@budibase/server 1.0.48 → 1.0.49-alpha.0

package/dist/utilities/{usageQuota.js → usageQuota/index.js}

@@ -8,12 +8,24 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-const env = require("../environment");
-const { getGlobalDB } = require("@budibase/backend-core/tenancy");
+const env = require("../../environment");
+const { getGlobalDB, getTenantId } = require("@budibase/backend-core/tenancy");
 const { StaticDatabases, generateNewUsageQuotaDoc, } = require("@budibase/backend-core/db");
-function getNewQuotaReset() {
-    return Date.now() + 2592000000;
-}
+exports.useQuotas = () => {
+    // check if quotas are enabled
+    if (env.USE_QUOTAS) {
+        // check if there are any tenants without limits
+        if (env.EXCLUDE_QUOTAS_TENANTS) {
+            const excludedTenants = env.EXCLUDE_QUOTAS_TENANTS.replace(/\s/g, "").split(",");
+            const tenantId = getTenantId();
+            if (excludedTenants.includes(tenantId)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    return false;
+};
 exports.Properties = {
     ROW: "rows",
     UPLOAD: "storage",
@@ -21,21 +33,21 @@ exports.Properties = {
     USER: "users",
     AUTOMATION: "automationRuns",
     APPS: "apps",
-    EMAILS: "emails",
+    EMAILS: "emails", // doesn't work yet
 };
-function getUsageQuotaDoc(db) {
-    return __awaiter(this, void 0, void 0, function* () {
-        let quota;
-        try {
-            quota = yield db.get(StaticDatabases.PLATFORM_INFO.docs.usageQuota);
-        }
-        catch (err) {
-            // doc doesn't exist. Create it
-            quota = yield db.post(generateNewUsageQuotaDoc());
-        }
-        return quota;
-    });
-}
+exports.getUsageQuotaDoc = (db) => __awaiter(void 0, void 0, void 0, function* () {
+    let quota;
+    try {
+        quota = yield db.get(StaticDatabases.GLOBAL.docs.usageQuota);
+    }
+    catch (err) {
+        // doc doesn't exist. Create it
+        quota = generateNewUsageQuotaDoc();
+        const response = yield db.put(quota);
+        quota._rev = response.rev;
+    }
+    return quota;
+});
 /**
  * Given a specified tenantId this will add to the usage object for the specified property.
  * @param {string} property The property which is to be added to (within the nested usageQuota object).
@@ -43,27 +55,28 @@ function getUsageQuotaDoc(db) {
  * @returns {Promise<void>} When this completes the API key will now be up to date - the quota period may have
  * also been reset after this call.
  */
-exports.update = (property, usage) => __awaiter(void 0, void 0, void 0, function* () {
-    if (!env.USE_QUOTAS) {
+exports.update = (property, usage, opts = { dryRun: false }) => __awaiter(void 0, void 0, void 0, function* () {
+    if (!exports.useQuotas()) {
         return;
     }
     try {
         const db = getGlobalDB();
-        const quota = yield getUsageQuotaDoc(db);
-        // Check if the quota needs reset
-        if (Date.now() >= quota.quotaReset) {
-            quota.quotaReset = getNewQuotaReset();
-            for (let prop of Object.keys(quota.usageQuota)) {
-                quota.usageQuota[prop] = 0;
-            }
-        }
+        const quota = yield exports.getUsageQuotaDoc(db);
         // increment the quota
         quota.usageQuota[property] += usage;
-        if (quota.usageQuota[property] > quota.usageLimits[property]) {
+        if (quota.usageQuota[property] > quota.usageLimits[property] &&
+            usage > 0 // allow for decrementing usage when the quota is already exceeded
+        ) {
             throw new Error(`You have exceeded your usage quota of ${quota.usageLimits[property]} ${property}.`);
         }
+        if (quota.usageQuota[property] < 0) {
+            // never go negative if the quota has previously been exceeded
+            quota.usageQuota[property] = 0;
+        }
         // update the usage quotas
-        yield db.put(quota);
+        if (!opts.dryRun) {
+            yield db.put(quota);
+        }
     }
     catch (err) {
         console.error(`Error updating usage quotas for ${property}`, err);

