@budibase/server 1.0.48 → 1.0.49-alpha.0

package/dist/api/controllers/application.js

@@ -20,7 +20,7 @@ const { cloneDeep } = require("lodash/fp");
 const { processObject } = require("@budibase/string-templates");
 const { getAllApps, isDevAppID, getDeployedAppID, Replication, } = require("@budibase/backend-core/db");
 const { USERS_TABLE_SCHEMA } = require("../../constants");
-const { getDeployedApps, removeAppFromUserRoles, } = require("../../utilities/workerRequests");
+const { removeAppFromUserRoles } = require("../../utilities/workerRequests");
 const { clientLibraryPath, stringToReadStream } = require("../../utilities");
 const { getAllLocks } = require("../../utilities/redis");
 const { updateClientLibrary, backupClientLibrary, revertClientLibrary, } = require("../../utilities/fileSystem/clientLibrary");
@@ -49,31 +49,44 @@ function getUserRoleId(ctx) {
         ? BUILTIN_ROLE_IDS.PUBLIC
         : ctx.user.role._id;
 }
-function getAppUrlIfNotInUse(ctx) {
+function getAppUrl(ctx) {
     return __awaiter(this, void 0, void 0, function* () {
+        // construct the url
         let url;
         if (ctx.request.body.url) {
+            // if the url is provided, use that
             url = encodeURI(ctx.request.body.url);
         }
         else if (ctx.request.body.name) {
+            // otherwise use the name
             url = encodeURI(`${ctx.request.body.name}`);
         }
         if (url) {
             url = `/${url.replace(URL_REGEX_SLASH, "")}`.toLowerCase();
         }
-        if (!env.SELF_HOSTED) {
-            return url;
-        }
-        const deployedApps = yield getDeployedApps();
-        if (url &&
-            deployedApps[url] != null &&
-            ctx.params != null &&
-            deployedApps[url].appId !== ctx.params.appId) {
-            ctx.throw(400, "App name/URL is already in use.");
-        }
         return url;
     });
 }
+const checkAppUrl = (ctx, apps, url, currentAppId) => {
+    if (currentAppId) {
+        apps = apps.filter(app => app.appId !== currentAppId);
+    }
+    if (apps.some(app => app.url === url)) {
+        ctx.throw(400, "App URL is already in use.");
+    }
+};
+const checkAppName = (ctx, apps, name, currentAppId) => {
+    // TODO: Replace with Joi
+    if (!name) {
+        ctx.throw(400, "Name is required");
+    }
+    if (currentAppId) {
+        apps = apps.filter(app => app.appId !== currentAppId);
+    }
+    if (apps.some(app => app.name === name)) {
+        ctx.throw(400, "App name is already in use.");
+    }
+};
 function createInstance(template) {
     return __awaiter(this, void 0, void 0, function* () {
         const tenantId = isMultiTenant() ? getTenantId() : null;
@@ -167,6 +180,11 @@ exports.fetchAppPackage = (ctx) => __awaiter(void 0, void 0, void 0, function* (
     };
 });
 exports.create = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const apps = yield getAllApps(CouchDB, { dev: true });
+    const name = ctx.request.body.name;
+    checkAppName(ctx, apps, name);
+    const url = yield getAppUrl(ctx);
+    checkAppUrl(ctx, apps, url);
     const { useTemplate, templateKey, templateString } = ctx.request.body;
     const instanceConfig = {
         useTemplate,
@@ -178,7 +196,6 @@ exports.create = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
     }
     const instance = yield createInstance(instanceConfig);
     const appId = instance._id;
-    const url = yield getAppUrlIfNotInUse(ctx);
     const db = new CouchDB(appId);
     let _rev;
     try {
@@ -196,7 +213,7 @@ exports.create = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
         type: "app",
         version: packageJson.version,
         componentLibraries: ["@budibase/standard-components"],
-        name: ctx.request.body.name,
+        name: name,
         url: url,
         template: ctx.request.body.template,
         instance: instance,
@@ -219,8 +236,21 @@ exports.create = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
     ctx.status = 200;
     ctx.body = newApplication;
 });
+// This endpoint currently operates as a PATCH rather than a PUT
+// Thus name and url fields are handled only if present
 exports.update = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
-    const data = yield updateAppPackage(ctx, ctx.request.body, ctx.params.appId);
+    const apps = yield getAllApps(CouchDB, { dev: true });
+    // validation
+    const name = ctx.request.body.name;
+    if (name) {
+        checkAppName(ctx, apps, name, ctx.params.appId);
+    }
+    const url = yield getAppUrl(ctx);
+    if (url) {
+        checkAppUrl(ctx, apps, url, ctx.params.appId);
+        ctx.request.body.url = url;
+    }
+    const data = yield updateAppPackage(ctx.request.body, ctx.params.appId);
     ctx.status = 200;
     ctx.body = data;
 });
@@ -239,7 +269,7 @@ exports.updateClient = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
         version: packageJson.version,
         revertableVersion: currentVersion,
     };
-    const data = yield updateAppPackage(ctx, appPackageUpdates, ctx.params.appId);
+    const data = yield updateAppPackage(appPackageUpdates, ctx.params.appId);
     ctx.status = 200;
     ctx.body = data;
 });
@@ -259,7 +289,7 @@ exports.revertClient = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
         version: application.revertableVersion,
         revertableVersion: null,
     };
-    const data = yield updateAppPackage(ctx, appPackageUpdates, ctx.params.appId);
+    const data = yield updateAppPackage(appPackageUpdates, ctx.params.appId);
     ctx.status = 200;
     ctx.body = data;
 });
@@ -326,11 +356,10 @@ exports.sync = (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
         };
     }
 });
-const updateAppPackage = (ctx, appPackage, appId) => __awaiter(void 0, void 0, void 0, function* () {
-    const url = yield getAppUrlIfNotInUse(ctx);
+const updateAppPackage = (appPackage, appId) => __awaiter(void 0, void 0, void 0, function* () {
     const db = new CouchDB(appId);
     const application = yield db.get(DocumentTypes.APP_METADATA);
-    const newAppPackage = Object.assign(Object.assign(Object.assign({}, application), appPackage), { url });
+    const newAppPackage = Object.assign(Object.assign({}, application), appPackage);
     if (appPackage._rev !== application._rev) {
         newAppPackage._rev = application._rev;
     }

