@budibase/server 1.0.219 → 1.0.220-alpha.0

package/dist/utilities/fileSystem/index.js

@@ -17,7 +17,7 @@ const { ObjectStoreBuckets } = require("../../constants");
 const { upload, retrieve, retrieveToTmp, streamUpload, deleteFolder, downloadTarball, } = require("./utilities");
 const { updateClientLibrary } = require("./clientLibrary");
 const env = require("../../environment");
-const { USER_METDATA_PREFIX, LINK_USER_METADATA_PREFIX, } = require("../../db/utils");
+const { USER_METDATA_PREFIX, LINK_USER_METADATA_PREFIX, TABLE_ROW_PREFIX, } = require("../../db/utils");
 const MemoryStream = require("memorystream");
 const { getAppId } = require("@budibase/backend-core/context");
 const TOP_LEVEL_PATH = join(__dirname, "..", "..", "..");
@@ -98,6 +98,17 @@ exports.apiFileReturn = contents => {
     fs.writeFileSync(path, contents);
     return fs.createReadStream(path);
 };
+exports.defineFilter = excludeRows => {
+    if (excludeRows) {
+        return doc => !(doc._id.includes(USER_METDATA_PREFIX) ||
+            doc._id.includes(LINK_USER_METADATA_PREFIX) ||
+            doc._id.includes(TABLE_ROW_PREFIX));
+    }
+    else if (!excludeRows) {
+        return doc => !(doc._id.includes(USER_METDATA_PREFIX) ||
+            doc._id.includes(LINK_USER_METADATA_PREFIX));
+    }
+};
 /**
  * Local utility to back up the database state for an app, excluding global user
  * data or user relationships.
@@ -105,9 +116,8 @@ exports.apiFileReturn = contents => {
  * @param {object} config Config to send to export DB
  * @returns {*} either a string or a stream of the backup
  */
-const backupAppData = (appId, config) => __awaiter(void 0, void 0, void 0, function* () {
-    return yield exports.exportDB(appId, Object.assign(Object.assign({}, config), { filter: doc => !(doc._id.includes(USER_METDATA_PREFIX) ||
-            doc._id.includes(LINK_USER_METADATA_PREFIX)) }));
+const backupAppData = (appId, config, includeRows) => __awaiter(void 0, void 0, void 0, function* () {
+    return yield exports.exportDB(appId, Object.assign(Object.assign({}, config), { filter: exports.defineFilter(includeRows) }));
 });
 /**
  * Takes a copy of the database state for an app to the object store.
@@ -123,8 +133,8 @@ exports.performBackup = (appId, backupName) => __awaiter(void 0, void 0, void 0,
  * @param {string} appId The ID of the app which is to be backed up.
  * @returns {*} a readable stream of the backup which is written in real time
  */
-exports.streamBackup = (appId) => __awaiter(void 0, void 0, void 0, function* () {
-    return yield backupAppData(appId, { stream: true });
+exports.streamBackup = (appId, includeRows) => __awaiter(void 0, void 0, void 0, function* () {
+    return yield backupAppData(appId, { stream: true }, includeRows);
 });
 /**
  * Exports a DB to either file or a variable (memory).