package/dist/utilities/usageQuota/rows.js

@@ -0,0 +1,77 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+const { getRowParams, USER_METDATA_PREFIX } = require("../../db/utils");
+const CouchDB = require("../../db");
+const { isDevAppID, getDevelopmentAppID } = require("@budibase/backend-core/db");
+const ROW_EXCLUSIONS = [USER_METDATA_PREFIX];
+const getAppPairs = appIds => {
+    // collect the app ids into dev / prod pairs
+    // keyed by the dev app id
+    const pairs = {};
+    for (let appId of appIds) {
+        const devId = getDevelopmentAppID(appId);
+        if (!pairs[devId]) {
+            pairs[devId] = {};
+        }
+        if (isDevAppID(appId)) {
+            pairs[devId].devId = appId;
+        }
+        else {
+            pairs[devId].prodId = appId;
+        }
+    }
+    return pairs;
+};
+const getAppRows = (appId) => __awaiter(void 0, void 0, void 0, function* () {
+    const appDb = new CouchDB(appId);
+    const response = yield appDb.allDocs(getRowParams(null, null, {
+        include_docs: false,
+    }));
+    return response.rows
+        .map(r => r.id)
+        .filter(id => {
+        for (let exclusion of ROW_EXCLUSIONS) {
+            if (id.startsWith(exclusion)) {
+                return false;
+            }
+        }
+        return true;
+    });
+});
+/**
+ * Return a set of all rows in the given app ids.
+ * The returned rows will be unique on a per dev/prod app basis.
+ * Rows duplicates may exist across apps due to data import so they are not filtered out.
+ */
+exports.getUniqueRows = (appIds) => __awaiter(void 0, void 0, void 0, function* () {
+    let uniqueRows = [];
+    const pairs = getAppPairs(appIds);
+    for (let pair of Object.values(pairs)) {
+        let appRows = [];
+        for (let appId of [pair.devId, pair.prodId]) {
+            if (!appId) {
+                continue;
+            }
+            try {
+                appRows.push(yield getAppRows(appId));
+            }
+            catch (e) {
+                console.error(e);
+                // don't error out if we can't count the app rows, just continue
+            }
+        }
+        // ensure uniqueness on a per app pair basis
+        // this can't be done on all rows because app import results in
+        // duplicate row ids across apps
+        uniqueRows = uniqueRows.concat(...new Set(appRows));
+    }
+    return uniqueRows;
+});

package/dist/utilities/usageQuota/usageQuoteReset.js

@@ -0,0 +1,16 @@
+"use strict";
+// UNUSED CODE
+// Preserved for future use
+/* eslint-disable no-unused-vars */
+function getNewQuotaReset() {
+    return Date.now() + 2592000000;
+}
+function resetQuotasIfRequired(quota) {
+    // Check if the quota needs reset
+    if (Date.now() >= quota.quotaReset) {
+        quota.quotaReset = getNewQuotaReset();
+        for (let prop of Object.keys(quota.usageQuota)) {
+            quota.usageQuota[prop] = 0;
+        }
+    }
+}

package/dist/utilities/workerRequests.js

@@ -61,26 +61,6 @@ exports.sendSmtpEmail = (to, from, subject, contents, automation) => __awaiter(v
     }
     return response.json();
 });
-exports.getDeployedApps = () => __awaiter(void 0, void 0, void 0, function* () {
-    try {
-        const response = yield fetch(checkSlashesInUrl(env.WORKER_URL + `/api/apps`), request(null, {
-            method: "GET",
-        }));
-        const json = yield response.json();
-        const apps = {};
-        for (let [key, value] of Object.entries(json)) {
-            if (value.url) {
-                value.url = value.url.toLowerCase();
-                apps[key.toLowerCase()] = value;
-            }
-        }
-        return apps;
-    }
-    catch (err) {
-        // error, cannot determine deployed apps, don't stop app creation - sort this later
-        return {};
-    }
-});
 exports.getGlobalSelf = (ctx, appId = null) => __awaiter(void 0, void 0, void 0, function* () {
     const endpoint = `/api/global/users/self`;
     const response = yield fetch(checkSlashesInUrl(env.WORKER_URL + endpoint), 

