@budibase/server 1.0.46-alpha.7 → 1.0.46-alpha.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (186) hide show
  1. package/builder/assets/{index.af9e71d8.js → index.51efc215.js} +26 -26
  2. package/builder/index.html +1 -1
  3. package/coverage/clover.xml +85 -75
  4. package/coverage/coverage-final.json +3 -3
  5. package/coverage/lcov-report/api/controllers/analytics.js.html +1 -1
  6. package/coverage/lcov-report/api/controllers/apikeys.js.html +1 -1
  7. package/coverage/lcov-report/api/controllers/application.js.html +1 -1
  8. package/coverage/lcov-report/api/controllers/auth.js.html +18 -6
  9. package/coverage/lcov-report/api/controllers/automation.js.html +1 -1
  10. package/coverage/lcov-report/api/controllers/backup.js.html +1 -1
  11. package/coverage/lcov-report/api/controllers/cloud.js.html +1 -1
  12. package/coverage/lcov-report/api/controllers/component.js.html +1 -1
  13. package/coverage/lcov-report/api/controllers/datasource.js.html +1 -1
  14. package/coverage/lcov-report/api/controllers/dev.js.html +1 -1
  15. package/coverage/lcov-report/api/controllers/index.html +16 -16
  16. package/coverage/lcov-report/api/controllers/integration.js.html +1 -1
  17. package/coverage/lcov-report/api/controllers/layout.js.html +1 -1
  18. package/coverage/lcov-report/api/controllers/metadata.js.html +1 -1
  19. package/coverage/lcov-report/api/controllers/permission.js.html +1 -1
  20. package/coverage/lcov-report/api/controllers/query/index.html +1 -1
  21. package/coverage/lcov-report/api/controllers/query/index.js.html +1 -1
  22. package/coverage/lcov-report/api/controllers/query/validation.js.html +1 -1
  23. package/coverage/lcov-report/api/controllers/role.js.html +1 -1
  24. package/coverage/lcov-report/api/controllers/routing.js.html +1 -1
  25. package/coverage/lcov-report/api/controllers/row/external.js.html +1 -1
  26. package/coverage/lcov-report/api/controllers/row/index.html +1 -1
  27. package/coverage/lcov-report/api/controllers/row/index.js.html +1 -1
  28. package/coverage/lcov-report/api/controllers/row/internal.js.html +1 -1
  29. package/coverage/lcov-report/api/controllers/row/internalSearch.js.html +1 -1
  30. package/coverage/lcov-report/api/controllers/row/utils.js.html +1 -1
  31. package/coverage/lcov-report/api/controllers/screen.js.html +1 -1
  32. package/coverage/lcov-report/api/controllers/script.js.html +1 -1
  33. package/coverage/lcov-report/api/controllers/table/external.js.html +1 -1
  34. package/coverage/lcov-report/api/controllers/table/index.html +1 -1
  35. package/coverage/lcov-report/api/controllers/table/index.js.html +1 -1
  36. package/coverage/lcov-report/api/controllers/table/internal.js.html +1 -1
  37. package/coverage/lcov-report/api/controllers/table/utils.js.html +1 -1
  38. package/coverage/lcov-report/api/controllers/templates.js.html +1 -1
  39. package/coverage/lcov-report/api/controllers/user.js.html +12 -6
  40. package/coverage/lcov-report/api/controllers/view/exporters.js.html +1 -1
  41. package/coverage/lcov-report/api/controllers/view/index.html +1 -1
  42. package/coverage/lcov-report/api/controllers/view/index.js.html +1 -1
  43. package/coverage/lcov-report/api/controllers/view/utils.js.html +1 -1
  44. package/coverage/lcov-report/api/controllers/view/viewBuilder.js.html +1 -1
  45. package/coverage/lcov-report/api/controllers/webhook.js.html +1 -1
  46. package/coverage/lcov-report/api/index.html +1 -1
  47. package/coverage/lcov-report/api/index.js.html +1 -1
  48. package/coverage/lcov-report/api/routes/analytics.js.html +1 -1
  49. package/coverage/lcov-report/api/routes/apikeys.js.html +1 -1
  50. package/coverage/lcov-report/api/routes/application.js.html +1 -1
  51. package/coverage/lcov-report/api/routes/auth.js.html +1 -1
  52. package/coverage/lcov-report/api/routes/automation.js.html +1 -1
  53. package/coverage/lcov-report/api/routes/backup.js.html +1 -1
  54. package/coverage/lcov-report/api/routes/cloud.js.html +1 -1
  55. package/coverage/lcov-report/api/routes/component.js.html +1 -1
  56. package/coverage/lcov-report/api/routes/datasource.js.html +1 -1
  57. package/coverage/lcov-report/api/routes/deploy.js.html +1 -1
  58. package/coverage/lcov-report/api/routes/dev.js.html +1 -1
  59. package/coverage/lcov-report/api/routes/index.html +1 -1
  60. package/coverage/lcov-report/api/routes/index.js.html +1 -1
  61. package/coverage/lcov-report/api/routes/integration.js.html +1 -1
  62. package/coverage/lcov-report/api/routes/layout.js.html +1 -1
  63. package/coverage/lcov-report/api/routes/metadata.js.html +1 -1
  64. package/coverage/lcov-report/api/routes/permission.js.html +1 -1
  65. package/coverage/lcov-report/api/routes/query.js.html +1 -1
  66. package/coverage/lcov-report/api/routes/role.js.html +1 -1
  67. package/coverage/lcov-report/api/routes/routing.js.html +1 -1
  68. package/coverage/lcov-report/api/routes/row.js.html +1 -1
  69. package/coverage/lcov-report/api/routes/screen.js.html +1 -1
  70. package/coverage/lcov-report/api/routes/script.js.html +1 -1
  71. package/coverage/lcov-report/api/routes/static.js.html +1 -1
  72. package/coverage/lcov-report/api/routes/table.js.html +1 -1
  73. package/coverage/lcov-report/api/routes/templates.js.html +1 -1
  74. package/coverage/lcov-report/api/routes/user.js.html +1 -1
  75. package/coverage/lcov-report/api/routes/view.js.html +1 -1
  76. package/coverage/lcov-report/api/routes/webhook.js.html +1 -1
  77. package/coverage/lcov-report/automations/actions.js.html +1 -1
  78. package/coverage/lcov-report/automations/automationUtils.js.html +1 -1
  79. package/coverage/lcov-report/automations/bullboard.js.html +1 -1
  80. package/coverage/lcov-report/automations/index.html +1 -1
  81. package/coverage/lcov-report/automations/index.js.html +1 -1
  82. package/coverage/lcov-report/automations/steps/bash.js.html +1 -1
  83. package/coverage/lcov-report/automations/steps/createRow.js.html +1 -1
  84. package/coverage/lcov-report/automations/steps/delay.js.html +1 -1
  85. package/coverage/lcov-report/automations/steps/deleteRow.js.html +1 -1
  86. package/coverage/lcov-report/automations/steps/discord.js.html +1 -1
  87. package/coverage/lcov-report/automations/steps/executeQuery.js.html +1 -1
  88. package/coverage/lcov-report/automations/steps/executeScript.js.html +1 -1
  89. package/coverage/lcov-report/automations/steps/filter.js.html +1 -1
  90. package/coverage/lcov-report/automations/steps/index.html +1 -1
  91. package/coverage/lcov-report/automations/steps/integromat.js.html +1 -1
