@budibase/server 1.0.46-alpha.4 → 1.0.46-alpha.8

package/dist/integrations/index.js

@@ -10,6 +10,7 @@ const airtable = require("./airtable");
 const mysql = require("./mysql");
 const arangodb = require("./arangodb");
 const rest = require("./rest");
+const googlesheets = require("./googlesheets");
 const { SourceNames } = require("../definitions/datasource");
 const DEFINITIONS = {
     [SourceNames.POSTGRES]: postgres.schema,
@@ -23,6 +24,7 @@ const DEFINITIONS = {
     [SourceNames.MYSQL]: mysql.schema,
     [SourceNames.ARANGODB]: arangodb.schema,
     [SourceNames.REST]: rest.schema,
+    [SourceNames.GOOGLE_SHEETS]: googlesheets.schema,
 };
 const INTEGRATIONS = {
     [SourceNames.POSTGRES]: postgres.integration,
@@ -36,6 +38,7 @@ const INTEGRATIONS = {
     [SourceNames.MYSQL]: mysql.integration,
     [SourceNames.ARANGODB]: arangodb.integration,
     [SourceNames.REST]: rest.integration,
+    [SourceNames.GOOGLE_SHEETS]: googlesheets.integration,
 };
 // optionally add oracle integration if the oracle binary can be installed
 if (!(process.arch === "arm64" && process.platform === "darwin")) {

package/dist/integrations/utils.js

@@ -153,7 +153,9 @@ exports.isIsoDateString = isIsoDateString;
  * @param tableIds The IDs of the tables which currently exist.
  */
 function shouldCopyRelationship(column, tableIds) {
-    return column.type === constants_1.FieldTypes.LINK && column.tableId && tableIds.includes(column.tableId);
+    return (column.type === constants_1.FieldTypes.LINK &&
+        column.tableId &&
+        tableIds.includes(column.tableId));
 }
 /**
  * Similar function to the shouldCopyRelationship function, but instead this looks for options and boolean
@@ -164,8 +166,9 @@ function shouldCopyRelationship(column, tableIds) {
  * @param fetchedColumn The fetched column to check for the type in the external database.
  */
 function shouldCopySpecialColumn(column, fetchedColumn) {
-    return column.type === constants_1.FieldTypes.OPTIONS ||
-        ((!fetchedColumn || fetchedColumn.type === constants_1.FieldTypes.NUMBER) && column.type === constants_1.FieldTypes.BOOLEAN);
+    return (column.type === constants_1.FieldTypes.OPTIONS ||
+        ((!fetchedColumn || fetchedColumn.type === constants_1.FieldTypes.NUMBER) &&
+            column.type === constants_1.FieldTypes.BOOLEAN));
 }
 /**
  * Looks for columns which need to be copied over into the new table definitions, like relationships