package/nodemon.json

@@ -1,5 +1,5 @@
 {
-  "watch": ["src", "../auth"],
+  "watch": ["src", "../backend-core"],
   "ext": "js,ts,json",
   "ignore": ["src/**/*.spec.ts", "src/**/*.spec.js"],
   "exec": "ts-node src/index.ts"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/server",
   "email": "hi@budibase.com",
-  "version": "1.0.48",
+  "version": "1.0.49-alpha.0",
   "description": "Budibase Web Server",
   "main": "src/index.ts",
   "repository": {
@@ -70,9 +70,9 @@
   "license": "GPL-3.0",
   "dependencies": {
     "@apidevtools/swagger-parser": "^10.0.3",
-    "@budibase/backend-core": "^1.0.48",
-    "@budibase/client": "^1.0.48",
-    "@budibase/string-templates": "^1.0.48",
+    "@budibase/backend-core": "^1.0.49-alpha.0",
+    "@budibase/client": "^1.0.49-alpha.0",
+    "@budibase/string-templates": "^1.0.49-alpha.0",
     "@bull-board/api": "^3.7.0",
     "@bull-board/koa": "^3.7.0",
     "@elastic/elasticsearch": "7.10.0",
@@ -92,6 +92,8 @@
     "fix-path": "3.0.0",
     "form-data": "^4.0.0",
     "fs-extra": "8.1.0",
+    "google-auth-library": "^7.11.0",
+    "google-spreadsheet": "^3.2.0",
     "jimp": "0.16.1",
     "joi": "17.2.1",
     "js-yaml": "^4.1.0",
@@ -110,7 +112,7 @@
     "mongodb": "3.6.3",
     "mssql": "6.2.3",
     "mysql2": "^2.3.1",
-    "node-fetch": "2.6.0",
+    "node-fetch": "2.6.7",
     "open": "^8.4.0",
     "pg": "8.5.1",
     "pino-pretty": "4.0.0",
@@ -139,6 +141,7 @@
     "@jest/test-sequencer": "^24.8.0",
     "@types/apidoc": "^0.50.0",
     "@types/bull": "^3.15.1",
+    "@types/google-spreadsheet": "^3.1.5",
     "@types/jest": "^26.0.23",
     "@types/koa": "^2.13.3",
     "@types/koa-router": "^7.4.2",
@@ -165,5 +168,5 @@
   "optionalDependencies": {
     "oracledb": "^5.3.0"
   },
-  "gitHead": "a5f51d83ba37e2361daf4ff579bb039a2247dd5e"
+  "gitHead": "27d295ae310158a0a240fe62c45362ad03f82115"
 }

package/src/api/controllers/application.js

@@ -33,10 +33,7 @@ const {
   Replication,
 } = require("@budibase/backend-core/db")
 const { USERS_TABLE_SCHEMA } = require("../../constants")
-const {
-  getDeployedApps,
-  removeAppFromUserRoles,
-} = require("../../utilities/workerRequests")
+const { removeAppFromUserRoles } = require("../../utilities/workerRequests")
 const { clientLibraryPath, stringToReadStream } = require("../../utilities")
 const { getAllLocks } = require("../../utilities/redis")
 const {
@@ -78,29 +75,42 @@ function getUserRoleId(ctx) {
     : ctx.user.role._id
 }
 
-async function getAppUrlIfNotInUse(ctx) {
+async function getAppUrl(ctx) {
+  // construct the url
   let url
   if (ctx.request.body.url) {
+    // if the url is provided, use that
     url = encodeURI(ctx.request.body.url)
   } else if (ctx.request.body.name) {
+    // otherwise use the name
     url = encodeURI(`${ctx.request.body.name}`)
   }
   if (url) {
     url = `/${url.replace(URL_REGEX_SLASH, "")}`.toLowerCase()
   }
-  if (!env.SELF_HOSTED) {
-    return url
+  return url
+}
+
+const checkAppUrl = (ctx, apps, url, currentAppId) => {
+  if (currentAppId) {
+    apps = apps.filter(app => app.appId !== currentAppId)
   }
-  const deployedApps = await getDeployedApps()
-  if (
-    url &&
-    deployedApps[url] != null &&
-    ctx.params != null &&
-    deployedApps[url].appId !== ctx.params.appId
-  ) {
-    ctx.throw(400, "App name/URL is already in use.")
+  if (apps.some(app => app.url === url)) {
+    ctx.throw(400, "App URL is already in use.")
+  }
+}
+
+const checkAppName = (ctx, apps, name, currentAppId) => {
+  // TODO: Replace with Joi
+  if (!name) {
+    ctx.throw(400, "Name is required")
+  }
+  if (currentAppId) {
+    apps = apps.filter(app => app.appId !== currentAppId)
+  }
+  if (apps.some(app => app.name === name)) {
+    ctx.throw(400, "App name is already in use.")
   }
-  return url
 }
 
