@budibase/server 0.9.185 → 0.9.189

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/server",
   "email": "hi@budibase.com",
-  "version": "0.9.185",
+  "version": "0.9.189",
   "description": "Budibase Web Server",
   "main": "src/index.js",
   "repository": {
@@ -14,7 +14,7 @@
     "test": "jest --coverage --maxWorkers=2",
     "test:watch": "jest --watch",
     "predocker": "copyfiles -f ../client/dist/budibase-client.js ../client/manifest.json client",
-    "build:docker": "yarn run predocker && docker build . -t app-service",
+    "build:docker": "yarn run predocker && docker build . -t app-service --label version=$BUDIBASE_RELEASE_VERSION",
     "run:docker": "node dist/index.js",
     "dev:stack:up": "node scripts/dev/manage.js up",
     "dev:stack:down": "node scripts/dev/manage.js down",
@@ -66,11 +66,11 @@
     "budibase"
   ],
   "author": "Budibase",
-  "license": "AGPL-3.0-or-later",
+  "license": "GPL-3.0",
   "dependencies": {
-    "@budibase/auth": "^0.9.185",
-    "@budibase/client": "^0.9.185",
-    "@budibase/string-templates": "^0.9.185",
+    "@budibase/auth": "^0.9.189",
+    "@budibase/client": "^0.9.189",
+    "@budibase/string-templates": "^0.9.189",
     "@elastic/elasticsearch": "7.10.0",
     "@koa/router": "8.0.0",
     "@sendgrid/mail": "7.1.1",
@@ -149,5 +149,5 @@
     "typescript": "^4.3.5",
     "update-dotenv": "^1.1.1"
   },
-  "gitHead": "d1714b7f9a70d509453c203774b61d26b079ced5"
+  "gitHead": "c71eab23f0e7c098da073a5765980b4b96f7fa13"
 }

package/src/api/controllers/row/external.js

@@ -55,7 +55,8 @@ exports.save = async ctx => {
 exports.fetchView = async ctx => {
   // there are no views in external data sources, shouldn't ever be called
   // for now just fetch
-  ctx.params.tableId = ctx.params.viewName.split("all_")[1]
+  const split = ctx.params.viewName.split("all_")
+  ctx.params.tableId = split[1] ? split[1] : split[0]
   return exports.fetch(ctx)
 }
 

package/src/api/controllers/view/exporters.js

@@ -16,3 +16,8 @@ exports.csv = function (headers, rows) {
 exports.json = function (headers, rows) {
   return JSON.stringify(rows, undefined, 2)
 }
+
+exports.ExportFormats = {
+  CSV: "csv",
+  JSON: "json",
+}

package/src/api/controllers/view/index.js

@@ -4,6 +4,7 @@ const { apiFileReturn } = require("../../../utilities/fileSystem")
 const exporters = require("./exporters")
 const { saveView, getView, getViews, deleteView } = require("./utils")
 const { fetchView } = require("../row")
+const { getTable } = require("../table/utils")
 
 exports.fetch = async ctx => {
   const db = new CouchDB(ctx.appId)
@@ -56,7 +57,7 @@ exports.exportView = async ctx => {
   const view = await getView(db, viewName)
 
   const format = ctx.query.format
-  if (!format) {
+  if (!format || !Object.values(exporters.ExportFormats).includes(format)) {
     ctx.throw(400, "Format must be specified, either csv or json")
   }
 
@@ -80,10 +81,22 @@ exports.exportView = async ctx => {
   let schema = view && view.meta && view.meta.schema
   if (!schema) {
     const tableId = ctx.params.tableId || view.meta.tableId
-    const table = await db.get(tableId)
+    const table = await getTable(ctx.appId, tableId)
     schema = table.schema
   }
 