package/dist/api/controllers/auth.js

@@ -24,6 +24,8 @@ exports.fetchSelf = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
     const user = yield getFullUser(ctx, userId);
     // this shouldn't be returned by the app self
     delete user.roles;
+    // forward the csrf token from the session
+    user.csrfToken = ctx.user.csrfToken;
     if (appId) {
         const db = new CouchDB(appId);
         // remove the full roles structure
@@ -31,6 +33,8 @@ exports.fetchSelf = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
         try {
             const userTable = yield db.get(InternalTables.USER_METADATA);
             const metadata = yield db.get(userId);
+            // make sure there is never a stale csrf token
+            delete metadata.csrfToken;
             // specifically needs to make sure is enriched
             ctx.body = yield outputProcessing(ctx, userTable, Object.assign(Object.assign({}, user), metadata));
         }

package/dist/api/controllers/datasource.js

@@ -28,6 +28,12 @@ exports.fetch = function (ctx) {
         const datasources = (yield database.allDocs(getDatasourceParams(null, {
             include_docs: true,
         }))).rows.map(row => row.doc);
+        for (let datasource of datasources) {
+            if (datasource.config && datasource.config.auth) {
+                // strip secrets from response so they don't show in the network request
+                delete datasource.config.auth;
+            }
+        }
         ctx.body = [bbInternalDb, ...datasources];
     });
 };
@@ -78,8 +84,13 @@ exports.update = function (ctx) {
         const db = new CouchDB(ctx.appId);
         const datasourceId = ctx.params.datasourceId;
         let datasource = yield db.get(datasourceId);
+        const auth = datasource.config.auth;
         yield invalidateVariables(datasource, ctx.request.body);
         datasource = Object.assign(Object.assign({}, datasource), ctx.request.body);
+        if (auth && !ctx.request.body.auth) {
+            // don't strip auth config from DB
+            datasource.config.auth = auth;
+        }
         const response = yield db.put(datasource);
         datasource._rev = response.rev;
         // Drain connection pools when configuration is changed