 async function createInstance(template) {
@@ -206,6 +216,12 @@ exports.fetchAppPackage = async ctx => {
 }
 
 exports.create = async ctx => {
+  const apps = await getAllApps(CouchDB, { dev: true })
+  const name = ctx.request.body.name
+  checkAppName(ctx, apps, name)
+  const url = await getAppUrl(ctx)
+  checkAppUrl(ctx, apps, url)
+
   const { useTemplate, templateKey, templateString } = ctx.request.body
   const instanceConfig = {
     useTemplate,
@@ -218,7 +234,6 @@ exports.create = async ctx => {
   const instance = await createInstance(instanceConfig)
   const appId = instance._id
 
-  const url = await getAppUrlIfNotInUse(ctx)
   const db = new CouchDB(appId)
   let _rev
   try {
@@ -235,7 +250,7 @@ exports.create = async ctx => {
     type: "app",
     version: packageJson.version,
     componentLibraries: ["@budibase/standard-components"],
-    name: ctx.request.body.name,
+    name: name,
     url: url,
     template: ctx.request.body.template,
     instance: instance,
@@ -262,8 +277,22 @@ exports.create = async ctx => {
   ctx.body = newApplication
 }
 
+// This endpoint currently operates as a PATCH rather than a PUT
+// Thus name and url fields are handled only if present
 exports.update = async ctx => {
-  const data = await updateAppPackage(ctx, ctx.request.body, ctx.params.appId)
+  const apps = await getAllApps(CouchDB, { dev: true })
+  // validation
+  const name = ctx.request.body.name
+  if (name) {
+    checkAppName(ctx, apps, name, ctx.params.appId)
+  }
+  const url = await getAppUrl(ctx)
+  if (url) {
+    checkAppUrl(ctx, apps, url, ctx.params.appId)
+    ctx.request.body.url = url
+  }
+
+  const data = await updateAppPackage(ctx.request.body, ctx.params.appId)
   ctx.status = 200
   ctx.body = data
 }
@@ -285,7 +314,7 @@ exports.updateClient = async ctx => {
     version: packageJson.version,
     revertableVersion: currentVersion,
   }
-  const data = await updateAppPackage(ctx, appPackageUpdates, ctx.params.appId)
+  const data = await updateAppPackage(appPackageUpdates, ctx.params.appId)
   ctx.status = 200
   ctx.body = data
 }
@@ -308,7 +337,7 @@ exports.revertClient = async ctx => {
     version: application.revertableVersion,
     revertableVersion: null,
   }
-  const data = await updateAppPackage(ctx, appPackageUpdates, ctx.params.appId)
+  const data = await updateAppPackage(appPackageUpdates, ctx.params.appId)
   ctx.status = 200
   ctx.body = data
 }
@@ -381,12 +410,11 @@ exports.sync = async (ctx, next) => {
   }
 }
 
-const updateAppPackage = async (ctx, appPackage, appId) => {
-  const url = await getAppUrlIfNotInUse(ctx)
+const updateAppPackage = async (appPackage, appId) => {
   const db = new CouchDB(appId)
   const application = await db.get(DocumentTypes.APP_METADATA)
 
-  const newAppPackage = { ...application, ...appPackage, url }
+  const newAppPackage = { ...application, ...appPackage }
   if (appPackage._rev !== application._rev) {
     newAppPackage._rev = application._rev
   }

package/src/api/controllers/auth.js

@@ -16,6 +16,8 @@ exports.fetchSelf = async ctx => {
   const user = await getFullUser(ctx, userId)
   // this shouldn't be returned by the app self
   delete user.roles
+  // forward the csrf token from the session
+  user.csrfToken = ctx.user.csrfToken
 
   if (appId) {
     const db = new CouchDB(appId)
@@ -24,6 +26,8 @@ exports.fetchSelf = async ctx => {
     try {
       const userTable = await db.get(InternalTables.USER_METADATA)
       const metadata = await db.get(userId)
+      // make sure there is never a stale csrf token
+      delete metadata.csrfToken
       // specifically needs to make sure is enriched
       ctx.body = await outputProcessing(ctx, userTable, {
         ...user,

package/src/api/controllers/datasource.js

@@ -38,6 +38,13 @@ exports.fetch = async function (ctx) {
     )
   ).rows.map(row => row.doc)
 