package/dist/middleware/authorized.js

@@ -12,9 +12,49 @@ const { getUserRoleHierarchy, getRequiredResourceRole, BUILTIN_ROLE_IDS, } = req
 const { PermissionTypes, doesHaveBasePermission, } = require("@budibase/backend-core/permissions");
 const builderMiddleware = require("./builder");
 const { isWebhookEndpoint } = require("./utils");
+const { buildCsrfMiddleware } = require("@budibase/backend-core/auth");
 function hasResource(ctx) {
     return ctx.resourceId != null;
 }
+const csrf = buildCsrfMiddleware();
+/**
+ * Apply authorization to the requested resource:
+ * - If this is a builder resource the user must be a builder.
+ * - Builders can access all resources.
+ * - Otherwise the user must have the required role.
+ */
+const checkAuthorized = (ctx, resourceRoles, permType, permLevel) => __awaiter(void 0, void 0, void 0, function* () {
+    // check if this is a builder api and the user is not a builder
+    const isBuilder = ctx.user && ctx.user.builder && ctx.user.builder.global;
+    const isBuilderApi = permType === PermissionTypes.BUILDER;
+    if (isBuilderApi && !isBuilder) {
+        return ctx.throw(403, "Not Authorized");
+    }
+    // check for resource authorization
+    if (!isBuilder) {
+        yield checkAuthorizedResource(ctx, resourceRoles, permType, permLevel);
+    }
+});
+const checkAuthorizedResource = (ctx, resourceRoles, permType, permLevel) => __awaiter(void 0, void 0, void 0, function* () {
+    // get the user's roles
+    const roleId = ctx.roleId || BUILTIN_ROLE_IDS.PUBLIC;
+    const userRoles = yield getUserRoleHierarchy(ctx.appId, roleId, {
+        idOnly: false,
+    });
+    const permError = "User does not have permission";
+    // check if the user has the required role
+    if (resourceRoles.length > 0) {
+        // deny access if the user doesn't have the required resource role
+        const found = userRoles.find(role => resourceRoles.indexOf(role._id) !== -1);
+        if (!found) {
+            ctx.throw(403, permError);
+        }
+        // fallback to the base permissions when no resource roles are found
+    }
+    else if (!doesHaveBasePermission(permType, permLevel, userRoles)) {
+        ctx.throw(403, permError);
+    }
+});
 module.exports =
     (permType, permLevel = null) => (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
         // webhooks don't need authentication, each webhook unique
@@ -28,37 +68,22 @@ module.exports =
         // check general builder stuff, this middleware is a good way
         // to find API endpoints which are builder focused
         yield builderMiddleware(ctx, permType);
-        const isAuthed = ctx.isAuthenticated;
-        // builders for now have permission to do anything
-        let isBuilder = ctx.user && ctx.user.builder && ctx.user.builder.global;
-        const isBuilderApi = permType === PermissionTypes.BUILDER;
-        if (isBuilder) {
-            return next();
-        }
-        else if (isBuilderApi && !isBuilder) {
-            return ctx.throw(403, "Not Authorized");
+        // get the resource roles
+        let resourceRoles = [];
+        if (ctx.appId && hasResource(ctx)) {
+            resourceRoles = yield getRequiredResourceRole(ctx.appId, permLevel, ctx);
         }
-        // need to check this first, in-case public access, don't check authed until last
-        const roleId = ctx.roleId || BUILTIN_ROLE_IDS.PUBLIC;
-        const hierarchy = yield getUserRoleHierarchy(ctx.appId, roleId, {
-            idOnly: false,
-        });
-        const permError = "User does not have permission";
-        let possibleRoleIds = [];
-        if (hasResource(ctx)) {
-            possibleRoleIds = yield getRequiredResourceRole(ctx.appId, permLevel, ctx);
-        }
-        // check if we found a role, if not fallback to base permissions
-        if (possibleRoleIds.length > 0) {
-            const found = hierarchy.find(role => possibleRoleIds.indexOf(role._id) !== -1);
-            return found ? next() : ctx.throw(403, permError);
-        }
-        else if (!doesHaveBasePermission(permType, permLevel, hierarchy)) {
-            ctx.throw(403, permError);
+        // if the resource is public, proceed
+        const isPublicResource = resourceRoles.includes(BUILTIN_ROLE_IDS.PUBLIC);
+        if (isPublicResource) {
+            return next();
         }
-        // if they are not authed, then anything using the authorized middleware will fail
-        if (!isAuthed) {
-            ctx.throw(403, "Session not authenticated");
+        // check authenticated
+        if (!ctx.isAuthenticated) {
+            return ctx.throw(403, "Session not authenticated");
         }
-        return next();
+        // check authorized
+        yield checkAuthorized(ctx, resourceRoles, permType, permLevel);
+        // csrf protection
+        return csrf(ctx, next);
     });

package/dist/middleware/currentapp.js

@@ -49,15 +49,6 @@ module.exports = (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
         !isWebhookEndpoint(ctx) &&
         (!ctx.user || !ctx.user.builder || !ctx.user.builder.global)) {
         clearCookie(ctx, Cookies.CurrentApp);
-        // have to set the return url on the server side as client side is not available
-        setCookie(ctx, ctx.url, Cookies.RETURN_URL, {
-            // don't sign so the browser can easily read
-            sign: false,
-            // use the request domain to match how ui handles the return url cookie.
-            // it's important we don't use the shared domain here as the builder
-            // can't delete from it without awareness of the domain.
-            requestDomain: true,
-        });
         return ctx.redirect("/");
     }
     let appId, roleId = BUILTIN_ROLE_IDS.PUBLIC;