package/dist/api/controllers/row/utils.js

@@ -64,19 +64,17 @@ exports.validate = ({ appId, tableId, row, table }) => __awaiter(void 0, void 0,
         }
         let res;
         // Validate.js doesn't seem to handle array
-        if (type === FieldTypes.ARRAY) {
-            const hasValues = Array.isArray(row[fieldName]) && row[fieldName].length > 0;
-            // Check values are valid if values are specified
-            if (hasValues) {
+        if (type === FieldTypes.ARRAY && row[fieldName]) {
+            if (row[fieldName].length) {
                 row[fieldName].map(val => {
                     if (!constraints.inclusion.includes(val)) {
-                        errors[fieldName] = "Value not in list";
+                        errors[fieldName] = "Field not in list";
                     }
                 });
             }
-            // Check for required constraint
-            if (constraints.presence === true && !hasValues) {
-                errors[fieldName] = "Required field";
+            else if (constraints.presence && row[fieldName].length === 0) {
+                // non required MultiSelect creates an empty array, which should not throw errors
+                errors[fieldName] = [`${fieldName} is required`];
             }
         }
         else if (type === FieldTypes.JSON && typeof row[fieldName] === "string") {

package/dist/api/controllers/static/index.js

@@ -14,7 +14,7 @@ const { resolve, join } = require("../../../utilities/centralPath");
 const uuid = require("uuid");
 const { ObjectStoreBuckets } = require("../../../constants");
 const { processString } = require("@budibase/string-templates");
-const { getDeployedApps } = require("../../../utilities/workerRequests");
+const { getAllApps } = require("@budibase/backend-core/db");
 const CouchDB = require("../../../db");
 const { loadHandlebarsFile, NODE_MODULES_PATH, TOP_LEVEL_PATH, } = require("../../../utilities/fileSystem");
 const env = require("../../../environment");
@@ -22,6 +22,8 @@ const { clientLibraryPath } = require("../../../utilities");
 const { upload } = require("../../../utilities/fileSystem");
 const { attachmentsRelativeURL } = require("../../../utilities");
 const { DocumentTypes } = require("../../../db/utils");
+const AWS = require("aws-sdk");
+const AWS_REGION = env.AWS_REGION ? env.AWS_REGION : "eu-west-1";
 function prepareUpload({ s3Key, bucket, metadata, file }) {
     return __awaiter(this, void 0, void 0, function* () {
         const response = yield upload({
@@ -41,13 +43,15 @@ function prepareUpload({ s3Key, bucket, metadata, file }) {
         };
     });
 }
-function checkForSelfHostedURL(ctx) {
+function getAppIdFromUrl(ctx) {
     return __awaiter(this, void 0, void 0, function* () {
-        // the "appId" component of the URL may actually be a specific self hosted URL
+        // the "appId" component of the URL can be the id or the custom url
         let possibleAppUrl = `/${encodeURI(ctx.params.appId).toLowerCase()}`;
-        const apps = yield getDeployedApps();
-        if (apps[possibleAppUrl] && apps[possibleAppUrl].appId) {
-            return apps[possibleAppUrl].appId;
+        // search prod apps for a url that matches, exclude dev where id is always used
+        const apps = yield getAllApps(CouchDB, { dev: false });
+        const app = apps.filter(a => a.url && a.url.toLowerCase() === possibleAppUrl)[0];
+        if (app && app.appId) {
+            return app.appId;
         }
         else {
             return ctx.params.appId;
@@ -80,10 +84,7 @@ exports.uploadFile = function (ctx) {
 };
 exports.serveApp = function (ctx) {
     return __awaiter(this, void 0, void 0, function* () {
-        let appId = ctx.params.appId;
-        if (env.SELF_HOSTED) {
-            appId = yield checkForSelfHostedURL(ctx);
-        }
+        let appId = yield getAppIdFromUrl(ctx);
         const App = require("./templates/BudibaseApp.svelte").default;
         const db = new CouchDB(appId, { skip_setup: true });
         const appInfo = yield db.get(DocumentTypes.APP_METADATA);
@@ -109,3 +110,51 @@ exports.serveClientLibrary = function (ctx) {
         });
     });
 };
+exports.getSignedUploadURL = function (ctx) {
+    var _a, _b, _c;
+    return __awaiter(this, void 0, void 0, function* () {
+        const database = new CouchDB(ctx.appId);
+        // Ensure datasource is valid
+        let datasource;
+        try {
+            const { datasourceId } = ctx.params;
+            datasource = yield database.get(datasourceId);
+            if (!datasource) {
+                ctx.throw(400, "The specified datasource could not be found");
+            }
+        }
+        catch (error) {
+            ctx.throw(400, "The specified datasource could not be found");
+        }
+        // Ensure we aren't using a custom endpoint
+        if ((_a = datasource === null || datasource === void 0 ? void 0 : datasource.config) === null || _a === void 0 ? void 0 : _a.endpoint) {
+            ctx.throw(400, "S3 datasources with custom endpoints are not supported");
+        }
+        // Determine type of datasource and generate signed URL
+        let signedUrl;
+        let publicUrl;
+        if (datasource.source === "S3") {
+            const { bucket, key } = ctx.request.body || {};
+            if (!bucket || !key) {
+                ctx.throw(400, "bucket and key values are required");
+                return;
+            }
+            try {
+                const s3 = new AWS.S3({
+                    region: AWS_REGION,
+                    accessKeyId: (_b = datasource === null || datasource === void 0 ? void 0 : datasource.config) === null || _b === void 0 ? void 0 : _b.accessKeyId,
+                    secretAccessKey: (_c = datasource === null || datasource === void 0 ? void 0 : datasource.config) === null || _c === void 0 ? void 0 : _c.secretAccessKey,
+                    apiVersion: "2006-03-01",
+                    signatureVersion: "v4",
+                });
+                const params = { Bucket: bucket, Key: key };
+                signedUrl = s3.getSignedUrl("putObject", params);
+                publicUrl = `https://${bucket}.s3.${AWS_REGION}.amazonaws.com/${key}`;
+            }
+            catch (error) {
+                ctx.throw(400, error);
+            }
+        }
+        ctx.body = { signedUrl, publicUrl };
+    });
+};

