role and then adding to the new role
+  for (let role of dbRoles) {
+    let updated = false
+    const rolePermissions = role.permissions ? role.permissions : {}
+    // make sure its an array, also handle migrating
+    if (
+      !rolePermissions[resourceId] ||
+      !Array.isArray(rolePermissions[resourceId])
+    ) {
+      rolePermissions[resourceId] =
+        typeof rolePermissions[resourceId] === "string"
+          ? [rolePermissions[resourceId]]
+          : []
+    }
+    // handle the removal/updating the role which has this permission first
+    // the updating (role._id !== dbRoleId) is required because a resource/level can
+    // only be permitted in a single role (this reduces hierarchy confusion and simplifies
+    // the general UI for this, rather than needing to show everywhere it is used)
+    if (
+      (role._id !== dbRoleId || remove) &&
+      rolePermissions[resourceId].indexOf(level) !== -1
+    ) {
+      removeFromArray(rolePermissions[resourceId], level)
+      updated = true
+    }
+    // handle the adding, we're on the correct role, at it to this
+    if (!remove && role._id === dbRoleId) {
+      const set = new Set(rolePermissions[resourceId])
+      rolePermissions[resourceId] = [...set.add(level)]
+      updated = true
+    }
+    // handle the update, add it to bulk docs to perform at end
+    if (updated) {
+      role.permissions = rolePermissions
+      docUpdates.push(role)
+    }
+  }
+
+  const response = await db.bulkDocs(docUpdates)
+  return response.map((resp: any) => {
+    resp._id = roles.getExternalRoleID(resp.id)
+    delete resp.id
+    return resp
+  })
+}
+
+export function fetchBuiltin(ctx: BBContext) {
+  ctx.body = Object.values(permissions.getBuiltinPermissions())
+}
+
+export function fetchLevels(ctx: BBContext) {
+  // for now only provide the read/write perms externally
+  ctx.body = SUPPORTED_LEVELS
+}
+
+export async function fetch(ctx: BBContext) {
+  const db = context.getAppDB()
+  const dbRoles: Role[] = await getAllDBRoles(db)
+  let permissions: any = {}
+  // create an object with structure role ID -> resource ID -> level
+  for (let role of dbRoles) {
+    if (!role.permissions) {
+      continue
+    }
+    const roleId = roles.getExternalRoleID(role._id)
+    if (!roleId) {
+      ctx.throw(400, "Unable to retrieve role")
+    }
+    for (let [resource, levelArr] of Object.entries(role.permissions)) {
+      const levels: string[] = Array.isArray(levelArr) ? levelArr : [levelArr]
+      const perms: Record<string, string> = {}
+      levels.forEach(level => (perms[level] = roleId!))
+      permissions[resource] = perms
+    }
+  }
+  // apply the base permissions
+  const finalPermissions: Record<string, Record<string, string>> = {}
+  for (let [resource, permission] of Object.entries(permissions)) {
+    const basePerms = getBasePermissions(resource)
+    finalPermissions[resource] = Object.assign(basePerms, permission)
+  }
+  ctx.body = finalPermissions
+}
+
+export async function getResourcePerms(ctx: BBContext) {
+  const resourceId = ctx.params.resourceId
+  const db = context.getAppDB()
+  const body = await db.allDocs(
+    getRoleParams(null, {
+      include_docs: true,
+    })
+  )
+  const rolesList = body.rows.map(row => row.doc)
+  let permissions: Record<string, string> = {}
+  for (let level of SUPPORTED_LEVELS) {
+    // update the various roleIds in the resource permissions
+    for (let role of rolesList) {
+      const rolePerms = roles.checkForRoleResourceArray(
+        role.permissions,
+        resourceId
+      )
+      if (
+        rolePerms &&
+        rolePerms[resourceId] &&
+        rolePerms[resourceId].indexOf(level) !== -1
+      ) {
+        permissions[level] = roles.getExternalRoleID(role._id)!
+      }
+    }
+  }
+  ctx.body = Object.assign(getBasePermissions(resourceId), permissions)
+}
+
+export async function addPermission(ctx: BBContext) {
+  ctx.body = await updatePermissionOnRole(
+    ctx.appId,
+    ctx.params,
+    PermissionUpdateType.ADD
+  )
+}
+
+export async function removePermission(ctx: BBContext) {
+  ctx.body = await updatePermissionOnRole(
+    ctx.appId,
+    ctx.params,
+    PermissionUpdateType.REMOVE
+  )
+}

package/src/api/controllers/plugin/file.ts

@@ -0,0 +1,15 @@
+import {
+  createTempFolder,
+  getPluginMetadata,
+  extractTarball,
+} from "../../../utilities/fileSystem"
+
+export async function fileUpload(file: { name: string; path: string }) {
+  if (!file.name.endsWith(".tar.gz")) {
+    throw new Error("Plugin must be compressed into a gzipped tarball.")
+  }
+  const path = createTempFolder(file.name.split(".tar.gz")[0])
+  await extractTarball(file.path, path)
+
+  return await getPluginMetadata(path)
+}