+  // make sure no "undefined" entries appear in the CSV
+  if (format === exporters.ExportFormats.CSV) {
+    const schemaKeys = Object.keys(schema)
+    for (let key of schemaKeys) {
+      for (let row of ctx.body) {
+        if (row[key] == null) {
+          row[key] = ""
+        }
+      }
+    }
+  }
+
   // Export part
   let headers = Object.keys(schema)
   const exporter = exporters[format]

package/src/automations/automationUtils.js

@@ -64,5 +64,14 @@ exports.cleanUpRow = async (appId, tableId, row) => {
 }
 
 exports.getError = err => {
+  if (err == null) {
+    return "No error provided."
+  }
+  if (
+    typeof err === "object" &&
+    (err.toString == null || err.toString() === "[object Object]")
+  ) {
+    return JSON.stringify(err)
+  }
   return typeof err !== "string" ? err.toString() : err
 }

package/src/middleware/authorized.js

@@ -1,7 +1,10 @@
-const { getUserPermissions } = require("@budibase/auth/roles")
+const {
+  getUserRoleHierarchy,
+  getRequiredResourceRole,
+  BUILTIN_ROLE_IDS,
+} = require("@budibase/auth/roles")
 const {
   PermissionTypes,
-  doesHaveResourcePermission,
   doesHaveBasePermission,
 } = require("@budibase/auth/permissions")
 const builderMiddleware = require("./builder")
@@ -28,13 +31,7 @@ module.exports =
     await builderMiddleware(ctx, permType)
 
     const isAuthed = ctx.isAuthenticated
-    const { basePermissions, permissions } = await getUserPermissions(
-      ctx.appId,
-      ctx.roleId
-    )
-
     // builders for now have permission to do anything
-    // TODO: in future should consider separating permissions with an require("@budibase/auth").isClient check
     let isBuilder = ctx.user && ctx.user.builder && ctx.user.builder.global
     const isBuilderApi = permType === PermissionTypes.BUILDER
     if (isBuilder) {
@@ -43,20 +40,30 @@ module.exports =
       return ctx.throw(403, "Not Authorized")
     }
 
-    if (
-      hasResource(ctx) &&
-      doesHaveResourcePermission(permissions, permLevel, ctx)
-    ) {
-      return next()
+    // need to check this first, in-case public access, don't check authed until last
+    const roleId = ctx.roleId || BUILTIN_ROLE_IDS.PUBLIC
+    const hierarchy = await getUserRoleHierarchy(ctx.appId, roleId, {
+      idOnly: false,
+    })
+    const permError = "User does not have permission"
+    let possibleRoleIds = []
+    if (hasResource(ctx)) {
+      possibleRoleIds = await getRequiredResourceRole(ctx.appId, permLevel, ctx)
+    }
+    // check if we found a role, if not fallback to base permissions
+    if (possibleRoleIds.length > 0) {
+      const found = hierarchy.find(
+        role => possibleRoleIds.indexOf(role._id) !== -1
+      )
+      return found ? next() : ctx.throw(403, permError)
+    } else if (!doesHaveBasePermission(permType, permLevel, hierarchy)) {
+      ctx.throw(403, permError)
     }
 
+    // if they are not authed, then anything using the authorized middleware will fail
     if (!isAuthed) {
       ctx.throw(403, "Session not authenticated")
     }
 
-    if (!doesHaveBasePermission(permType, permLevel, basePermissions)) {
-      ctx.throw(403, "User does not have permission")
-    }
-
     return next()
   }

package/src/middleware/tests/authorized.spec.js

@@ -10,6 +10,7 @@ jest.mock("../../environment", () => ({
 const authorizedMiddleware = require("../authorized")
 const env = require("../../environment")
 const { PermissionTypes, PermissionLevels } = require("@budibase/auth/permissions")
+require("@budibase/auth").init(require("../../db"))
 
 class TestConfiguration {
   constructor(role) {
@@ -21,6 +22,7 @@ class TestConfiguration {
       request: {
         url: ""
       },
+      appId: "",
       auth: {},
       next: this.next,
       throw: this.throw