package/dist/api/controllers/table/index.js

@@ -12,7 +12,7 @@ const CouchDB = require("../../../db");
 const internal = require("./internal");
 const external = require("./external");
 const csvParser = require("../../../utilities/csvParser");
-const { isExternalTable } = require("../../../integrations/utils");
+const { isExternalTable, isSQL } = require("../../../integrations/utils");
 const { getTableParams, getDatasourceParams, BudibaseInternalDB, } = require("../../../db/utils");
 const { getTable } = require("./utils");
 function pickApi({ tableId, table }) {
@@ -34,12 +34,18 @@ exports.fetch = function (ctx) {
         const internalTables = yield db.allDocs(getTableParams(null, {
             include_docs: true,
         }));
-        const internal = internalTables.rows.map(row => (Object.assign(Object.assign({}, row.doc), { type: "internal", sourceId: BudibaseInternalDB._id })));
+        const internal = internalTables.rows.map(tableDoc => (Object.assign(Object.assign({}, tableDoc.doc), { type: "internal", sourceId: BudibaseInternalDB._id })));
         const externalTables = yield db.allDocs(getDatasourceParams("plus", {
             include_docs: true,
         }));
-        const external = externalTables.rows.flatMap(row => {
-            return Object.values(row.doc.entities || {}).map(entity => (Object.assign(Object.assign({}, entity), { type: "external", sourceId: row.doc._id })));
+        const external = externalTables.rows.flatMap(tableDoc => {
+            let entities = tableDoc.doc.entities;
+            if (entities) {
+                return Object.values(entities).map(entity => (Object.assign(Object.assign({}, entity), { type: "external", sourceId: tableDoc.doc._id, sql: isSQL(tableDoc.doc) })));
+            }
+            else {
+                return [];
+            }
         });
         ctx.body = [...internal, ...external];
     });

package/dist/api/controllers/table/internal.js

@@ -24,6 +24,7 @@ const linkRows = require("../../../db/linkedRows");
 const { getRowParams, generateTableID } = require("../../../db/utils");
 const { FieldTypes } = require("../../../constants");
 const { TableSaveFunctions, hasTypeChanged, getTable, handleDataImport, } = require("./utils");
+const usageQuota = require("../../../utilities/usageQuota");
 exports.save = function (ctx) {
     return __awaiter(this, void 0, void 0, function* () {
         const appId = ctx.appId;
@@ -118,6 +119,7 @@ exports.destroy = function (ctx) {
             include_docs: true,
         }));
         yield db.bulkDocs(rows.rows.map(row => (Object.assign(Object.assign({}, row.doc), { _deleted: true }))));
+        yield usageQuota.update(usageQuota.Properties.ROW, -rows.rows.length);
         // update linked rows
         yield linkRows.updateLinks({
             appId,