+  for (let datasource of datasources) {
+    if (datasource.config && datasource.config.auth) {
+      // strip secrets from response so they don't show in the network request
+      delete datasource.config.auth
+    }
+  }
+
   ctx.body = [bbInternalDb, ...datasources]
 }
 
@@ -94,8 +101,13 @@ exports.update = async function (ctx) {
   const db = new CouchDB(ctx.appId)
   const datasourceId = ctx.params.datasourceId
   let datasource = await db.get(datasourceId)
+  const auth = datasource.config.auth
   await invalidateVariables(datasource, ctx.request.body)
   datasource = { ...datasource, ...ctx.request.body }
+  if (auth && !ctx.request.body.auth) {
+    // don't strip auth config from DB
+    datasource.config.auth = auth
+  }
 
   const response = await db.put(datasource)
   datasource._rev = response.rev

package/src/api/controllers/row/utils.js

@@ -58,22 +58,16 @@ exports.validate = async ({ appId, tableId, row, table }) => {
     let res
 
     // Validate.js doesn't seem to handle array
-    if (type === FieldTypes.ARRAY) {
-      const hasValues =
-        Array.isArray(row[fieldName]) && row[fieldName].length > 0
-
-      // Check values are valid if values are specified
-      if (hasValues) {
+    if (type === FieldTypes.ARRAY && row[fieldName]) {
+      if (row[fieldName].length) {
         row[fieldName].map(val => {
           if (!constraints.inclusion.includes(val)) {
-            errors[fieldName] = "Value not in list"
+            errors[fieldName] = "Field not in list"
           }
         })
-      }
-
-      // Check for required constraint
-      if (constraints.presence === true && !hasValues) {
-        errors[fieldName] = "Required field"
+      } else if (constraints.presence && row[fieldName].length === 0) {
+        // non required MultiSelect creates an empty array, which should not throw errors
+        errors[fieldName] = [`${fieldName} is required`]
       }
     } else if (type === FieldTypes.JSON && typeof row[fieldName] === "string") {
       // this should only happen if there is an error

package/src/api/controllers/static/index.js

@@ -5,7 +5,7 @@ const { resolve, join } = require("../../../utilities/centralPath")
 const uuid = require("uuid")
 const { ObjectStoreBuckets } = require("../../../constants")
 const { processString } = require("@budibase/string-templates")
-const { getDeployedApps } = require("../../../utilities/workerRequests")
+const { getAllApps } = require("@budibase/backend-core/db")
 const CouchDB = require("../../../db")
 const {
   loadHandlebarsFile,
@@ -17,6 +17,8 @@ const { clientLibraryPath } = require("../../../utilities")
 const { upload } = require("../../../utilities/fileSystem")
 const { attachmentsRelativeURL } = require("../../../utilities")
 const { DocumentTypes } = require("../../../db/utils")
+const AWS = require("aws-sdk")
+const AWS_REGION = env.AWS_REGION ? env.AWS_REGION : "eu-west-1"
 
 async function prepareUpload({ s3Key, bucket, metadata, file }) {
   const response = await upload({
@@ -37,12 +39,18 @@ async function prepareUpload({ s3Key, bucket, metadata, file }) {
   }
 }
 
