@budibase/server 0.9.185 → 0.9.189

package/dist/api/controllers/view/index.js

@@ -25,6 +25,7 @@ const { apiFileReturn } = require("../../../utilities/fileSystem");
 const exporters = require("./exporters");
 const { saveView, getView, getViews, deleteView } = require("./utils");
 const { fetchView } = require("../row");
+const { getTable } = require("../table/utils");
 exports.fetch = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
     const db = new CouchDB(ctx.appId);
     ctx.body = yield getViews(db);
@@ -65,7 +66,7 @@ exports.exportView = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
     const viewName = decodeURI(ctx.query.view);
     const view = yield getView(db, viewName);
     const format = ctx.query.format;
-    if (!format) {
+    if (!format || !Object.values(exporters.ExportFormats).includes(format)) {
         ctx.throw(400, "Format must be specified, either csv or json");
     }
     if (view) {
@@ -87,9 +88,20 @@ exports.exportView = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
     let schema = view && view.meta && view.meta.schema;
     if (!schema) {
         const tableId = ctx.params.tableId || view.meta.tableId;
-        const table = yield db.get(tableId);
+        const table = yield getTable(ctx.appId, tableId);
         schema = table.schema;
     }
+    // make sure no "undefined" entries appear in the CSV
+    if (format === exporters.ExportFormats.CSV) {
+        const schemaKeys = Object.keys(schema);
+        for (let key of schemaKeys) {
+            for (let row of ctx.body) {
+                if (row[key] == null) {
+                    row[key] = "";
+                }
+            }
+        }
+    }
     // Export part
     let headers = Object.keys(schema);
     const exporter = exporters[format];

package/dist/automations/automationUtils.js

@@ -71,5 +71,12 @@ exports.cleanUpRow = (appId, tableId, row) => __awaiter(void 0, void 0, void 0,
     return exports.cleanInputValues(row, { properties: table.schema });
 });
 exports.getError = err => {
+    if (err == null) {
+        return "No error provided.";
+    }
+    if (typeof err === "object" &&
+        (err.toString == null || err.toString() === "[object Object]")) {
+        return JSON.stringify(err);
+    }
     return typeof err !== "string" ? err.toString() : err;
 };

package/dist/middleware/authorized.js

@@ -8,8 +8,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-const { getUserPermissions } = require("@budibase/auth/roles");
-const { PermissionTypes, doesHaveResourcePermission, doesHaveBasePermission, } = require("@budibase/auth/permissions");
+const { getUserRoleHierarchy, getRequiredResourceRole, BUILTIN_ROLE_IDS, } = require("@budibase/auth/roles");
+const { PermissionTypes, doesHaveBasePermission, } = require("@budibase/auth/permissions");
 const builderMiddleware = require("./builder");
 const { isWebhookEndpoint } = require("./utils");
 function hasResource(ctx) {
@@ -28,9 +28,7 @@ module.exports =
         // to find API endpoints which are builder focused
         yield builderMiddleware(ctx, permType);
         const isAuthed = ctx.isAuthenticated;
-        const { basePermissions, permissions } = yield getUserPermissions(ctx.appId, ctx.roleId);
         // builders for now have permission to do anything
-        // TODO: in future should consider separating permissions with an require("@budibase/auth").isClient check
         let isBuilder = ctx.user && ctx.user.builder && ctx.user.builder.global;
         const isBuilderApi = permType === PermissionTypes.BUILDER;
         if (isBuilder) {
@@ -39,15 +37,27 @@ module.exports =
         else if (isBuilderApi && !isBuilder) {
             return ctx.throw(403, "Not Authorized");
         }
-        if (hasResource(ctx) &&
-            doesHaveResourcePermission(permissions, permLevel, ctx)) {
-            return next();
+        // need to check this first, in-case public access, don't check authed until last
+        const roleId = ctx.roleId || BUILTIN_ROLE_IDS.PUBLIC;
+        const hierarchy = yield getUserRoleHierarchy(ctx.appId, roleId, {
+            idOnly: false,
+        });
+        const permError = "User does not have permission";
+        let possibleRoleIds = [];
+        if (hasResource(ctx)) {
+            possibleRoleIds = yield getRequiredResourceRole(ctx.appId, permLevel, ctx);
+        }
+        // check if we found a role, if not fallback to base permissions
+        if (possibleRoleIds.length > 0) {
+            const found = hierarchy.find(role => possibleRoleIds.indexOf(role._id) !== -1);
+            return found ? next() : ctx.throw(403, permError);
         }
+        else if (!doesHaveBasePermission(permType, permLevel, hierarchy)) {
+            ctx.throw(403, permError);
+        }
+        // if they are not authed, then anything using the authorized middleware will fail
         if (!isAuthed) {
             ctx.throw(403, "Session not authenticated");
         }
-        if (!doesHaveBasePermission(permType, permLevel, basePermissions)) {
-            ctx.throw(403, "User does not have permission");
-        }
         return next();
     });

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@budibase/server",
     "email": "hi@budibase.com",
-    "version": "0.9.184",
+    "version": "0.9.188",
     "description": "Budibase Web Server",
     "main": "src/index.js",
     "repository": {
@@ -14,7 +14,7 @@
         "test": "jest --coverage --maxWorkers=2",
         "test:watch": "jest --watch",
         "predocker": "copyfiles -f ../client/dist/budibase-client.js ../client/manifest.json client",
-        "build:docker": "yarn run predocker && docker build . -t app-service",
+        "build:docker": "yarn run predocker && docker build . -t app-service --label version=$BUDIBASE_RELEASE_VERSION",
         "run:docker": "node dist/index.js",
         "dev:stack:up": "node scripts/dev/manage.js up",
         "dev:stack:down": "node scripts/dev/manage.js down",
@@ -66,11 +66,11 @@
         "budibase"
     ],
     "author": "Budibase",
-    "license": "AGPL-3.0-or-later",
+    "license": "GPL-3.0",
     "dependencies": {
-        "@budibase/auth": "^0.9.184",
-        "@budibase/client": "^0.9.184",
-        "@budibase/string-templates": "^0.9.184",
+        "@budibase/auth": "^0.9.188",
+        "@budibase/client": "^0.9.188",
+        "@budibase/string-templates": "^0.9.188",
         "@elastic/elasticsearch": "7.10.0",
         "@koa/router": "8.0.0",
         "@sendgrid/mail": "7.1.1",