@budibase/server 1.0.48 → 1.0.49-alpha.3

package/dist/middleware/authorized.js

@@ -12,9 +12,49 @@ const { getUserRoleHierarchy, getRequiredResourceRole, BUILTIN_ROLE_IDS, } = req
 const { PermissionTypes, doesHaveBasePermission, } = require("@budibase/backend-core/permissions");
 const builderMiddleware = require("./builder");
 const { isWebhookEndpoint } = require("./utils");
+const { buildCsrfMiddleware } = require("@budibase/backend-core/auth");
 function hasResource(ctx) {
     return ctx.resourceId != null;
 }
+const csrf = buildCsrfMiddleware();
+/**
+ * Apply authorization to the requested resource:
+ * - If this is a builder resource the user must be a builder.
+ * - Builders can access all resources.
+ * - Otherwise the user must have the required role.
+ */
+const checkAuthorized = (ctx, resourceRoles, permType, permLevel) => __awaiter(void 0, void 0, void 0, function* () {
+    // check if this is a builder api and the user is not a builder
+    const isBuilder = ctx.user && ctx.user.builder && ctx.user.builder.global;
+    const isBuilderApi = permType === PermissionTypes.BUILDER;
+    if (isBuilderApi && !isBuilder) {
+        return ctx.throw(403, "Not Authorized");
+    }
+    // check for resource authorization
+    if (!isBuilder) {
+        yield checkAuthorizedResource(ctx, resourceRoles, permType, permLevel);
+    }
+});
+const checkAuthorizedResource = (ctx, resourceRoles, permType, permLevel) => __awaiter(void 0, void 0, void 0, function* () {
+    // get the user's roles
+    const roleId = ctx.roleId || BUILTIN_ROLE_IDS.PUBLIC;
+    const userRoles = yield getUserRoleHierarchy(ctx.appId, roleId, {
+        idOnly: false,
+    });
+    const permError = "User does not have permission";
+    // check if the user has the required role
+    if (resourceRoles.length > 0) {
+        // deny access if the user doesn't have the required resource role
+        const found = userRoles.find(role => resourceRoles.indexOf(role._id) !== -1);
+        if (!found) {
+            ctx.throw(403, permError);
+        }
+        // fallback to the base permissions when no resource roles are found
+    }
+    else if (!doesHaveBasePermission(permType, permLevel, userRoles)) {
+        ctx.throw(403, permError);
+    }
+});
 module.exports =
     (permType, permLevel = null) => (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
         // webhooks don't need authentication, each webhook unique
@@ -28,37 +68,22 @@ module.exports =
         // check general builder stuff, this middleware is a good way
         // to find API endpoints which are builder focused
         yield builderMiddleware(ctx, permType);
-        const isAuthed = ctx.isAuthenticated;
-        // builders for now have permission to do anything
-        let isBuilder = ctx.user && ctx.user.builder && ctx.user.builder.global;
-        const isBuilderApi = permType === PermissionTypes.BUILDER;
-        if (isBuilder) {
-            return next();
-        }
-        else if (isBuilderApi && !isBuilder) {
-            return ctx.throw(403, "Not Authorized");
+        // get the resource roles
+        let resourceRoles = [];
+        if (ctx.appId && hasResource(ctx)) {
+            resourceRoles = yield getRequiredResourceRole(ctx.appId, permLevel, ctx);
         }
-        // need to check this first, in-case public access, don't check authed until last
-        const roleId = ctx.roleId || BUILTIN_ROLE_IDS.PUBLIC;
-        const hierarchy = yield getUserRoleHierarchy(ctx.appId, roleId, {
-            idOnly: false,
-        });
-        const permError = "User does not have permission";
-        let possibleRoleIds = [];
-        if (hasResource(ctx)) {
-            possibleRoleIds = yield getRequiredResourceRole(ctx.appId, permLevel, ctx);
-        }
-        // check if we found a role, if not fallback to base permissions
-        if (possibleRoleIds.length > 0) {
-            const found = hierarchy.find(role => possibleRoleIds.indexOf(role._id) !== -1);
-            return found ? next() : ctx.throw(403, permError);
-        }
-        else if (!doesHaveBasePermission(permType, permLevel, hierarchy)) {
-            ctx.throw(403, permError);
+        // if the resource is public, proceed
+        const isPublicResource = resourceRoles.includes(BUILTIN_ROLE_IDS.PUBLIC);
+        if (isPublicResource) {
+            return next();
         }
-        // if they are not authed, then anything using the authorized middleware will fail
-        if (!isAuthed) {
-            ctx.throw(403, "Session not authenticated");
+        // check authenticated
+        if (!ctx.isAuthenticated) {
+            return ctx.throw(403, "Session not authenticated");
         }
-        return next();
+        // check authorized
+        yield checkAuthorized(ctx, resourceRoles, permType, permLevel);
+        // csrf protection
+        return csrf(ctx, next);
     });