package/dist/api/controllers/table/utils.js

@@ -15,9 +15,10 @@ const { isEqual } = require("lodash/fp");
 const { AutoFieldSubTypes, FieldTypes } = require("../../../constants");
 const { inputProcessing } = require("../../../utilities/rowProcessor");
 const { USERS_TABLE_SCHEMA, SwitchableTypes, CanSwitchTypes, } = require("../../../constants");
-const { isExternalTable, breakExternalTableId, } = require("../../../integrations/utils");
+const { isExternalTable, breakExternalTableId, isSQL, } = require("../../../integrations/utils");
 const { getViews, saveView } = require("../view/utils");
 const viewTemplate = require("../view/viewBuilder");
+const usageQuota = require("../../../utilities/usageQuota");
 exports.checkForColumnUpdates = (db, oldTable, updatedTable) => __awaiter(void 0, void 0, void 0, function* () {
     let updatedRows = [];
     const rename = updatedTable._rename;
@@ -95,7 +96,11 @@ exports.handleDataImport = (appId, user, table, dataImport) => __awaiter(void 0,
         }
         finalData.push(row);
     }
+    yield usageQuota.update(usageQuota.Properties.ROW, finalData.length, {
+        dryRun: true,
+    });
     yield db.bulkDocs(finalData);
+    yield usageQuota.update(usageQuota.Properties.ROW, finalData.length);
     let response = yield db.put(table);
     table._rev = response._rev;
     return table;
@@ -207,7 +212,9 @@ exports.getTable = (appId, tableId) => __awaiter(void 0, void 0, void 0, functio
     const db = new CouchDB(appId);
     if (isExternalTable(tableId)) {
         let { datasourceId, tableName } = breakExternalTableId(tableId);
-        return exports.getExternalTable(appId, datasourceId, tableName);
+        const datasource = yield db.get(datasourceId);
+        const table = yield exports.getExternalTable(appId, datasourceId, tableName);
+        return Object.assign(Object.assign({}, table), { sql: isSQL(datasource) });
     }
     else {
         return db.get(tableId);

package/dist/api/controllers/user.js

@@ -155,6 +155,8 @@ exports.updateSelfMetadata = function (ctx) {
         ctx.request.body._id = ctx.user._id;
         // make sure no stale rev
         delete ctx.request.body._rev;
+        // make sure no csrf token
+        delete ctx.request.body.csrfToken;
         yield exports.updateMetadata(ctx);
     });
 };

package/dist/api/routes/index.js

@@ -21,7 +21,6 @@ const integrationRoutes = require("./integration");
 const permissionRoutes = require("./permission");
 const datasourceRoutes = require("./datasource");
 const queryRoutes = require("./query");
-const hostingRoutes = require("./hosting");
 const backupRoutes = require("./backup");
 const metadataRoutes = require("./metadata");
 const devRoutes = require("./dev");
@@ -46,7 +45,6 @@ exports.mainRoutes = [
     permissionRoutes,
     datasourceRoutes,
     queryRoutes,
-    hostingRoutes,
     backupRoutes,
     metadataRoutes,
     devRoutes,

package/dist/api/routes/static.js

@@ -43,5 +43,6 @@ router
     .post("/api/attachments/process", authorized(BUILDER), controller.uploadFile)
     .post("/api/attachments/:tableId/upload", paramResource("tableId"), authorized(PermissionTypes.TABLE, PermissionLevels.WRITE), controller.uploadFile)
     // TODO: this likely needs to be secured in some way
-    .get("/:appId/:path*", controller.serveApp);
+    .get("/:appId/:path*", controller.serveApp)
+    .post("/api/attachments/:datasourceId/url", authorized(PermissionTypes.TABLE, PermissionLevels.READ), controller.getSignedUploadURL);
 module.exports = router;

package/dist/automations/steps/createRow.js

@@ -10,7 +10,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 const rowController = require("../../api/controllers/row");
 const automationUtils = require("../automationUtils");
-const env = require("../../environment");
 const usage = require("../../utilities/usageQuota");
 const { buildCtx } = require("./utils");
 exports.definition = {
@@ -87,10 +86,9 @@ exports.run = function ({ inputs, appId, emitter }) {
         });
         try {
             inputs.row = yield automationUtils.cleanUpRow(appId, inputs.row.tableId, inputs.row);
-            if (env.USE_QUOTAS) {
-                yield usage.update(usage.Properties.ROW, 1);
-            }
+            yield usage.update(usage.Properties.ROW, 1, { dryRun: true });
             yield rowController.save(ctx);
+            yield usage.update(usage.Properties.ROW, 1);
             return {
                 row: inputs.row,
                 response: ctx.body,