package/dist/utilities/workerRequests.js

@@ -120,3 +120,11 @@ exports.readGlobalUser = (ctx) => __awaiter(void 0, void 0, void 0, function* ()
     request(ctx, { method: "GET" }));
     return checkResponse(response, "get user", { ctx });
 });
+exports.createAdminUser = (email, password, tenantId) => __awaiter(void 0, void 0, void 0, function* () {
+    const response = yield fetch(checkSlashesInUrl(env.WORKER_URL + "/api/global/users/init"), request(null, { method: "POST", body: { email, password, tenantId } }));
+    return checkResponse(response, "create admin user");
+});
+exports.getChecklist = () => __awaiter(void 0, void 0, void 0, function* () {
+    const response = yield fetch(checkSlashesInUrl(env.WORKER_URL + "/api/global/configs/checklist"), request(null, { method: "GET" }));
+    return checkResponse(response, "get checklist");
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/server",
   "email": "hi@budibase.com",
-  "version": "1.0.219",
+  "version": "1.0.220-alpha.0",
   "description": "Budibase Web Server",
   "main": "src/index.ts",
   "repository": {
@@ -77,10 +77,10 @@
   "license": "GPL-3.0",
   "dependencies": {
     "@apidevtools/swagger-parser": "10.0.3",
-    "@budibase/backend-core": "^1.0.219",
-    "@budibase/client": "^1.0.219",
-    "@budibase/pro": "1.0.218",
-    "@budibase/string-templates": "^1.0.219",
+    "@budibase/backend-core": "^1.0.220-alpha.0",
+    "@budibase/client": "^1.0.220-alpha.0",
+    "@budibase/pro": "1.0.219",
+    "@budibase/string-templates": "^1.0.220-alpha.0",
     "@bull-board/api": "3.7.0",
     "@bull-board/koa": "3.9.4",
     "@elastic/elasticsearch": "7.10.0",
@@ -135,6 +135,7 @@
     "pouchdb-replication-stream": "1.2.9",
     "redis": "4",
     "server-destroy": "1.0.1",
+    "snowflake-promise": "^4.5.0",
     "svelte": "3.44.1",
     "swagger-parser": "10.0.3",
     "to-json-schema": "0.2.5",
@@ -150,7 +151,7 @@
     "@babel/core": "7.17.4",
     "@babel/preset-env": "7.16.11",
     "@budibase/standard-components": "^0.9.139",
-    "@budibase/types": "^1.0.219",
+    "@budibase/types": "^1.0.220-alpha.0",
     "@jest/test-sequencer": "24.9.0",
     "@types/apidoc": "0.50.0",
     "@types/bson": "4.2.0",
@@ -194,5 +195,5 @@
   "optionalDependencies": {
     "oracledb": "5.3.0"
   },
-  "gitHead": "231b038a3c99f730dd27a595f870663dd84b7837"
+  "gitHead": "00cefe45cc19f1151ad2a4590d6a5aed0afa0ea7"
 }

package/scripts/dev/manage.js

@@ -56,6 +56,8 @@ async function init() {
       DISABLE_THREADING: 1,
       SERVICE: "app-service",
       DEPLOYMENT_ENVIRONMENT: "development",
+      BB_ADMIN_USER_EMAIL: "",
+      BB_ADMIN_USER_PASSWORD: "",
     }
     let envFile = ""
     Object.keys(envFileJson).forEach(key => {

package/scripts/integrations/oracle/instantclient/linux/arm64/install.sh

@@ -0,0 +1,23 @@
+#!/bin/bash 
+
+# Must be root to continue
+if [[ $(id -u) -ne 0 ]] ; then echo "Please run as root" ; exit 1 ; fi
+
+# Allow for re-runs
+rm -rf /opt/oracle
+
+echo "Installing oracle instant client"
+
+# copy and unzip package
+mkdir -p /opt/oracle
+cp scripts/integrations/oracle/instantclient/linux/arm64/basiclite-19.10.zip /opt/oracle
+cd /opt/oracle
+unzip -qq basiclite-19.10.zip -d .
+rm *.zip
+mv instantclient* instantclient
+
+# update runtime link path
+sh -c "echo /opt/oracle/instantclient > /etc/ld.so.conf.d/oracle-instantclient.conf"
+ldconfig /etc/ld.so.conf.d
+
+echo "Installation complete"

package/scripts/integrations/oracle/instantclient/linux/install.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]:-$0}"; )" &> /dev/null && pwd 2> /dev/null; )"
+if [[ $TARGETARCH == arm* ]] ;
+then
+  echo "Installing ARM Oracle instant client..."
+  $SCRIPT_DIR/arm64/install.sh
+else
+  echo "Installing x86-64 Oracle instant client..."
+  $SCRIPT_DIR/x86-64/install.sh
+fi

package/specs/openapi.json

@@ -2137,6 +2137,10 @@
                   "query": {
                     "type": "object",
                     "properties": {
+                      "allOr": {
+                        "type": "boolean",
+                        "description": "Specifies that a row should be returned if it satisfies any of the specified options, rather than requiring it to fulfill all the search parameters. This defaults to false, meaning AND logic will be used."
+                      },
                       "string": {
                         "type": "object",
                         "example": {
@@ -2155,12 +2159,12 @@
                       },
                       "range": {
                         "type": "object",
-                        "description": "Searches within a range, the format of this must be columnName -> [low, high].",
+                        "description": "Searches within a range, the format of this must be in the format of an object with a \"low\" and \"high\" property.",
                         "example": {
-                          "columnName1": [
-                            10,
-                            20
-                          ]
+                          "columnName1": {
+                            "low": 10,
+                            "high": 20
+                          }
                         }
                       },
                       "equal": {

