@budibase/server 1.0.46-alpha.7 → 1.0.46-alpha.8

package/coverage/lcov-report/utilities/index.html

@@ -245,7 +245,7 @@
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../prettify.js"></script>

package/coverage/lcov-report/utilities/index.js.html

@@ -553,7 +553,7 @@ exports.formatBytes = bytes => {
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../prettify.js"></script>

package/coverage/lcov-report/utilities/queue/inMemoryQueue.js.html

@@ -367,7 +367,7 @@ module.exports = InMemoryQueue
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../../prettify.js"></script>

package/coverage/lcov-report/utilities/queue/index.html

@@ -95,7 +95,7 @@
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../../prettify.js"></script>

package/coverage/lcov-report/utilities/routing/index.html

@@ -95,7 +95,7 @@
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../../prettify.js"></script>

package/coverage/lcov-report/utilities/routing/index.js.html

@@ -139,7 +139,7 @@ exports.createRoutingView = createRoutingView
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../../prettify.js"></script>

package/coverage/lcov-report/utilities/rowProcessor/index.html

@@ -110,7 +110,7 @@
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../../prettify.js"></script>

package/coverage/lcov-report/utilities/rowProcessor/index.js.html

@@ -1087,7 +1087,7 @@ exports.cleanupAttachments = async (appId, table, { row, rows, oldRow }) => {
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../../prettify.js"></script>

package/coverage/lcov-report/utilities/rowProcessor/utils.js.html

@@ -133,7 +133,7 @@ exports.processFormulas = (table, rows) => {
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../../prettify.js"></script>

package/coverage/lcov-report/utilities/scriptRunner.js.html

@@ -136,7 +136,7 @@ module.exports = ScriptRunner
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../prettify.js"></script>

package/coverage/lcov-report/utilities/security.js.html

@@ -274,7 +274,7 @@ exports.CURRENTLY_SUPPORTED_LEVELS = CURRENTLY_SUPPORTED_LEVELS
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../prettify.js"></script>

package/coverage/lcov-report/utilities/statusCodes.js.html

@@ -85,7 +85,7 @@
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../prettify.js"></script>

package/coverage/lcov-report/utilities/usageQuota/index.html

@@ -125,7 +125,7 @@
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../../prettify.js"></script>

package/coverage/lcov-report/utilities/usageQuota/index.js.html

@@ -340,7 +340,7 @@ exports.update = async (property, usage, opts = { dryRun: false }) => {
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../../prettify.js"></script>

package/coverage/lcov-report/utilities/usageQuota/rows.js.html

@@ -286,7 +286,7 @@ exports.getUniqueRows = async appIds => {
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../../prettify.js"></script>

package/coverage/lcov-report/utilities/usageQuota/usageQuoteReset.js.html

@@ -118,7 +118,7 @@ function <span class="fstat-no" title="function not covered" >resetQuotasIfRequi
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../../prettify.js"></script>

package/coverage/lcov-report/utilities/users.js.html

@@ -136,7 +136,7 @@ exports.getFullUser = async (ctx, userId) => {
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../prettify.js"></script>

package/coverage/lcov-report/utilities/workerRequests.js.html

@@ -334,7 +334,7 @@ exports.removeAppFromUserRoles = async (ctx, appId) => {
             <div class='footer quiet pad2 space-top1 center small'>
                 Code coverage generated by
                 <a href="https://istanbul.js.org/" target="_blank">istanbul</a>
-                at Fri Jan 28 2022 15:12:12 GMT+0000 (Coordinated Universal Time)
+                at Sun Jan 30 2022 21:42:59 GMT+0000 (Coordinated Universal Time)
             </div>
         </div>
         <script src="../prettify.js"></script>