  92. package/coverage/lcov-report/automations/steps/outgoingWebhook.js.html +1 -1
  93. package/coverage/lcov-report/automations/steps/queryRows.js.html +1 -1
  94. package/coverage/lcov-report/automations/steps/sendSmtpEmail.js.html +1 -1
  95. package/coverage/lcov-report/automations/steps/serverLog.js.html +1 -1
  96. package/coverage/lcov-report/automations/steps/slack.js.html +1 -1
  97. package/coverage/lcov-report/automations/steps/updateRow.js.html +1 -1
  98. package/coverage/lcov-report/automations/steps/utils.js.html +1 -1
  99. package/coverage/lcov-report/automations/steps/zapier.js.html +1 -1
  100. package/coverage/lcov-report/automations/triggerInfo/app.js.html +1 -1
  101. package/coverage/lcov-report/automations/triggerInfo/cron.js.html +1 -1
  102. package/coverage/lcov-report/automations/triggerInfo/index.html +1 -1
  103. package/coverage/lcov-report/automations/triggerInfo/index.js.html +1 -1
  104. package/coverage/lcov-report/automations/triggerInfo/rowDeleted.js.html +1 -1
  105. package/coverage/lcov-report/automations/triggerInfo/rowSaved.js.html +1 -1
  106. package/coverage/lcov-report/automations/triggerInfo/rowUpdated.js.html +1 -1
  107. package/coverage/lcov-report/automations/triggerInfo/webhook.js.html +1 -1
  108. package/coverage/lcov-report/automations/triggers.js.html +1 -1
  109. package/coverage/lcov-report/automations/utils.js.html +1 -1
  110. package/coverage/lcov-report/constants/index.html +1 -1
  111. package/coverage/lcov-report/constants/index.js.html +1 -1
  112. package/coverage/lcov-report/constants/layouts.js.html +1 -1
  113. package/coverage/lcov-report/constants/screens.js.html +1 -1
  114. package/coverage/lcov-report/db/client.js.html +1 -1
  115. package/coverage/lcov-report/db/inMemoryView.js.html +1 -1
  116. package/coverage/lcov-report/db/index.html +1 -1
  117. package/coverage/lcov-report/db/index.js.html +1 -1
  118. package/coverage/lcov-report/db/linkedRows/LinkController.js.html +1 -1
  119. package/coverage/lcov-report/db/linkedRows/index.html +1 -1
  120. package/coverage/lcov-report/db/linkedRows/index.js.html +1 -1
  121. package/coverage/lcov-report/db/linkedRows/linkUtils.js.html +1 -1
  122. package/coverage/lcov-report/db/newid.js.html +1 -1
  123. package/coverage/lcov-report/db/utils.js.html +1 -1
  124. package/coverage/lcov-report/events/AutomationEmitter.js.html +1 -1
  125. package/coverage/lcov-report/events/index.html +1 -1
  126. package/coverage/lcov-report/events/index.js.html +1 -1
  127. package/coverage/lcov-report/events/utils.js.html +1 -1
  128. package/coverage/lcov-report/index.html +25 -25
  129. package/coverage/lcov-report/integrations/tests/TestConfiguration.js.html +1 -1
  130. package/coverage/lcov-report/integrations/tests/index.html +1 -1
  131. package/coverage/lcov-report/middleware/appInfo.js.html +1 -1
  132. package/coverage/lcov-report/middleware/authorized.js.html +165 -63
  133. package/coverage/lcov-report/middleware/builder.js.html +1 -1
  134. package/coverage/lcov-report/middleware/currentapp.js.html +1 -1
  135. package/coverage/lcov-report/middleware/index.html +19 -19
  136. package/coverage/lcov-report/middleware/joi-validator.js.html +1 -1
  137. package/coverage/lcov-report/middleware/resourceId.js.html +1 -1
  138. package/coverage/lcov-report/middleware/selfhost.js.html +1 -1
  139. package/coverage/lcov-report/middleware/usageQuota.js.html +1 -1
  140. package/coverage/lcov-report/middleware/utils.js.html +1 -1
  141. package/coverage/lcov-report/migrations/usageQuotas/index.html +1 -1
  142. package/coverage/lcov-report/migrations/usageQuotas/index.js.html +1 -1
  143. package/coverage/lcov-report/migrations/usageQuotas/syncApps.js.html +1 -1
  144. package/coverage/lcov-report/migrations/usageQuotas/syncRows.js.html +1 -1
  145. package/coverage/lcov-report/threads/automation.js.html +1 -1
  146. package/coverage/lcov-report/threads/index.html +1 -1
  147. package/coverage/lcov-report/threads/index.js.html +1 -1
  148. package/coverage/lcov-report/threads/query.js.html +1 -1
  149. package/coverage/lcov-report/threads/utils.js.html +1 -1
  150. package/coverage/lcov-report/utilities/bcrypt.js.html +1 -1
  151. package/coverage/lcov-report/utilities/budibaseDir.js.html +1 -1
  152. package/coverage/lcov-report/utilities/centralPath.js.html +1 -1
  153. package/coverage/lcov-report/utilities/csvParser.js.html +1 -1
  154. package/coverage/lcov-report/utilities/global.js.html +1 -1
  155. package/coverage/lcov-report/utilities/index.html +1 -1
  156. package/coverage/lcov-report/utilities/index.js.html +1 -1
  157. package/coverage/lcov-report/utilities/queue/inMemoryQueue.js.html +1 -1
  158. package/coverage/lcov-report/utilities/queue/index.html +1 -1
  159. package/coverage/lcov-report/utilities/routing/index.html +1 -1
  160. package/coverage/lcov-report/utilities/routing/index.js.html +1 -1
  161. package/coverage/lcov-report/utilities/rowProcessor/index.html +1 -1
  162. package/coverage/lcov-report/utilities/rowProcessor/index.js.html +1 -1
  163. package/coverage/lcov-report/utilities/rowProcessor/utils.js.html +1 -1
  164. package/coverage/lcov-report/utilities/scriptRunner.js.html +1 -1
  165. package/coverage/lcov-report/utilities/security.js.html +1 -1
  166. package/coverage/lcov-report/utilities/statusCodes.js.html +1 -1
  167. package/coverage/lcov-report/utilities/usageQuota/index.html +1 -1
  168. package/coverage/lcov-report/utilities/usageQuota/index.js.html +1 -1
  169. package/coverage/lcov-report/utilities/usageQuota/rows.js.html +1 -1
  170. package/coverage/lcov-report/utilities/usageQuota/usageQuoteReset.js.html +1 -1
  171. package/coverage/lcov-report/utilities/users.js.html +1 -1
  172. package/coverage/lcov-report/utilities/workerRequests.js.html +1 -1
  173. package/coverage/lcov.info +141 -123
  174. package/dist/api/controllers/auth.js +4 -0
  175. package/dist/api/controllers/user.js +2 -0
  176. package/dist/middleware/authorized.js +55 -30
  177. package/dist/package.json +4 -4
  178. package/dist/tests/utilities/TestConfiguration.js +7 -5
  179. package/dist/tsconfig.tsbuildinfo +1 -1
  180. package/package.json +5 -5
  181. package/src/api/controllers/auth.js +4 -0
  182. package/src/api/controllers/user.js +2 -0
  183. package/src/api/routes/tests/auth.spec.js +1 -2
  184. package/src/middleware/authorized.js +64 -30
  185. package/src/middleware/tests/authorized.spec.js +6 -4
  186. package/src/tests/utilities/TestConfiguration.js +7 -5
@@ -23,30 +23,30 @@
23
23
  <div class='clearfix'>
24
24
 