package/dist/automations/steps/deleteRow.js

@@ -9,7 +9,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 const rowController = require("../../api/controllers/row");
-const env = require("../../environment");
 const usage = require("../../utilities/usageQuota");
 const { buildCtx } = require("./utils");
 const automationUtils = require("../automationUtils");
@@ -81,9 +80,7 @@ exports.run = function ({ inputs, appId, emitter }) {
             },
         });
         try {
-            if (env.isProd()) {
-                yield usage.update(usage.Properties.ROW, -1);
-            }
+            yield usage.update(usage.Properties.ROW, -1);
             yield rowController.destroy(ctx);
             return {
                 response: ctx.body,

package/dist/constants/index.js

@@ -67,6 +67,9 @@ exports.DataSourceOperation = {
     UPDATE_TABLE: "UPDATE_TABLE",
     DELETE_TABLE: "DELETE_TABLE",
 };
+exports.DatasourceAuthTypes = {
+    GOOGLE: "google",
+};
 exports.SortDirection = {
     ASCENDING: "ASCENDING",
     DESCENDING: "DESCENDING",

package/dist/definitions/datasource.js

@@ -49,6 +49,7 @@ var SourceNames;
     SourceNames["ARANGODB"] = "ARANGODB";
     SourceNames["REST"] = "REST";
     SourceNames["ORACLE"] = "ORACLE";
+    SourceNames["GOOGLE_SHEETS"] = "GOOGLE_SHEETS";
 })(SourceNames = exports.SourceNames || (exports.SourceNames = {}));
 var IncludeRelationships;
 (function (IncludeRelationships) {

package/dist/environment.js

@@ -30,6 +30,7 @@ module.exports = {
     MINIO_ACCESS_KEY: process.env.MINIO_ACCESS_KEY,
     MINIO_SECRET_KEY: process.env.MINIO_SECRET_KEY,
     USE_QUOTAS: process.env.USE_QUOTAS,
+    EXCLUDE_QUOTAS_TENANTS: process.env.EXCLUDE_QUOTAS_TENANTS,
     REDIS_URL: process.env.REDIS_URL,
     REDIS_PASSWORD: process.env.REDIS_PASSWORD,
     INTERNAL_API_KEY: process.env.INTERNAL_API_KEY,

package/dist/integrations/base/sql.js

@@ -69,10 +69,16 @@ class InternalBuilder {
         this.client = client;
     }
     // right now we only do filters on the specific table being queried
-    addFilters(tableName, query, filters) {
+    addFilters(query, filters, opts) {
         function iterate(structure, fn) {
             for (let [key, value] of Object.entries(structure)) {
-                fn(`${tableName}.${key}`, value);
+                const isRelationshipField = key.includes(".");
+                if (!opts.relationship && !isRelationshipField) {
+                    fn(`${opts.tableName}.${key}`, value);
+                }
+                if (opts.relationship && isRelationshipField) {
+                    fn(key, value);
+                }
             }
         }
         if (!filters) {
@@ -248,7 +254,7 @@ class InternalBuilder {
         if (foundOffset) {
             query = query.offset(foundOffset);
         }
-        query = this.addFilters(tableName, query, filters);
+        query = this.addFilters(query, filters, { tableName });
         // add sorting to pre-query
         query = this.addSorting(query, json);
         // @ts-ignore
@@ -261,13 +267,14 @@ class InternalBuilder {
             preQuery = this.addSorting(preQuery, json);
         }
         // handle joins
-        return this.addRelationships(knex, preQuery, selectStatement, tableName, relationships);
+        query = this.addRelationships(knex, preQuery, selectStatement, tableName, relationships);
+        return this.addFilters(query, filters, { relationship: true });
     }
     update(knex, json, opts) {
         const { endpoint, body, filters } = json;
         let query = knex(endpoint.entityId);
         const parsedBody = parseBody(body);
-        query = this.addFilters(endpoint.entityId, query, filters);
+        query = this.addFilters(query, filters, { tableName: endpoint.entityId });
         // mysql can't use returning
         if (opts.disableReturning) {
             return query.update(parsedBody);
@@ -279,7 +286,7 @@ class InternalBuilder {
     delete(knex, json, opts) {
         const { endpoint, filters } = json;
         let query = knex(endpoint.entityId);
-        query = this.addFilters(endpoint.entityId, query, filters);
+        query = this.addFilters(query, filters, { tableName: endpoint.entityId });
         // mysql can't use returning
         if (opts.disableReturning) {
             return query.delete();