package/specs/openapi.yaml

@@ -1551,6 +1551,12 @@ paths:
                 query:
                   type: object
                   properties:
+                    allOr:
+                      type: boolean
+                      description: Specifies that a row should be returned if it satisfies any of the
+                        specified options, rather than requiring it to fulfill
+                        all the search parameters. This defaults to false,
+                        meaning AND logic will be used.
                     string:
                       type: object
                       example:
@@ -1566,12 +1572,12 @@ paths:
                       description: A fuzzy search, only supported by internal tables.
                     range:
                       type: object
-                      description: Searches within a range, the format of this must be columnName ->
-                        [low, high].
+                      description: Searches within a range, the format of this must be in the format
+                        of an object with a "low" and "high" property.
                       example:
                         columnName1:
-                          - 10
-                          - 20
+                          low: 10
+                          high: 20
                     equal:
                       type: object
                       description: Searches for rows that have a column value that is exactly the

package/src/api/controllers/application.ts

@@ -45,10 +45,12 @@ const { getTenantId, isMultiTenant } = require("@budibase/backend-core/tenancy")
 import { syncGlobalUsers } from "./user"
 const { app: appCache } = require("@budibase/backend-core/cache")
 import { cleanupAutomations } from "../../automations/utils"
+import { checkAppMetadata } from "../../automations/logging"
 const {
   getAppDB,
   getProdAppDB,
   updateAppId,
+  doInAppContext,
 } = require("@budibase/backend-core/context")
 import { getUniqueRows } from "../../utilities/usageQuota/rows"
 import { quotas } from "@budibase/pro"
@@ -192,7 +194,7 @@ export const fetch = async (ctx: any) => {
     }
   }
 
-  ctx.body = apps
+  ctx.body = await checkAppMetadata(apps)
 }
 
 export const fetchAppDefinition = async (ctx: any) => {
@@ -548,22 +550,24 @@ export const sync = async (ctx: any, next: any) => {
 }
 
 const updateAppPackage = async (appPackage: any, appId: any) => {
-  const db = getAppDB()
-  const application = await db.get(DocumentTypes.APP_METADATA)
+  return doInAppContext(appId, async () => {
+    const db = getAppDB()
+    const application = await db.get(DocumentTypes.APP_METADATA)
 
-  const newAppPackage = { ...application, ...appPackage }
-  if (appPackage._rev !== application._rev) {
-    newAppPackage._rev = application._rev
-  }
+    const newAppPackage = { ...application, ...appPackage }
+    if (appPackage._rev !== application._rev) {
+      newAppPackage._rev = application._rev
+    }
 
-  // the locked by property is attached by server but generated from
-  // Redis, shouldn't ever store it
-  delete newAppPackage.lockedBy
+    // the locked by property is attached by server but generated from
+    // Redis, shouldn't ever store it
+    delete newAppPackage.lockedBy
 
-  await db.put(newAppPackage)
-  // remove any cached metadata, so that it will be updated
-  await appCache.invalidateAppMetadata(appId)
-  return newAppPackage
+    await db.put(newAppPackage)
+    // remove any cached metadata, so that it will be updated
+    await appCache.invalidateAppMetadata(appId)
+    return newAppPackage
+  })
 }
 
 const createEmptyAppPackage = async (ctx: any, app: any) => {

package/src/api/controllers/automation.js

@@ -1,6 +1,10 @@
 const actions = require("../../automations/actions")
 const triggers = require("../../automations/triggers")
-const { getAutomationParams, generateAutomationID } = require("../../db/utils")
+const {
+  getAutomationParams,
+  generateAutomationID,
+  DocumentTypes,
+} = require("../../db/utils")
 const {
   checkForWebhooks,
   updateTestHistory,
@@ -9,8 +13,14 @@ const {
 const { deleteEntityMetadata } = require("../../utilities")
 const { MetadataTypes } = require("../../constants")
 const { setTestFlag, clearTestFlag } = require("../../utilities/redis")
-const { getAppDB } = require("@budibase/backend-core/context")
+const {
+  getAppDB,
+  getProdAppDB,
+  doInAppContext,
+} = require("@budibase/backend-core/context")
 const { events } = require("@budibase/backend-core")
+const { app } = require("@budibase/backend-core/cache")
+const { automations } = require("@budibase/pro")
 
 const ACTION_DEFS = removeDeprecated(actions.ACTION_DEFINITIONS)
 const TRIGGER_DEFS = removeDeprecated(triggers.TRIGGER_DEFINITIONS)
@@ -183,6 +193,29 @@ exports.destroy = async function (ctx) {
   await events.automation.deleted(oldAutomation)
 }
 