25
25
  <div class='fl pad1y space-right2'>
26
- <span class="strong">100% </span>
26
+ <span class="strong">90.47% </span>
27
27
  <span class="quiet">Statements</span>
28
- <span class='fraction'>34/34</span>
28
+ <span class='fraction'>38/42</span>
29
29
  </div>
30
30
 
31
31
 
32
32
  <div class='fl pad1y space-right2'>
33
- <span class="strong">89.28% </span>
33
+ <span class="strong">87.5% </span>
34
34
  <span class="quiet">Branches</span>
35
- <span class='fraction'>25/28</span>
35
+ <span class='fraction'>28/32</span>
36
36
  </div>
37
37
 
38
38
 
39
39
  <div class='fl pad1y space-right2'>
40
- <span class="strong">100% </span>
40
+ <span class="strong">83.33% </span>
41
41
  <span class="quiet">Functions</span>
42
- <span class='fraction'>4/4</span>
42
+ <span class='fraction'>5/6</span>
43
43
  </div>
44
44
 
45
45
 
46
46
  <div class='fl pad1y space-right2'>
47
- <span class="strong">100% </span>
47
+ <span class="strong">92.68% </span>
48
48
  <span class="quiet">Lines</span>
49
- <span class='fraction'>34/34</span>
49
+ <span class='fraction'>38/41</span>
50
50
  </div>
51
51
 