package/coverage/lcov.info

@@ -489,32 +489,34 @@ DA:9,1
 DA:16,1
 DA:18,1
 DA:20,1
-DA:21,1
+DA:22,1
 DA:23,1
-DA:24,1
 DA:25,1
 DA:26,1
-DA:28,0
-DA:35,1
-DA:36,0
+DA:27,1
+DA:28,1
+DA:30,0
+DA:32,0
 DA:39,1
-DA:40,1
+DA:40,0
+DA:43,1
 DA:44,1
-DA:45,1
-DA:46,1
-DA:48,0
+DA:48,1
+DA:49,1
 DA:50,1
-DA:53,0
-LF:27
-LH:23
+DA:52,0
+DA:54,1
+DA:57,0
+LF:29
+LH:24
 BRDA:9,0,0,1
 BRDA:9,0,1,0
-BRDA:20,1,0,1
-BRDA:20,1,1,0
-BRDA:35,2,0,0
-BRDA:35,2,1,1
-BRDA:39,3,0,1
-BRDA:39,3,1,0
+BRDA:22,1,0,1
+BRDA:22,1,1,0
+BRDA:39,2,0,0
+BRDA:39,2,1,1
+BRDA:43,3,0,1
+BRDA:43,3,1,0
 BRF:8
 BRH:4
 end_of_record
@@ -1728,11 +1730,11 @@ FN:101,(anonymous_7)
 FN:145,(anonymous_8)
 FN:152,(anonymous_9)
 FN:165,(anonymous_10)
-FN:173,(anonymous_11)
-FN:186,(anonymous_12)
-FN:199,(anonymous_13)
-FN:203,(anonymous_14)
-FN:222,(anonymous_15)
+FN:175,(anonymous_11)
+FN:188,(anonymous_12)
+FN:201,(anonymous_13)
+FN:205,(anonymous_14)
+FN:224,(anonymous_15)
 FNF:16
 FNH:5
 FNDA:2,rawMetadata
@@ -1833,44 +1835,45 @@ DA:162,2
 DA:165,37
 DA:167,0
 DA:169,0
-DA:170,0
-DA:173,37
-DA:174,1
-DA:175,1
+DA:171,0
+DA:172,0
+DA:175,37
 DA:176,1
+DA:177,1
 DA:178,1
-DA:179,1
-DA:183,1
-DA:186,37
-DA:187,1
-DA:188,1
+DA:180,1
+DA:181,1
+DA:185,1
+DA:188,37
 DA:189,1
-DA:190,0
-DA:194,1
-DA:199,37
-DA:200,1
-DA:203,37
-DA:204,0
-DA:205,0
+DA:190,1
+DA:191,1
+DA:192,0
+DA:196,1
+DA:201,37
+DA:202,1
+DA:205,37
 DA:206,0
 DA:207,0
+DA:208,0
 DA:209,0
-DA:210,0
+DA:211,0
 DA:212,0
-DA:213,0
+DA:214,0
 DA:215,0
 DA:217,0
-DA:218,0
 DA:219,0
-DA:222,37
-DA:223,0
-DA:224,0
+DA:220,0
+DA:221,0
+DA:224,37
 DA:225,0
+DA:226,0
 DA:227,0
-DA:228,0
+DA:229,0
 DA:230,0
 DA:232,0
-LF:119
+DA:234,0
+LF:120
 LH:39
 BRDA:31,0,0,0
 BRDA:31,0,1,0
@@ -1905,10 +1908,10 @@ BRDA:127,14,0,0
 BRDA:127,14,1,0
 BRDA:135,15,0,0
 BRDA:135,15,1,0
-BRDA:206,16,0,0
-BRDA:206,16,1,0
-BRDA:217,17,0,0
-BRDA:217,17,1,0
+BRDA:208,16,0,0
+BRDA:208,16,1,0
+BRDA:219,17,0,0
+BRDA:219,17,1,0
 BRF:37
 BRH:0
 end_of_record
@@ -7086,82 +7089,97 @@ BRH:6
 end_of_record
 TN:
 SF:src/middleware/authorized.js
-FN:13,hasResource
-FN:18,(anonymous_1)
-FN:19,(anonymous_2)
-FN:57,(anonymous_3)
-FNF:4
-FNH:4