-async function checkForSelfHostedURL(ctx) {
-  // the "appId" component of the URL may actually be a specific self hosted URL
+async function getAppIdFromUrl(ctx) {
+  // the "appId" component of the URL can be the id or the custom url
   let possibleAppUrl = `/${encodeURI(ctx.params.appId).toLowerCase()}`
-  const apps = await getDeployedApps()
-  if (apps[possibleAppUrl] && apps[possibleAppUrl].appId) {
-    return apps[possibleAppUrl].appId
+
+  // search prod apps for a url that matches, exclude dev where id is always used
+  const apps = await getAllApps(CouchDB, { dev: false })
+  const app = apps.filter(
+    a => a.url && a.url.toLowerCase() === possibleAppUrl
+  )[0]
+
+  if (app && app.appId) {
+    return app.appId
   } else {
     return ctx.params.appId
   }
@@ -75,10 +83,7 @@ exports.uploadFile = async function (ctx) {
 }
 
 exports.serveApp = async function (ctx) {
-  let appId = ctx.params.appId
-  if (env.SELF_HOSTED) {
-    appId = await checkForSelfHostedURL(ctx)
-  }
+  let appId = await getAppIdFromUrl(ctx)
   const App = require("./templates/BudibaseApp.svelte").default
   const db = new CouchDB(appId, { skip_setup: true })
   const appInfo = await db.get(DocumentTypes.APP_METADATA)
@@ -104,3 +109,51 @@ exports.serveClientLibrary = async function (ctx) {
     root: join(NODE_MODULES_PATH, "@budibase", "client", "dist"),
   })
 }
+
+exports.getSignedUploadURL = async function (ctx) {
+  const database = new CouchDB(ctx.appId)
+
+  // Ensure datasource is valid
+  let datasource
+  try {
+    const { datasourceId } = ctx.params
+    datasource = await database.get(datasourceId)
+    if (!datasource) {
+      ctx.throw(400, "The specified datasource could not be found")
+    }
+  } catch (error) {
+    ctx.throw(400, "The specified datasource could not be found")
+  }
+
+  // Ensure we aren't using a custom endpoint
+  if (datasource?.config?.endpoint) {
+    ctx.throw(400, "S3 datasources with custom endpoints are not supported")
+  }
+
+  // Determine type of datasource and generate signed URL
+  let signedUrl
+  let publicUrl
+  if (datasource.source === "S3") {
+    const { bucket, key } = ctx.request.body || {}
+    if (!bucket || !key) {
+      ctx.throw(400, "bucket and key values are required")
+      return
+    }
+    try {
+      const s3 = new AWS.S3({
+        region: AWS_REGION,
+        accessKeyId: datasource?.config?.accessKeyId,
+        secretAccessKey: datasource?.config?.secretAccessKey,
+        apiVersion: "2006-03-01",
+        signatureVersion: "v4",
+      })
+      const params = { Bucket: bucket, Key: key }
+      signedUrl = s3.getSignedUrl("putObject", params)
+      publicUrl = `https://${bucket}.s3.${AWS_REGION}.amazonaws.com/${key}`
+    } catch (error) {
+      ctx.throw(400, error)
+    }
+  }
+
+  ctx.body = { signedUrl, publicUrl }
+}

package/src/api/controllers/table/index.js

@@ -2,7 +2,7 @@ const CouchDB = require("../../../db")
 const internal = require("./internal")
 const external = require("./external")
 const csvParser = require("../../../utilities/csvParser")
-const { isExternalTable } = require("../../../integrations/utils")
+const { isExternalTable, isSQL } = require("../../../integrations/utils")
 const {
   getTableParams,
   getDatasourceParams,
@@ -32,8 +32,8 @@ exports.fetch = async function (ctx) {
     })
   )
 
-  const internal = internalTables.rows.map(row => ({
-    ...row.doc,
+  const internal = internalTables.rows.map(tableDoc => ({
+    ...tableDoc.doc,
     type: "internal",
     sourceId: BudibaseInternalDB._id,
   }))
@@ -44,12 +44,18 @@ exports.fetch = async function (ctx) {
     })
   )
 
-  const external = externalTables.rows.flatMap(row => {
-    return Object.values(row.doc.entities || {}).map(entity => ({
-      ...entity,
-      type: "external",
-      sourceId: row.doc._id,
-    }))
+  const external = externalTables.rows.flatMap(tableDoc => {
+    let entities = tableDoc.doc.entities
+    if (entities) {
+      return Object.values(entities).map(entity => ({
+        ...entity,
+        type: "external",
+        sourceId: tableDoc.doc._id,
+        sql: isSQL(tableDoc.doc),
+      }))
+    } else {
+      return []
+    }
   })
 
   ctx.body = [...internal, ...external]