52
52
 
@@ -127,7 +127,41 @@
127
127
  <a name='L68'></a><a href='#L68'>68</a>
128
128
  <a name='L69'></a><a href='#L69'>69</a>
129
129
  <a name='L70'></a><a href='#L70'>70</a>
130
- <a name='L71'></a><a href='#L71'>71</a></td><td class="line-coverage quiet"><span class="cline-any cline-neutral">&nbsp;</span>
130
+ <a name='L71'></a><a href='#L71'>71</a>
131
+ <a name='L72'></a><a href='#L72'>72</a>
132
+ <a name='L73'></a><a href='#L73'>73</a>
133
+ <a name='L74'></a><a href='#L74'>74</a>
134
+ <a name='L75'></a><a href='#L75'>75</a>
135
+ <a name='L76'></a><a href='#L76'>76</a>
136
+ <a name='L77'></a><a href='#L77'>77</a>
137
+ <a name='L78'></a><a href='#L78'>78</a>
138
+ <a name='L79'></a><a href='#L79'>79</a>
139
+ <a name='L80'></a><a href='#L80'>80</a>
140
+ <a name='L81'></a><a href='#L81'>81</a>
141
+ <a name='L82'></a><a href='#L82'>82</a>
142
+ <a name='L83'></a><a href='#L83'>83</a>
143
+ <a name='L84'></a><a href='#L84'>84</a>
144
+ <a name='L85'></a><a href='#L85'>85</a>
145
+ <a name='L86'></a><a href='#L86'>86</a>
146
+ <a name='L87'></a><a href='#L87'>87</a>
147
+ <a name='L88'></a><a href='#L88'>88</a>
148
+ <a name='L89'></a><a href='#L89'>89</a>
149
+ <a name='L90'></a><a href='#L90'>90</a>
150
+ <a name='L91'></a><a href='#L91'>91</a>
151
+ <a name='L92'></a><a href='#L92'>92</a>
152
+ <a name='L93'></a><a href='#L93'>93</a>
153
+ <a name='L94'></a><a href='#L94'>94</a>
154
+ <a name='L95'></a><a href='#L95'>95</a>
155
+ <a name='L96'></a><a href='#L96'>96</a>
156
+ <a name='L97'></a><a href='#L97'>97</a>
157
+ <a name='L98'></a><a href='#L98'>98</a>
158
+ <a name='L99'></a><a href='#L99'>99</a>
159
+ <a name='L100'></a><a href='#L100'>100</a>
160
+ <a name='L101'></a><a href='#L101'>101</a>
161
+ <a name='L102'></a><a href='#L102'>102</a>
162
+ <a name='L103'></a><a href='#L103'>103</a>
163
+ <a name='L104'></a><a href='#L104'>104</a>
164
+ <a name='L105'></a><a href='#L105'>105</a></td><td class="line-coverage quiet"><span class="cline-any cline-neutral">&nbsp;</span>
131
165
  <span class="cline-any cline-neutral">&nbsp;</span>
132
166
  <span class="cline-any cline-neutral">&nbsp;</span>
133
167
  <span class="cline-any cline-neutral">&nbsp;</span>
@@ -138,9 +172,57 @@
138
172
  <span class="cline-any cline-yes">24x</span>
139
173
  <span class="cline-any cline-yes">24x</span>
140
174
  <span class="cline-any cline-yes">24x</span>
175
+ <span class="cline-any cline-yes">24x</span>
176
+ <span class="cline-any cline-neutral">&nbsp;</span>
177
+ <span class="cline-any cline-neutral">&nbsp;</span>
178
+ <span class="cline-any cline-yes">155x</span>
179
+ <span class="cline-any cline-neutral">&nbsp;</span>
180
+ <span class="cline-any cline-neutral">&nbsp;</span>
181
+ <span class="cline-any cline-yes">24x</span>
182
+ <span class="cline-any cline-neutral">&nbsp;</span>
183
+ <span class="cline-any cline-neutral">&nbsp;</span>
184
+ <span class="cline-any cline-neutral">&nbsp;</span>
185
+ <span class="cline-any cline-neutral">&nbsp;</span>
186
+ <span class="cline-any cline-neutral">&nbsp;</span>
187
+ <span class="cline-any cline-neutral">&nbsp;</span>
188
+ <span class="cline-any cline-neutral">&nbsp;</span>
189
+ <span class="cline-any cline-yes">24x</span>
190
+ <span class="cline-any cline-neutral">&nbsp;</span>
191
+ <span class="cline-any cline-yes">129x</span>
192
+ <span class="cline-any cline-yes">129x</span>
193
+ <span class="cline-any cline-yes">129x</span>
194
+ <span class="cline-any cline-yes">1x</span>
195
+ <span class="cline-any cline-neutral">&nbsp;</span>
196
+ <span class="cline-any cline-neutral">&nbsp;</span>
197
+ <span class="cline-any cline-neutral">&nbsp;</span>
198
+ <span class="cline-any cline-yes">128x</span>
199
+ <span class="cline-any cline-yes">3x</span>
200
+ <span class="cline-any cline-neutral">&nbsp;</span>
201
+ <span class="cline-any cline-neutral">&nbsp;</span>
202
+ <span class="cline-any cline-neutral">&nbsp;</span>
203
+ <span class="cline-any cline-yes">24x</span>
204
+ <span class="cline-any cline-neutral">&nbsp;</span>
205
+ <span class="cline-any cline-neutral">&nbsp;</span>
206
+ <span class="cline-any cline-neutral">&nbsp;</span>
207
+ <span class="cline-any cline-neutral">&nbsp;</span>
208
+ <span class="cline-any cline-neutral">&nbsp;</span>
209
+ <span class="cline-any cline-neutral">&nbsp;</span>
210
+ <span class="cline-any cline-yes">3x</span>
211
+ <span class="cline-any cline-yes">3x</span>
212