+exports.logSearch = async function (ctx) {
+  ctx.body = await automations.logs.logSearch(ctx.request.body)
+}
+
+exports.clearLogError = async function (ctx) {
+  const { automationId, appId } = ctx.request.body
+  await doInAppContext(appId, async () => {
+    const db = getProdAppDB()
+    const metadata = await db.get(DocumentTypes.APP_METADATA)
+    if (!automationId) {
+      delete metadata.automationErrors
+    } else if (
+      metadata.automationErrors &&
+      metadata.automationErrors[automationId]
+    ) {
+      delete metadata.automationErrors[automationId]
+    }
+    await db.put(metadata)
+    await app.invalidateAppMetadata(metadata.appId, metadata)
+    ctx.body = { message: `Error logs cleared.` }
+  })
+}
+
 exports.getActionList = async function (ctx) {
   ctx.body = ACTION_DEFS
 }

package/src/api/controllers/backup.js

@@ -3,11 +3,12 @@ const { events, context } = require("@budibase/backend-core")
 const { DocumentTypes } = require("../../db/utils")
 
 exports.exportAppDump = async function (ctx) {
-  const { appId } = ctx.query
+  let { appId, excludeRows } = ctx.query
   const appName = decodeURI(ctx.query.appname)
+  excludeRows = excludeRows === "true"
   const backupIdentifier = `${appName}-export-${new Date().getTime()}.txt`
   ctx.attachment(backupIdentifier)
-  ctx.body = await streamBackup(appId)
+  ctx.body = await streamBackup(appId, excludeRows)
 
   await context.doInAppContext(appId, async () => {
     const appDb = context.getAppDB()

package/src/api/controllers/public/applications.ts

@@ -1,6 +1,6 @@
 const { getAllApps } = require("@budibase/backend-core/db")
 const { updateAppId } = require("@budibase/backend-core/context")
-import { search as stringSearch } from "./utils"
+import { search as stringSearch, addRev } from "./utils"
 import * as controller from "../application"
 import { Application } from "../../../definitions/common"
 
@@ -47,7 +47,7 @@ export async function read(ctx: any, next: any) {
 }
 
 export async function update(ctx: any, next: any) {
-  ctx.request.body = fixAppID(ctx.request.body, ctx.params)
+  ctx.request.body = await addRev(fixAppID(ctx.request.body, ctx.params))
   updateAppId(ctx.params.appId)
   await controller.update(ctx)
   await setResponseApp(ctx)

package/src/api/controllers/public/utils.ts

@@ -1,5 +1,6 @@
 const { getAppDB } = require("@budibase/backend-core/context")
 import { isExternalTable } from "../../../integrations/utils"
+import { APP_PREFIX, DocumentTypes } from "../../../db/utils"
 
 export async function addRev(
   body: { _id?: string; _rev?: string },
@@ -8,9 +9,15 @@ export async function addRev(
   if (!body._id || (tableId && isExternalTable(tableId))) {
     return body
   }
+  let id = body._id
+  if (body._id.startsWith(APP_PREFIX)) {
+    id = DocumentTypes.APP_METADATA
+  }
   const db = getAppDB()
-  const dbDoc = await db.get(body._id)
+  const dbDoc = await db.get(id)
   body._rev = dbDoc._rev
+  // update ID in case it is an app ID
+  body._id = id
   return body
 }
 

package/src/api/controllers/query/index.ts

@@ -8,6 +8,8 @@ import { QUERY_THREAD_TIMEOUT } from "../../../environment"
 import { getAppDB } from "@budibase/backend-core/context"
 import { quotas } from "@budibase/pro"
 import { events } from "@budibase/backend-core"
+import { getCookie } from "@budibase/backend-core/utils"
+import { Cookies, Configs } from "@budibase/backend-core/constants"
 
 const Runner = new Thread(ThreadType.QUERY, {
   timeoutMs: QUERY_THREAD_TIMEOUT || 10000,
@@ -110,6 +112,21 @@ export async function find(ctx: any) {
   ctx.body = query
 }
 