-FNDA:7,hasResource
-FNDA:2338,(anonymous_1)
-FNDA:162,(anonymous_2)
-FNDA:1,(anonymous_3)
+FN:14,hasResource
+FN:26,(anonymous_1)
+FN:40,(anonymous_2)
+FN:55,(anonymous_3)
+FN:66,(anonymous_4)
+FN:67,(anonymous_5)
+FNF:6
+FNH:5
+FNDA:155,hasResource
+FNDA:129,(anonymous_1)
+FNDA:3,(anonymous_2)
+FNDA:0,(anonymous_3)
+FNDA:2338,(anonymous_4)
+FNDA:162,(anonymous_5)
 DA:5,24
 DA:9,24
 DA:10,24
 DA:11,24
-DA:14,7
-DA:17,24
-DA:19,2338
-DA:22,162
-DA:23,1
-DA:26,161
-DA:27,1
-DA:32,160
-DA:34,160
-DA:36,160
-DA:37,160
-DA:38,160
-DA:39,125
-DA:40,35
-DA:41,28
-DA:45,7
-DA:46,7
-DA:49,7
-DA:50,7
-DA:51,7
-DA:52,3
-DA:55,7
-DA:56,1
-DA:57,1
-DA:59,1
-DA:60,6
-DA:61,6
-DA:65,4
-DA:66,4
-DA:69,4
-LF:34
-LH:34
-BRDA:18,0,0,1671
-BRDA:22,1,0,1
-BRDA:22,1,1,161
-BRDA:22,2,0,162
-BRDA:22,2,1,161
-BRDA:26,3,0,1
-BRDA:26,3,1,160
-BRDA:36,4,0,160
-BRDA:36,4,1,160
-BRDA:36,4,2,125
-BRDA:38,5,0,125
-BRDA:38,5,1,35
-BRDA:40,6,0,28
-BRDA:40,6,1,7
-BRDA:40,7,0,35
-BRDA:40,7,1,28
-BRDA:45,8,0,7
-BRDA:45,8,1,4
-BRDA:51,9,0,3
-BRDA:51,9,1,4
-BRDA:55,10,0,1
-BRDA:55,10,1,6
-BRDA:59,11,0,1
-BRDA:59,11,1,0
-BRDA:60,12,0,6
-BRDA:60,12,1,0
-BRDA:65,13,0,4
-BRDA:65,13,1,0
-BRF:28
-BRH:25
+DA:12,24
+DA:15,155
+DA:18,24
+DA:26,24
+DA:28,129
+DA:29,129
+DA:30,129
+DA:31,1
+DA:35,128
+DA:36,3
+DA:40,24
+DA:47,3
+DA:48,3
+DA:51,3
+DA:53,3
+DA:55,0
+DA:56,0
+DA:57,0
+DA:60,3
+DA:61,3
+DA:65,24
+DA:67,2338
+DA:70,162
+DA:71,1
+DA:74,161
+DA:75,1
+DA:80,160
+DA:83,160
+DA:84,160
+DA:85,55
+DA:89,160
+DA:90,160
+DA:91,1
+DA:95,159
+DA:96,30
+DA:100,129
+DA:103,129
+LF:41
+LH:38
+BRDA:28,0,0,129
+BRDA:28,0,1,129
+BRDA:28,0,2,125
+BRDA:30,1,0,1
+BRDA:30,1,1,128
+BRDA:30,2,0,129
+BRDA:30,2,1,83
+BRDA:35,3,0,3
+BRDA:35,3,1,125
+BRDA:47,4,0,3
+BRDA:47,4,1,3
+BRDA:53,5,0,0
+BRDA:53,5,1,3
+BRDA:56,6,0,0
+BRDA:56,6,1,0
+BRDA:60,7,0,3
+BRDA:60,7,1,0
+BRDA:66,8,0,1671
+BRDA:70,9,0,1
+BRDA:70,9,1,161
+BRDA:70,10,0,162
+BRDA:70,10,1,161
+BRDA:74,11,0,1
+BRDA:74,11,1,160
+BRDA:84,12,0,55
+BRDA:84,12,1,105
+BRDA:84,13,0,160
+BRDA:84,13,1,155
+BRDA:90,14,0,1
+BRDA:90,14,1,159
+BRDA:95,15,0,30
+BRDA:95,15,1,129
+BRF:32
+BRH:28
 end_of_record
 TN:
 SF:src/middleware/builder.js