+ <span class="cline-any cline-neutral">&nbsp;</span>
141
213
  <span class="cline-any cline-neutral">&nbsp;</span>
214
+ <span class="cline-any cline-yes">3x</span>
215
+ <span class="cline-any cline-neutral">&nbsp;</span>
216
+ <span class="cline-any cline-yes">3x</span>
217
+ <span class="cline-any cline-neutral">&nbsp;</span>
218
+ <span class="cline-any cline-no">&nbsp;</span>
219
+ <span class="cline-any cline-no">&nbsp;</span>
220
+ <span class="cline-any cline-no">&nbsp;</span>
221
+ <span class="cline-any cline-neutral">&nbsp;</span>
222
+ <span class="cline-any cline-neutral">&nbsp;</span>
223
+ <span class="cline-any cline-yes">3x</span>
224
+ <span class="cline-any cline-yes">3x</span>
142
225
  <span class="cline-any cline-neutral">&nbsp;</span>
143
- <span class="cline-any cline-yes">7x</span>
144
226
  <span class="cline-any cline-neutral">&nbsp;</span>
145
227
  <span class="cline-any cline-neutral">&nbsp;</span>
146
228
  <span class="cline-any cline-yes">24x</span>
@@ -160,42 +242,28 @@
160
242
  <span class="cline-any cline-neutral">&nbsp;</span>
161
243
  <span class="cline-any cline-yes">160x</span>
162
244
  <span class="cline-any cline-neutral">&nbsp;</span>
163
- <span class="cline-any cline-yes">160x</span>
164
245
  <span class="cline-any cline-neutral">&nbsp;</span>
165
246
  <span class="cline-any cline-yes">160x</span>
166
247
  <span class="cline-any cline-yes">160x</span>
167
- <span class="cline-any cline-yes">160x</span>
168
- <span class="cline-any cline-yes">125x</span>
169
- <span class="cline-any cline-yes">35x</span>
170
- <span class="cline-any cline-yes">28x</span>
248
+ <span class="cline-any cline-yes">55x</span>
171
249
  <span class="cline-any cline-neutral">&nbsp;</span>
172
250
  <span class="cline-any cline-neutral">&nbsp;</span>
173
251
  <span class="cline-any cline-neutral">&nbsp;</span>
174
- <span class="cline-any cline-yes">7x</span>
175
- <span class="cline-any cline-yes">7x</span>
252
+ <span class="cline-any cline-yes">160x</span>
253
+ <span class="cline-any cline-yes">160x</span>
254
+ <span class="cline-any cline-yes">1x</span>
176
255
  <span class="cline-any cline-neutral">&nbsp;</span>
177
256
  <span class="cline-any cline-neutral">&nbsp;</span>
178
- <span class="cline-any cline-yes">7x</span>
179
- <span class="cline-any cline-yes">7x</span>
180
- <span class="cline-any cline-yes">7x</span>
181
- <span class="cline-any cline-yes">3x</span>
182
257
  <span class="cline-any cline-neutral">&nbsp;</span>
258
+ <span class="cline-any cline-yes">159x</span>
259
+ <span class="cline-any cline-yes">30x</span>
183
260
  <span class="cline-any cline-neutral">&nbsp;</span>
184
- <span class="cline-any cline-yes">7x</span>
185
- <span class="cline-any cline-yes">1x</span>
186
- <span class="cline-any cline-yes">1x</span>
187
261
  <span class="cline-any cline-neutral">&nbsp;</span>
188
- <span class="cline-any cline-yes">1x</span>
189
- <span class="cline-any cline-yes">6x</span>
190
- <span class="cline-any cline-yes">6x</span>
191
262
  <span class="cline-any cline-neutral">&nbsp;</span>
263
+ <span class="cline-any cline-yes">129x</span>
192
264
  <span class="cline-any cline-neutral">&nbsp;</span>
193
265
  <span class="cline-any cline-neutral">&nbsp;</span>
194
- <span class="cline-any cline-yes">4x</span>
195
- <span class="cline-any cline-yes">4x</span>
196
- <span class="cline-any cline-neutral">&nbsp;</span>
197
- <span class="cline-any cline-neutral">&nbsp;</span>
198
- <span class="cline-any cline-yes">4x</span>
266
+ <span class="cline-any cline-yes">129x</span>
199
267
  <span class="cline-any cline-neutral">&nbsp;</span>
200
268
  <span class="cline-any cline-neutral">&nbsp;</span></td><td class="text"><pre class="prettyprint lang-js">const {
201
269
  getUserRoleHierarchy,
@@ -208,11 +276,59 @@ const {
208
276
  } = require("@budibase/backend-core/permissions")
209
277
  const builderMiddleware = require("./builder")
210
278
  const { isWebhookEndpoint } = require("./utils")
279
+ const { buildCsrfMiddleware } = require("@budibase/backend-core/auth")
211
280
  &nbsp;
212
281
  function hasResource(ctx) {
213
282
  return ctx.resourceId != null
214
283
  }
215
284
  &nbsp;
285
+ const csrf = buildCsrfMiddleware()
286
+ &nbsp;
287
+ /**
288
+ * Apply authorization to the requested resource:
289
+ * - If this is a builder resource the user must be a builder.
290
+ * - Builders can access all resources.
291