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@budibase/server",
     "email": "hi@budibase.com",
-    "version": "1.0.46-alpha.3",
+    "version": "1.0.46-alpha.7",
     "description": "Budibase Web Server",
     "main": "src/index.ts",
     "repository": {
@@ -70,9 +70,9 @@
     "license": "GPL-3.0",
     "dependencies": {
         "@apidevtools/swagger-parser": "^10.0.3",
-        "@budibase/backend-core": "^1.0.46-alpha.3",
-        "@budibase/client": "^1.0.46-alpha.3",
-        "@budibase/string-templates": "^1.0.46-alpha.3",
+        "@budibase/backend-core": "^1.0.46-alpha.7",
+        "@budibase/client": "^1.0.46-alpha.7",
+        "@budibase/string-templates": "^1.0.46-alpha.7",
         "@bull-board/api": "^3.7.0",
         "@bull-board/koa": "^3.7.0",
         "@elastic/elasticsearch": "7.10.0",
@@ -92,6 +92,8 @@
         "fix-path": "3.0.0",
         "form-data": "^4.0.0",
         "fs-extra": "8.1.0",
+        "google-auth-library": "^7.11.0",
+        "google-spreadsheet": "^3.2.0",
         "jimp": "0.16.1",
         "joi": "17.2.1",
         "js-yaml": "^4.1.0",
@@ -110,7 +112,7 @@
         "mongodb": "3.6.3",
         "mssql": "6.2.3",
         "mysql2": "^2.3.1",
-        "node-fetch": "2.6.0",
+        "node-fetch": "2.6.7",
         "open": "^8.4.0",
         "pg": "8.5.1",
         "pino-pretty": "4.0.0",
@@ -139,6 +141,7 @@
         "@jest/test-sequencer": "^24.8.0",
         "@types/apidoc": "^0.50.0",
         "@types/bull": "^3.15.1",
+        "@types/google-spreadsheet": "^3.1.5",
         "@types/jest": "^26.0.23",
         "@types/koa": "^2.13.3",
         "@types/koa-router": "^7.4.2",

package/dist/tests/utilities/TestConfiguration.js

@@ -21,9 +21,11 @@ const { getGlobalDB } = require("@budibase/backend-core/tenancy");
 const { createASession } = require("@budibase/backend-core/sessions");
 const { user: userCache } = require("@budibase/backend-core/cache");
 const CouchDB = require("../../db");
+const newid = require("../../db/newid");
 core.init(CouchDB);
 const GLOBAL_USER_ID = "us_uuid1";
 const EMAIL = "babs@babs.com";
+const CSRF_TOKEN = "e3727778-7af0-4226-b5eb-f43cbe60a306";
 class TestConfiguration {
     constructor(openServer = true) {
         if (openServer) {
@@ -72,7 +74,11 @@ class TestConfiguration {
                 existing = { email };
             }
             const user = Object.assign(Object.assign({ _id: id }, existing), { roles: roles || {}, tenantId: TENANT_ID });
-            yield createASession(id, { sessionId: "sessionid", tenantId: TENANT_ID });
+            yield createASession(id, {
+                sessionId: "sessionid",
+                tenantId: TENANT_ID,
+                csrfToken: CSRF_TOKEN,
+            });
             if (builder) {
                 user.builder = { global: true };
             }
@@ -83,7 +89,8 @@ class TestConfiguration {
             return Object.assign({ _rev: resp._rev }, user);
         });
     }
-    init(appName = "test_application") {
+    // use a new id as the name to avoid name collisions
+    init(appName = newid()) {
         return __awaiter(this, void 0, void 0, function* () {
             yield this.globalUser();
             return this.createApp(appName);
@@ -116,6 +123,7 @@ class TestConfiguration {
                 `${Cookies.Auth}=${authToken}`,
                 `${Cookies.CurrentApp}=${appToken}`,
             ],
+            [Headers.CSRF_TOKEN]: CSRF_TOKEN,
         };
         if (this.appId) {
             headers[Headers.APP_ID] = this.appId;
@@ -394,10 +402,6 @@ class TestConfiguration {
                     roles: { [this.prodAppId]: roleId },
                 });
             }
-            yield createASession(userId, {
-                sessionId: "sessionid",
-                tenantId: TENANT_ID,
-            });
             // have to fake this
             const auth = {
                 userId,

package/dist/threads/query.js

@@ -75,6 +75,10 @@ class QueryRunner {
                 yield threadUtils.invalidateDynamicVariables(this.cachedVariables);
                 return this.execute();
             }
+            // check for undefined response
+            if (!rows) {
+                rows = [];
+            }
             // needs to an array for next step
             if (!Array.isArray(rows)) {
                 rows = [rows];