+//Required to discern between OIDC OAuth config entries
+function getOAuthConfigCookieId(ctx: any) {
+  if (ctx.user.providerType === Configs.OIDC) {
+    return getCookie(ctx, Cookies.OIDC_CONFIG)
+  }
+}
+
+function getAuthConfig(ctx: any) {
+  const authCookie = getCookie(ctx, Cookies.Auth)
+  let authConfigCtx: any = {}
+  authConfigCtx["configId"] = getOAuthConfigCookieId(ctx)
+  authConfigCtx["sessionId"] = authCookie ? authCookie.sessionId : null
+  return authConfigCtx
+}
+
 export async function preview(ctx: any) {
   const db = getAppDB()
 
@@ -119,6 +136,8 @@ export async function preview(ctx: any) {
   // this stops dynamic variables from calling the same query
   const { fields, parameters, queryVerb, transformer, queryId } = query
 
+  const authConfigCtx: any = getAuthConfig(ctx)
+
   try {
     const runFn = () =>
       Runner.run({
@@ -129,8 +148,11 @@ export async function preview(ctx: any) {
         parameters,
         transformer,
         queryId,
+        ctx: {
+          user: ctx.user,
+          auth: { ...authConfigCtx },
+        },
       })
-
     const { rows, keys, info, extra } = await quotas.addQuery(runFn)
     await events.query.previewed(datasource, query)
     ctx.body = {
@@ -144,12 +166,19 @@ export async function preview(ctx: any) {
   }
 }
 
-async function execute(ctx: any, opts = { rowsOnly: false }) {
+async function execute(
+  ctx: any,
+  opts: any = { rowsOnly: false, isAutomation: false }
+) {
   const db = getAppDB()
 
   const query = await db.get(ctx.params.queryId)
   const datasource = await db.get(query.datasourceId)
 
+  let authConfigCtx: any = {}
+  if (!opts.isAutomation) {
+    authConfigCtx = getAuthConfig(ctx)
+  }
   const enrichedParameters = ctx.request.body.parameters || {}
   // make sure parameters are fully enriched with defaults
   if (query && query.parameters) {
@@ -172,6 +201,10 @@ async function execute(ctx: any, opts = { rowsOnly: false }) {
         parameters: enrichedParameters,
         transformer: query.transformer,
         queryId: ctx.params.queryId,
+        ctx: {
+          user: ctx.user,
+          auth: { ...authConfigCtx },
+        },
       })
 
     const { rows, pagination, extra } = await quotas.addQuery(runFn)
@@ -189,8 +222,11 @@ export async function executeV1(ctx: any) {
   return execute(ctx, { rowsOnly: true })
 }
 
-export async function executeV2(ctx: any) {
-  return execute(ctx, { rowsOnly: false })
+export async function executeV2(
+  ctx: any,
+  { isAutomation }: { isAutomation?: boolean } = {}
+) {
+  return execute(ctx, { rowsOnly: false, isAutomation })
 }
 
 const removeDynamicVariables = async (queryId: any) => {

package/src/api/controllers/row/external.js

@@ -155,34 +155,44 @@ exports.validate = async () => {
 }
 
 exports.exportRows = async ctx => {
-  const { datasourceId, tableName } = breakExternalTableId(ctx.params.tableId)
+  const { datasourceId } = breakExternalTableId(ctx.params.tableId)
   const db = getAppDB()
-  let format = ctx.query.format
+  const format = ctx.query.format
+  const { columns } = ctx.request.body
   const datasource = await db.get(datasourceId)
   if (!datasource || !datasource.entities) {
     ctx.throw(400, "Datasource has not been configured for plus API.")
   }
-  const tables = datasource.entities
-  const table = tables[tableName]
   ctx.request.body = {
     query: {
       oneOf: {
-        [table.primaryDisplay]: ctx.request.body.rows.map(
-          id => breakRowIdField(id)[0]
-        ),
+        _id: ctx.request.body.rows.map(row => JSON.parse(decodeURI(row))[0]),
       },
     },
   }
 
   let result = await exports.search(ctx)
+  let rows = []
+
+  // Filter data to only specified columns if required
+  if (columns && columns.length) {
+    for (let i = 0; i < result.rows.length; i++) {
+      rows[i] = {}
+      for (let column of columns) {
+        rows[i][column] = result.rows[i][column]
+      }
+    }
+  } else {
+    rows = result.rows
+  }
 