+ * - Otherwise the user must have the required role.
292
+ */
293
+ const checkAuthorized = async (ctx, resourceRoles, permType, permLevel) =&gt; {
294
+ // check if this is a builder api and the user is not a builder
295
+ const isBuilder = ctx.user &amp;&amp; ctx.user.builder &amp;&amp; ctx.user.builder.global
296
+ const isBuilderApi = permType === PermissionTypes.BUILDER
297
+ if (isBuilderApi &amp;&amp; !isBuilder) {
298
+ return ctx.throw(403, "Not Authorized")
299
+ }
300
+ &nbsp;
301
+ // check for resource authorization
302
+ if (!isBuilder) {
303
+ await checkAuthorizedResource(ctx, resourceRoles, permType, permLevel)
304
+ }
305
+ }
306
+ &nbsp;
307
+ const checkAuthorizedResource = async (
308
+ ctx,
309
+ resourceRoles,
310
+ permType,
311
+ permLevel
312
+ ) =&gt; {
313
+ // get the user's roles
314
+ const roleId = ctx.roleId || BUILTIN_ROLE_IDS.PUBLIC
315
+ const userRoles = await getUserRoleHierarchy(ctx.appId, roleId, {
316
+ idOnly: false,
317
+ })
318
+ const permError = "User does not have permission"
319
+ // check if the user has the required role
320
+ <span class="missing-if-branch" title="if path not taken" >I</span>if (resourceRoles.length &gt; 0) {
321
+ // deny access if the user doesn't have the required resource role
322
+ const found = <span class="cstat-no" title="statement not covered" >userRoles.find(<span class="fstat-no" title="function not covered" >ro</span>le =&gt; <span class="cstat-no" title="statement not covered" >resourceRoles.indexOf(role._id) !== -1)</span></span>
323
+ <span class="cstat-no" title="statement not covered" > if (!found) {</span>
324
+ <span class="cstat-no" title="statement not covered" > ctx.throw(403, permError)</span>
325
+ }
326
+ // fallback to the base permissions when no resource roles are found
327
+ } else if (!doesHaveBasePermission(permType, permLevel, userRoles)) {
328
+ ctx.throw(403, permError)
329
+ }
330
+ }
331
+ &nbsp;
216
332
  module.exports =
217
333
  (permType, permLevel = null) =&gt;
218
334
  async (ctx, next) =&gt; {
@@ -230,42 +346,28 @@ module.exports =
230
346
  // to find API endpoints which are builder focused
231
347
  await builderMiddleware(ctx, permType)
232
348
  &nbsp;
233
- const isAuthed = ctx.isAuthenticated
234
- // builders for now have permission to do anything
235
- let isBuilder = ctx.user &amp;&amp; ctx.user.builder &amp;&amp; ctx.user.builder.global
236
- const isBuilderApi = permType === PermissionTypes.BUILDER
237
- if (isBuilder) {
238
- return next()
239
- } else if (isBuilderApi &amp;&amp; !isBuilder) {
240
- return ctx.throw(403, "Not Authorized")
349
+ // get the resource roles
350
+ let resourceRoles = []
351
+ if (ctx.appId &amp;&amp; hasResource(ctx)) {
352
+ resourceRoles = await getRequiredResourceRole(ctx.appId, permLevel, ctx)
241
353
  }
242
354
  &nbsp;
243
- // need to check this first, in-case public access, don't check authed until last
244
- const roleId = ctx.roleId || BUILTIN_ROLE_IDS.PUBLIC
245
- const hierarchy = await getUserRoleHierarchy(ctx.appId, roleId, {
246
- idOnly: false,
247
- })
248
- const permError = "User does not have permission"
249
- let possibleRoleIds = []
250
- if (hasResource(ctx)) {
251
- possibleRoleIds = await getRequiredResourceRole(ctx.appId, permLevel, ctx)
252
- }
253
- // check if we found a role, if not fallback to base permissions
254
- if (possibleRoleIds.length &gt; 0) {
255
- const found = hierarchy.find(
256
- role =&gt; possibleRoleIds.indexOf(role._id) !== -1
257
- )
258
- return found ? next() : <span class="branch-1 cbranch-no" title="branch not covered" >ctx.throw(403, permError)</span>
259
- } else if (!doesHaveBasePermission(permType, permLevel, hierarchy)) {
260
- ctx.throw(403, permError)
355
+ // if the resource is public, proceed
356
+ const isPublicResource = resourceRoles.includes(BUILTIN_ROLE_IDS.PUBLIC)
357
+ if (isPublicResource) {
358
+ return next()
261
359
  }
262
360
  &nbsp;
263
- // if they are not authed, then anything using the authorized middleware will fail
264
- if (!isAuthed) {
265
- ctx.throw(403, "Session not authenticated")
361
+ // check authenticated
362
+ if (!ctx.isAuthenticated) {
363
+ return ctx.throw(403, "Session not authenticated")
266
364
  }
267
365
  &nbsp;
268
- return next()
366
+ // check authorized
367
+ await checkAuthorized(ctx, resourceRoles, permType, permLevel)
368
+ &nbsp;
369
+ // csrf protection
370
+ return csrf(ctx, next)
269
371
  }
270
372
  &nbsp;</pre></td></tr></table></pre>
271
373
 