package/dist/api/controllers/auth.js

@@ -24,6 +24,8 @@ exports.fetchSelf = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
     const user = yield getFullUser(ctx, userId);
     // this shouldn't be returned by the app self
     delete user.roles;
+    // forward the csrf token from the session
+    user.csrfToken = ctx.user.csrfToken;
     if (appId) {
         const db = new CouchDB(appId);
         // remove the full roles structure
@@ -31,6 +33,8 @@ exports.fetchSelf = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
         try {
             const userTable = yield db.get(InternalTables.USER_METADATA);
             const metadata = yield db.get(userId);
+            // make sure there is never a stale csrf token
+            delete metadata.csrfToken;
             // specifically needs to make sure is enriched
             ctx.body = yield outputProcessing(ctx, userTable, Object.assign(Object.assign({}, user), metadata));
         }

package/dist/api/controllers/user.js

@@ -155,6 +155,8 @@ exports.updateSelfMetadata = function (ctx) {
         ctx.request.body._id = ctx.user._id;
         // make sure no stale rev
         delete ctx.request.body._rev;
+        // make sure no csrf token
+        delete ctx.request.body.csrfToken;
         yield exports.updateMetadata(ctx);
     });
 };

package/dist/middleware/authorized.js

@@ -12,9 +12,49 @@ const { getUserRoleHierarchy, getRequiredResourceRole, BUILTIN_ROLE_IDS, } = req
 const { PermissionTypes, doesHaveBasePermission, } = require("@budibase/backend-core/permissions");
 const builderMiddleware = require("./builder");
 const { isWebhookEndpoint } = require("./utils");
+const { buildCsrfMiddleware } = require("@budibase/backend-core/auth");
 function hasResource(ctx) {
     return ctx.resourceId != null;
 }
+const csrf = buildCsrfMiddleware();
+/**
+ * Apply authorization to the requested resource:
+ * - If this is a builder resource the user must be a builder.
+ * - Builders can access all resources.
+ * - Otherwise the user must have the required role.
+ */
+const checkAuthorized = (ctx, resourceRoles, permType, permLevel) => __awaiter(void 0, void 0, void 0, function* () {
+    // check if this is a builder api and the user is not a builder
+    const isBuilder = ctx.user && ctx.user.builder && ctx.user.builder.global;
+    const isBuilderApi = permType === PermissionTypes.BUILDER;
+    if (isBuilderApi && !isBuilder) {
+        return ctx.throw(403, "Not Authorized");
+    }
+    // check for resource authorization
+    if (!isBuilder) {
+        yield checkAuthorizedResource(ctx, resourceRoles, permType, permLevel);
+    }
+});
+const checkAuthorizedResource = (ctx, resourceRoles, permType, permLevel) => __awaiter(void 0, void 0, void 0, function* () {
+    // get the user's roles
+    const roleId = ctx.roleId || BUILTIN_ROLE_IDS.PUBLIC;
+    const userRoles = yield getUserRoleHierarchy(ctx.appId, roleId, {
+        idOnly: false,
+    });
+    const permError = "User does not have permission";
+    // check if the user has the required role
+    if (resourceRoles.length > 0) {
+        // deny access if the user doesn't have the required resource role
+        const found = userRoles.find(role => resourceRoles.indexOf(role._id) !== -1);
+        if (!found) {
+            ctx.throw(403, permError);
+        }
+        // fallback to the base permissions when no resource roles are found
+    }
+    else if (!doesHaveBasePermission(permType, permLevel, userRoles)) {
+        ctx.throw(403, permError);
+    }
+});
 module.exports =
     (permType, permLevel = null) => (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
         // webhooks don't need authentication, each webhook unique
@@ -28,37 +68,22 @@ module.exports =
         // check general builder stuff, this middleware is a good way
         // to find API endpoints which are builder focused
         yield builderMiddleware(ctx, permType);
-        const isAuthed = ctx.isAuthenticated;
-        // builders for now have permission to do anything
-        let isBuilder = ctx.user && ctx.user.builder && ctx.user.builder.global;
-        const isBuilderApi = permType === PermissionTypes.BUILDER;
-        if (isBuilder) {
-            return next();
-        }
-        else if (isBuilderApi && !isBuilder) {
-            return ctx.throw(403, "Not Authorized");
+        // get the resource roles
+        let resourceRoles = [];
+        if (ctx.appId && hasResource(ctx)) {
+            resourceRoles = yield getRequiredResourceRole(ctx.appId, permLevel, ctx);
         }
-        // need to check this first, in-case public access, don't check authed until last
-        const roleId = ctx.roleId || BUILTIN_ROLE_IDS.PUBLIC;
-        const hierarchy = yield getUserRoleHierarchy(ctx.appId, roleId, {
-            idOnly: false,
-        });
-        const permError = "User does not have permission";
-        let possibleRoleIds = [];
-        if (hasResource(ctx)) {
-            possibleRoleIds = yield getRequiredResourceRole(ctx.appId, permLevel, ctx);
-        }
-        // check if we found a role, if not fallback to base permissions
-        if (possibleRoleIds.length > 0) {
-            const found = hierarchy.find(role => possibleRoleIds.indexOf(role._id) !== -1);
-            return found ? next() : ctx.throw(403, permError);
-        }
-        else if (!doesHaveBasePermission(permType, permLevel, hierarchy)) {
-            ctx.throw(403, permError);
+        // if the resource is public, proceed
+        const isPublicResource = resourceRoles.includes(BUILTIN_ROLE_IDS.PUBLIC);
+        if (isPublicResource) {
+            return next();
         }
-        // if they are not authed, then anything using the authorized middleware will fail
-        if (!isAuthed) {
-            ctx.throw(403, "Session not authenticated");
+        // check authenticated
+        if (!ctx.isAuthenticated) {
+            return ctx.throw(403, "Session not authenticated");
         }
-        return next();
+        // check authorized
+        yield checkAuthorized(ctx, resourceRoles, permType, permLevel);
+        // csrf protection
+        return csrf(ctx, next);
     });