package/src/api/controllers/plugin/github.ts

@@ -0,0 +1,75 @@
+import { getPluginMetadata } from "../../../utilities/fileSystem"
+import fetch from "node-fetch"
+import { downloadUnzipTarball } from "./utils"
+
+export async function request(
+  url: string,
+  headers: { [key: string]: string },
+  err: string
+) {
+  const response = await fetch(url, { headers })
+  if (response.status >= 300) {
+    const respErr = await response.text()
+    throw new Error(`Error: ${err} - ${respErr}`)
+  }
+  return response.json()
+}
+
+export async function githubUpload(url: string, name = "", token = "") {
+  let githubUrl = url
+
+  if (!githubUrl.includes("https://github.com/")) {
+    throw new Error("The plugin origin must be from Github")
+  }
+
+  if (url.includes(".git")) {
+    githubUrl = url.replace(".git", "")
+  }
+
+  const githubApiUrl = githubUrl.replace(
+    "https://github.com/",
+    "https://api.github.com/repos/"
+  )
+  const headers: any = token ? { Authorization: `Bearer ${token}` } : {}
+  const pluginDetails = await request(
+    githubApiUrl,
+    headers,
+    "Repository not found"
+  )
+  const pluginName = pluginDetails.name || name
+  const pluginLatestReleaseUrl = pluginDetails?.["releases_url"]
+    ? pluginDetails?.["releases_url"].replace("{/id}", "/latest")
+    : undefined
+  if (!pluginLatestReleaseUrl) {
+    throw new Error("Github release not found")
+  }
+
+  const pluginReleaseDetails = await request(
+    pluginLatestReleaseUrl,
+    headers,
+    "Github latest release not found"
+  )
+  const pluginReleaseTarballAsset = pluginReleaseDetails?.assets?.find(
+    (x: any) => x?.["content_type"] === "application/gzip"
+  )
+  const pluginLastReleaseTarballUrl =
+    pluginReleaseTarballAsset?.["browser_download_url"]
+  if (!pluginLastReleaseTarballUrl) {
+    throw new Error("Github latest release url not found")
+  }
+
+  try {
+    const path = await downloadUnzipTarball(
+      pluginLastReleaseTarballUrl,
+      pluginName,
+      headers
+    )
+    return await getPluginMetadata(path)
+  } catch (err: any) {
+    let errMsg = err?.message || err
+    if (errMsg === "unexpected response Not Found") {
+      errMsg = "Github release tarball not found"
+    }
+    throw new Error(errMsg)
+  }
+}

package/src/api/controllers/plugin/index.ts

@@ -0,0 +1,101 @@
+import { npmUpload, urlUpload, githubUpload } from "./uploaders"
+import { plugins as pluginCore } from "@budibase/backend-core"
+import { PluginType, FileType, PluginSource } from "@budibase/types"
+import env from "../../../environment"
+import { clientAppSocket } from "../../../websockets"
+import sdk from "../../../sdk"
+import { sdk as pro } from "@budibase/pro"
+
+export async function upload(ctx: any) {
+  const plugins: FileType[] =
+    ctx.request.files.file.length > 1
+      ? Array.from(ctx.request.files.file)
+      : [ctx.request.files.file]
+  try {
+    let docs = []
+    // can do single or multiple plugins
+    for (let plugin of plugins) {
+      const doc = await sdk.plugins.processUploaded(plugin, PluginSource.FILE)
+      docs.push(doc)
+    }
+    ctx.body = {
+      message: "Plugin(s) uploaded successfully",
+      plugins: docs,
+    }
+  } catch (err: any) {
+    const errMsg = err?.message ? err?.message : err
+
+    ctx.throw(400, `Failed to import plugin: ${errMsg}`)
+  }
+}
+
+export async function create(ctx: any) {
+  const { source, url, headers, githubToken } = ctx.request.body
+
+  try {
+    let metadata
+    let directory
+    // Generating random name as a backup and needed for url
+    let name = "PLUGIN_" + Math.floor(100000 + Math.random() * 900000)
+
+    switch (source) {
+      case PluginSource.NPM:
+        const { metadata: metadataNpm, directory: directoryNpm } =
+          await npmUpload(url, name)
+        metadata = metadataNpm
+        directory = directoryNpm
+        break
+      case PluginSource.GITHUB:
+        const { metadata: metadataGithub, directory: directoryGithub } =
+          await githubUpload(url, name, githubToken)
+        metadata = metadataGithub
+        directory = directoryGithub
+        break
+      case PluginSource.URL:
+        const headersObj = headers || {}
+        const { metadata: metadataUrl, directory: directoryUrl } =
+          await urlUpload(url, name, headersObj)
+        metadata = metadataUrl
+        directory = directoryUrl
+        break
+    }
+
+    pluginCore.validate(metadata?.schema)
+
+    // Only allow components in cloud
+    if (!env.SELF_HOSTED && metadata?.schema?.type !== PluginType.COMPONENT) {
+      throw new Error(
+        "Only component plugins are supported outside of self-host"
+      )
+    }
+
+    const doc = await pro.plugins.storePlugin(metadata, directory, source)
+
+    clientAppSocket.emit("plugins-update", { name, hash: doc.hash })
+    ctx.body = {
+      message: "Plugin uploaded successfully",
+      plugins: [doc],
+    }
+    ctx.body = { plugin: doc }
+  } catch (err: any) {
+    const errMsg = err?.message ? err?.message : err
+
+    ctx.throw(400, `Failed to import plugin: ${errMsg}`)
+  }
+}
+
+export async function fetch(ctx: any) {
+  ctx.body = await sdk.plugins.fetch()
+}
+
+export async function destroy(ctx: any) {
+  const { pluginId } = ctx.params
+
+  try {
+    await pro.plugins.deletePlugin(pluginId)
+
+    ctx.body = { message: `Plugin ${ctx.params.pluginId} deleted.` }
+  } catch (err: any) {
+    ctx.throw(400, err.message)
+  }
+}