@@ -274,7 +376,7 @@ module.exports =
274
376
  <div class='footer quiet pad2 space-top1 center small'>
275
377
  Code coverage generated by
276
378
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
277
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
379
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
278
380
  </div>
279
381
  </div>
280
382
  <script src="../prettify.js"></script>
@@ -298,7 +298,7 @@ module.exports = async (ctx, permType) =&gt; {
298
298
  <div class='footer quiet pad2 space-top1 center small'>
299
299
  Code coverage generated by
300
300
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
301
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
301
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
302
302
  </div>
303
303
  </div>
304
304
  <script src="../prettify.js"></script>
@@ -397,7 +397,7 @@ module.exports = async (ctx, next) =&gt; {
397
397
  <div class='footer quiet pad2 space-top1 center small'>
398
398
  Code coverage generated by
399
399
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
400
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
400
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
401
401
  </div>
402
402
  </div>
403
403
  <script src="../prettify.js"></script>
@@ -23,30 +23,30 @@
23
23
  <div class='clearfix'>
24
24
 
25
25
  <div class='fl pad1y space-right2'>
26
- <span class="strong">83.52% </span>
26
+ <span class="strong">82.52% </span>
27
27
  <span class="quiet">Statements</span>
28
- <span class='fraction'>218/261</span>
28
+ <span class='fraction'>222/269</span>
29
29
  </div>
30
30
 
31
31
 
32
32
  <div class='fl pad1y space-right2'>
33
- <span class="strong">70.85% </span>
33
+ <span class="strong">70.94% </span>
34
34
  <span class="quiet">Branches</span>
35
- <span class='fraction'>124/175</span>
35
+ <span class='fraction'>127/179</span>
36
36
  </div>
37
37
 
38
38
 
39
39
  <div class='fl pad1y space-right2'>
40
- <span class="strong">87.87% </span>
40
+ <span class="strong">85.71% </span>
41
41
  <span class="quiet">Functions</span>
42
- <span class='fraction'>29/33</span>
42
+ <span class='fraction'>30/35</span>
43
43
  </div>
44
44
 
45
45
 
46
46
  <div class='fl pad1y space-right2'>
47
- <span class="strong">84.16% </span>
47
+ <span class="strong">83.45% </span>
48
48
  <span class="quiet">Lines</span>
49
- <span class='fraction'>218/259</span>
49
+ <span class='fraction'>222/266</span>
50
50
  </div>
51
51
 
52
52
 
@@ -89,17 +89,17 @@
89
89
 
90
90
  <tr>
91
91
  <td class="file high" data-value="authorized.js"><a href="authorized.js.html">authorized.js</a></td>
92
- <td data-value="100" class="pic high">
93
- <div class="chart"><div class="cover-fill cover-full" style="width: 100%"></div><div class="cover-empty" style="width: 0%"></div></div>
92
+ <td data-value="90.47" class="pic high">
93
+ <div class="chart"><div class="cover-fill" style="width: 90%"></div><div class="cover-empty" style="width: 10%"></div></div>
94
94
  </td>
95
- <td data-value="100" class="pct high">100%</td>
96
- <td data-value="34" class="abs high">34/34</td>
97
- <td data-value="89.28" class="pct high">89.28%</td>
98
- <td data-value="28" class="abs high">25/28</td>
99
- <td data-value="100" class="pct high">100%</td>
100
- <td data-value="4" class="abs high">4/4</td>
101
- <td data-value="100" class="pct high">100%</td>
102
- <td data-value="34" class="abs high">34/34</td>
95
+ <td data-value="90.47" class="pct high">90.47%</td>
96
+ <td data-value="42" class="abs high">38/42</td>
97
+ <td data-value="87.5" class="pct high">87.5%</td>
98
+ <td data-value="32" class="abs high">28/32</td>
99
+ <td data-value="83.33" class="pct high">83.33%</td>
100
+ <td data-value="6" class="abs high">5/6</td>
101
+ <td data-value="92.68" class="pct high">92.68%</td>
102
+ <td data-value="41" class="abs high">38/41</td>
103
103
  </tr>
104
104
 