-  let headers = Object.keys(result.rows[0])
+  let headers = Object.keys(rows[0])
   const exporter = exporters[format]
   const filename = `export.${format}`
 
   // send down the file
   ctx.attachment(filename)
-  return apiFileReturn(exporter(headers, result.rows))
+  return apiFileReturn(exporter(headers, rows))
 }
 
 exports.fetchEnrichedRow = async ctx => {

package/src/api/controllers/row/internalSearch.js

@@ -10,6 +10,7 @@ const { getAppId } = require("@budibase/backend-core/context")
 class QueryBuilder {
   constructor(base) {
     this.query = {
+      allOr: false,
       string: {},
       fuzzy: {},
       range: {},
@@ -17,6 +18,7 @@ class QueryBuilder {
       notEqual: {},
       empty: {},
       notEmpty: {},
+      oneOf: {},
       ...base,
     }
     this.limit = 50
@@ -112,6 +114,11 @@ class QueryBuilder {
     return this
   }
 
+  addOneOf(key, value) {
+    this.query.oneOf[key] = value
+    return this
+  }
+
   /**
    * Preprocesses a value before going into a lucene search.
    * Transforms strings to lowercase and wraps strings and bools in quotes.
@@ -140,8 +147,22 @@ class QueryBuilder {
 
   buildSearchQuery() {
     const builder = this
-    let query = "*:*"
+    let allOr = this.query && this.query.allOr
+    let query = allOr ? "" : "*:*"
     const allPreProcessingOpts = { escape: true, lowercase: true, wrap: true }
+    let tableId
+    if (this.query.equal.tableId) {
+      tableId = this.query.equal.tableId
+      delete this.query.equal.tableId
+    }
+
+    const equal = (key, value) => {
+      // 0 evaluates to false, which means we would return all rows if we don't check it
+      if (!value && value !== 0) {
+        return null
+      }
+      return `${key}:${builder.preprocess(value, allPreProcessingOpts)}`
+    }
 
     function build(structure, queryFn) {
       for (let [key, value] of Object.entries(structure)) {
@@ -152,7 +173,10 @@ class QueryBuilder {
         if (expression == null) {
           continue
         }
-        query += ` AND ${expression}`
+        if (query.length > 0) {
+          query += ` ${allOr ? "OR" : "AND"} `
+        }
+        query += expression
       }
     }
 
@@ -198,13 +222,7 @@ class QueryBuilder {
       })
     }
     if (this.query.equal) {
-      build(this.query.equal, (key, value) => {
-        // 0 evaluates to false, which means we would return all rows if we don't check it
-        if (!value && value !== 0) {
-          return null
-        }
-        return `${key}:${builder.preprocess(value, allPreProcessingOpts)}`
-      })
+      build(this.query.equal, equal)
     }
     if (this.query.notEqual) {
       build(this.query.notEqual, (key, value) => {
@@ -220,6 +238,34 @@ class QueryBuilder {
     if (this.query.notEmpty) {
       build(this.query.notEmpty, key => `${key}:["" TO *]`)
     }
+    if (this.query.oneOf) {
+      build(this.query.oneOf, (key, value) => {
+        if (!Array.isArray(value)) {
+          if (typeof value === "string") {
+            value = value.split(",")
+          } else {
+            return ""
+          }
+        }
+        let orStatement = `${builder.preprocess(
+          value[0],
+          allPreProcessingOpts
+        )}`
+        for (let i = 1; i < value.length; i++) {
+          orStatement += ` OR ${builder.preprocess(
+            value[i],
+            allPreProcessingOpts
+          )}`
+        }
+        return `${key}:(${orStatement})`
+      })
+    }
+    // make sure table ID is always added as an AND
+    if (tableId) {
+      query = `(${query})`
+      allOr = false
+      build({ tableId }, equal)
+    }
     return query
   }
 

package/src/api/controllers/row/utils.js

@@ -64,6 +64,9 @@ exports.validate = async ({ tableId, row, table }) => {
     // Validate.js doesn't seem to handle array
     if (type === FieldTypes.ARRAY && row[fieldName]) {
       if (row[fieldName].length) {
+        if (!Array.isArray(row[fieldName])) {
+          row[fieldName] = row[fieldName].split(",")
+        }
         row[fieldName].map(val => {
           if (
             !constraints.inclusion.includes(val) &&