@budibase/server 0.9.169-alpha.0 → 0.9.169-alpha.4

package/dist/api/controllers/permission.js

@@ -132,6 +132,7 @@ exports.getResourcePerms = function (ctx) {
             for (let role of roles) {
                 const rolePerms = role.permissions;
                 if (rolePerms &&
+                    rolePerms[resourceId] &&
                     (rolePerms[resourceId] === level ||
                         rolePerms[resourceId].indexOf(level) !== -1)) {
                     permissions[level] = getExternalRoleID(role._id);

package/dist/api/controllers/row/ExternalRequest.js

@@ -22,11 +22,10 @@ var __rest = (this && this.__rest) || function (s, e) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const datasource_1 = require("../../../definitions/datasource");
 const utils_1 = require("../../../integrations/utils");
-const constants_1 = require("../../../constants");
 var External;
 (function (External) {
     const { makeExternalQuery } = require("./utils");
-    const { DataSourceOperation, FieldTypes } = require("../../../constants");
+    const { DataSourceOperation, FieldTypes, RelationshipTypes } = require("../../../constants");
     const { breakExternalTableId, isSQL } = require("../../../integrations/utils");
     const { processObjectSync } = require("@budibase/string-templates");
     const { cloneDeep } = require("lodash/fp");
@@ -67,6 +66,46 @@ var External;
             equal,
         };
     }
+    /**
+     * This function checks the incoming parameters to make sure all the inputs are
+     * valid based on on the table schema. The main thing this is looking for is when a
+     * user has made use of the _id field of a row for a foreign key or a search parameter.
+     * In these cases the key will be sent up as [1], rather than 1. In these cases we will
+     * simplify it down to the requirements. This function is quite complex as we try to be
+     * relatively restrictive over what types of columns we will perform this action for.
+     */
+    function cleanupConfig(config, table) {
+        const primaryOptions = [
+            FieldTypes.STRING,
+            FieldTypes.LONGFORM,
+            FieldTypes.OPTIONS,
+            FieldTypes.NUMBER,
+        ];
+        // filter out fields which cannot be keys
+        const fieldNames = Object.entries(table.schema)
+            .filter(schema => primaryOptions.find(val => val === schema[1].type))
+            .map(([fieldName]) => fieldName);
+        const iterateObject = (obj) => {
+            for (let [field, value] of Object.entries(obj)) {
+                if (fieldNames.find(name => name === field) && utils_1.isRowId(value)) {
+                    obj[field] = utils_1.convertRowId(value);
+                }
+            }
+        };
+        // check the row and filters to make sure they aren't a key of some sort
+        if (config.filters) {
+            for (let filter of Object.values(config.filters)) {
+                if (typeof filter !== "object" || Object.keys(filter).length === 0) {
+                    continue;
+                }
+                iterateObject(filter);
+            }
+        }
+        if (config.row) {
+            iterateObject(config.row);
+        }
+        return config;
+    }
     function generateIdForRow(row, table) {
         const primary = table.primary;
         if (!row || !primary) {
@@ -316,7 +355,7 @@ var External;
                     if (field.type !== FieldTypes.LINK || !field.fieldName) {
                         continue;
                     }
-                    const isMany = field.relationshipType === constants_1.RelationshipTypes.MANY_TO_MANY;
+                    const isMany = field.relationshipType === RelationshipTypes.MANY_TO_MANY;
                     const tableId = isMany ? field.through : field.tableId;
                     const manyKey = field.throughFrom || primaryKey;
                     const fieldName = isMany ? manyKey : field.fieldName;
@@ -430,7 +469,7 @@ var External;
             }
             return fields;
         }
-        run({ id, row, filters, sort, paginate }) {
+        run(config) {
             return __awaiter(this, void 0, void 0, function* () {
                 const { appId, operation, tableId } = this;
                 let { datasourceId, tableName } = breakExternalTableId(tableId);
@@ -447,9 +486,11 @@ var External;
                 if (!table) {
                     throw `Unable to process query, table "${tableName}" not defined.`;
                 }
-                // clean up row on ingress using schema
+                // look for specific components of config which may not be considered acceptable
+                let { id, row, filters, sort, paginate } = cleanupConfig(config, table);
                 filters = buildFilters(id, filters || {}, table);
                 const relationships = this.buildRelationships(table);
+                // clean up row on ingress using schema
                 const processed = this.inputProcessing(row, table);
                 row = processed.row;
                 if (operation === DataSourceOperation.DELETE &&

package/dist/integrations/utils.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.copyExistingPropsOver = exports.isIsoDateString = exports.isSQL = exports.getSqlQuery = exports.convertType = exports.breakRowIdField = exports.generateRowIdField = exports.breakExternalTableId = exports.buildExternalTableId = exports.isExternalTable = void 0;
+exports.copyExistingPropsOver = exports.isIsoDateString = exports.isSQL = exports.getSqlQuery = exports.convertType = exports.breakRowIdField = exports.convertRowId = exports.isRowId = exports.generateRowIdField = exports.breakExternalTableId = exports.buildExternalTableId = exports.isExternalTable = void 0;
 const datasource_1 = require("../definitions/datasource");
 const { DocumentTypes, SEPARATOR } = require("../db/utils");
 const { FieldTypes } = require("../constants");
 const DOUBLE_SEPARATOR = `${SEPARATOR}${SEPARATOR}`;
+const ROW_ID_REGEX = /^\[.*]$/g;
 function isExternalTable(tableId) {
     return tableId.includes(DocumentTypes.DATASOURCE);
 }
@@ -31,6 +32,20 @@ function generateRowIdField(keyProps = []) {
     return encodeURIComponent(JSON.stringify(keyProps).replace(/"/g, "'"));
 }
 exports.generateRowIdField = generateRowIdField;
+function isRowId(field) {
+    return Array.isArray(field) || (typeof field === "string" && field.match(ROW_ID_REGEX) != null);
+}
+exports.isRowId = isRowId;
+function convertRowId(field) {
+    if (Array.isArray(field)) {
+        return field[0];
+    }
+    if (typeof field === "string" && field.match(ROW_ID_REGEX) != null) {
+        return field.substring(1, field.length - 1);
+    }
+    return field;
+}
+exports.convertRowId = convertRowId;
 // should always return an array
 function breakRowIdField(_id) {
     if (!_id) {

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@budibase/server",
     "email": "hi@budibase.com",
-    "version": "0.9.168",
+    "version": "0.9.169-alpha.3",
     "description": "Budibase Web Server",
     "main": "src/index.js",
     "repository": {
@@ -68,9 +68,9 @@
     "author": "Budibase",
     "license": "AGPL-3.0-or-later",
     "dependencies": {
-        "@budibase/auth": "^0.9.168",
-        "@budibase/client": "^0.9.168",
-        "@budibase/string-templates": "^0.9.168",
+        "@budibase/auth": "^0.9.169-alpha.3",
+        "@budibase/client": "^0.9.169-alpha.3",
+        "@budibase/string-templates": "^0.9.169-alpha.3",
         "@elastic/elasticsearch": "7.10.0",
         "@koa/router": "8.0.0",
         "@sendgrid/mail": "7.1.1",