105
105
  <tr>
@@ -215,7 +215,7 @@
215
215
  <div class='footer quiet pad2 space-top1 center small'>
216
216
  Code coverage generated by
217
217
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
218
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
218
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
219
219
  </div>
220
220
  </div>
221
221
  <script src="../prettify.js"></script>
@@ -148,7 +148,7 @@ module.exports.params = schema =&gt; {
148
148
  <div class='footer quiet pad2 space-top1 center small'>
149
149
  Code coverage generated by
150
150
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
151
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
151
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
152
152
  </div>
153
153
  </div>
154
154
  <script src="../prettify.js"></script>
@@ -247,7 +247,7 @@ module.exports.bodySubResource = (main, sub) =&gt; {
247
247
  <div class='footer quiet pad2 space-top1 center small'>
248
248
  Code coverage generated by
249
249
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
250
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
250
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
251
251
  </div>
252
252
  </div>
253
253
  <script src="../prettify.js"></script>
@@ -94,7 +94,7 @@ module.exports = async (ctx, next) =&gt; {
94
94
  <div class='footer quiet pad2 space-top1 center small'>
95
95
  Code coverage generated by
96
96
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
97
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
97
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
98
98
  </div>
99
99
  </div>
100
100
  <script src="../prettify.js"></script>
@@ -562,7 +562,7 @@ const POST_CREATE = {
562
562
  <div class='footer quiet pad2 space-top1 center small'>
563
563
  Code coverage generated by
564
564
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
565
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
565
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
566
566
  </div>
567
567
  </div>
568
568
  <script src="../prettify.js"></script>
@@ -85,7 +85,7 @@ exports.isWebhookEndpoint = ctx =&gt; {
85
85
  <div class='footer quiet pad2 space-top1 center small'>
86
86
  Code coverage generated by
87
87
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
88
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
88
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
89
89
  </div>
90
90
  </div>
91
91
  <script src="../prettify.js"></script>
@@ -125,7 +125,7 @@
125
125
  <div class='footer quiet pad2 space-top1 center small'>
126
126
  Code coverage generated by
127
127
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
128
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
128
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
129
129
  </div>
130
130
  </div>
131
131
  <script src="../../prettify.js"></script>
@@ -136,7 +136,7 @@ exports.run = async () =&gt; {
136
136
  <div class='footer quiet pad2 space-top1 center small'>
137
137
  Code coverage generated by
138
138
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
139
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
139
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
140
140
  </div>
141
141
  </div>
142
142
  <script src="../../prettify.js"></script>
@@ -118,7 +118,7 @@ exports.run = async () =&gt; {
118
118
  <div class='footer quiet pad2 space-top1 center small'>
119
119
  Code coverage generated by
120
120
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
121
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
121
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
122
122
  </div>
123
123
  </div>
124
124
  <script src="../../prettify.js"></script>
@@ -127,7 +127,7 @@ exports.run = async () =&gt; {
127
127
  <div class='footer quiet pad2 space-top1 center small'>
128
128
  Code coverage generated by
129
129
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
130
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
130
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
131
131
  </div>
132
132
  </div>
133
133
  <script src="../../prettify.js"></script>
@@ -502,7 +502,7 @@ module.exports = (input, callback) =&gt; {
502
502
  <div class='footer quiet pad2 space-top1 center small'>
503
503
  Code coverage generated by
504
504
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
505
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
505
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
506
506
  </div>
507
507
  </div>
508
508
  <script src="../prettify.js"></script>
@@ -140,7 +140,7 @@
140
140
  <div class='footer quiet pad2 space-top1 center small'>
141
141
  Code coverage generated by
142
142
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
143
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
143
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
144
144
  </div>
145
145
  </div>
146
146
  <script src="../prettify.js"></script>
@@ -262,7 +262,7 @@ module.exports.ThreadType = ThreadType
262
262
  <div class='footer quiet pad2 space-top1 center small'>
263
263
  Code coverage generated by
264
264
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
265
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
265
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
266
266
  </div>
267
267
  </div>
268
268
  <script src="../prettify.js"></script>
@@ -766,7 +766,7 @@ module.exports = (input, callback) =&gt; {
766
766
  <div class='footer quiet pad2 space-top1 center small'>
767
767
  Code coverage generated by
768
768
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
769
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
769
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
770
770
  </div>
771
771
  </div>
772
772
  <script src="../prettify.js"></script>
@@ -298,7 +298,7 @@ exports.hasExtraData = response =&gt; {
298
298
  <div class='footer quiet pad2 space-top1 center small'>
299
299
  Code coverage generated by
300
300
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
301
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
301
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
302
302
  </div>
303
303
  </div>
304
304
  <script src="../prettify.js"></script>
@@ -109,7 +109,7 @@ const SALT_ROUNDS = <span class="cstat-no" title="statement not covered" >env.SA
109
109
  <div class='footer quiet pad2 space-top1 center small'>
110
110
  Code coverage generated by
111
111
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
112
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
112
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
113
113
  </div>
114
114
  </div>
115
115
  <script src="../prettify.js"></script>
@@ -94,7 +94,7 @@ module.exports.budibaseTempDir = budibaseTempDir
94
94
  <div class='footer quiet pad2 space-top1 center small'>
95
95
  Code coverage generated by
96
96
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
97
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
97
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
98
98
  </div>
99
99
  </div>
100
100
  <script src="../prettify.js"></script>
@@ -130,7 +130,7 @@ exports.resolve = <span class="fstat-no" title="function not covered" >fu</span>
130
130
  <div class='footer quiet pad2 space-top1 center small'>
131
131
  Code coverage generated by
132
132
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
133
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
133
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
134
134
  </div>
135
135
  </div>
136
136
  <script src="../prettify.js"></script>
@@ -496,7 +496,7 @@ module.exports = {
496
496
  <div class='footer quiet pad2 space-top1 center small'>
497
497
  Code coverage generated by
498
498
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
499
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
499
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
500
500
  </div>
501
501
  </div>
502
502
  <script src="../prettify.js"></script>
@@ -376,7 +376,7 @@ exports.getGlobalUsersFromMetadata = async (appId, users) =&gt; {
376
376
  <div class='footer quiet pad2 space-top1 center small'>
377
377
  Code coverage generated by
378
378
  <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
379
- at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
379
+ at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
380
380
  </div>
381
381
  </div>
382
382
  <script src="../prettify.js"></script>