package/dist/middleware/usageQuota.js

@@ -10,11 +10,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 const CouchDB = require("../db");
 const usageQuota = require("../utilities/usageQuota");
-const env = require("../environment");
-const { getTenantId } = require("@budibase/backend-core/tenancy");
+const { getUniqueRows } = require("../utilities/usageQuota/rows");
 const { isExternalTable, isRowId: isExternalRowId, } = require("../integrations/utils");
-// tenants without limits
-const EXCLUDED_TENANTS = ["bb", "default", "bbtest", "bbstaging"];
 // currently only counting new writes and deletes
 const METHOD_MAP = {
     POST: 1,
@@ -22,13 +19,13 @@ const METHOD_MAP = {
 };
 const DOMAIN_MAP = {
     rows: usageQuota.Properties.ROW,
-    upload: usageQuota.Properties.UPLOAD,
-    views: usageQuota.Properties.VIEW,
-    users: usageQuota.Properties.USER,
+    // upload: usageQuota.Properties.UPLOAD,            // doesn't work yet
+    // views: usageQuota.Properties.VIEW,               // doesn't work yet
+    // users: usageQuota.Properties.USER,               // doesn't work yet
     applications: usageQuota.Properties.APPS,
     // this will not be updated by endpoint calls
     // instead it will be updated by triggerInfo
-    automationRuns: usageQuota.Properties.AUTOMATION,
+    // automationRuns: usageQuota.Properties.AUTOMATION, // doesn't work yet
 };
 function getProperty(url) {
     for (let domain of Object.keys(DOMAIN_MAP)) {
@@ -38,9 +35,7 @@ function getProperty(url) {
     }
 }
 module.exports = (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
-    const tenantId = getTenantId();
-    // if in development or a self hosted cloud usage quotas should not be executed
-    if (env.isDev() || env.SELF_HOSTED || EXCLUDED_TENANTS.includes(tenantId)) {
+    if (!usageQuota.useQuotas()) {
         return next();
     }
     let usage = METHOD_MAP[ctx.req.method];
@@ -78,10 +73,82 @@ module.exports = (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
         usage = files.map(file => file.size).reduce((total, size) => total + size);
     }
     try {
-        yield usageQuota.update(property, usage);
-        return next();
+        yield performRequest(ctx, next, property, usage);
     }
     catch (err) {
         ctx.throw(400, err);
     }
 });
+const performRequest = (ctx, next, property, usage) => __awaiter(void 0, void 0, void 0, function* () {
+    const usageContext = {
+        skipNext: false,
+        skipUsage: false,
+        [usageQuota.Properties.APPS]: {},
+    };
+    if (usage === -1) {
+        if (PRE_DELETE[property]) {
+            yield PRE_DELETE[property](ctx, usageContext);
+        }
+    }
+    else {
+        if (PRE_CREATE[property]) {
+            yield PRE_CREATE[property](ctx, usageContext);
+        }
+    }
+    // run the request
+    if (!usageContext.skipNext) {
+        yield usageQuota.update(property, usage, { dryRun: true });
+        yield next();
+    }
+    if (usage === -1) {
+        if (POST_DELETE[property]) {
+            yield POST_DELETE[property](ctx, usageContext);
+        }
+    }
+    else {
+        if (POST_CREATE[property]) {
+            yield POST_CREATE[property](ctx, usageContext);
+        }
+    }
+    // update the usage
+    if (!usageContext.skipUsage) {
+        yield usageQuota.update(property, usage);
+    }
+});
+const appPreDelete = (ctx, usageContext) => __awaiter(void 0, void 0, void 0, function* () {
+    if (ctx.query.unpublish) {
+        // don't run usage decrement for unpublish
+        usageContext.skipUsage = true;
+        return;
+    }
+    // store the row count to delete
+    const rows = yield getUniqueRows([ctx.appId]);
+    if (rows.length) {
+        usageContext[usageQuota.Properties.APPS] = { rowCount: rows.length };
+    }
+});
+const appPostDelete = (ctx, usageContext) => __awaiter(void 0, void 0, void 0, function* () {
+    // delete the app rows from usage
+    const rowCount = usageContext[usageQuota.Properties.APPS].rowCount;
+    if (rowCount) {
+        yield usageQuota.update(usageQuota.Properties.ROW, -rowCount);
+    }
+});
+const appPostCreate = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    // app import & template creation
+    if (ctx.request.body.useTemplate === "true") {
+        const rows = yield getUniqueRows([ctx.response.body.appId]);
+        const rowCount = rows ? rows.length : 0;
+        yield usageQuota.update(usageQuota.Properties.ROW, rowCount);
+    }
+});
+const PRE_DELETE = {
+    [usageQuota.Properties.APPS]: appPreDelete,
+};
+const POST_DELETE = {
+    [usageQuota.Properties.APPS]: appPostDelete,
+};
+const PRE_CREATE = {};
+const POST_CREATE = {
+    [usageQuota.Properties.APPS]: appPostCreate,
+};

package/dist/migrations/functions/appUrls.js

@@ -0,0 +1,46 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = void 0;
+const { DocumentTypes } = require("@budibase/backend-core/db");
+const application_1 = require("../../api/controllers/application");
+/**
+ * Date:
+ * January 2022
+ *
+ * Description:
+ * Add the url to the app metadata if it doesn't exist
+ */
+const run = (appDb) => __awaiter(void 0, void 0, void 0, function* () {
+    let metadata;
+    try {
+        metadata = yield appDb.get(DocumentTypes.APP_METADATA);
+    }
+    catch (e) {
+        // sometimes the metadata document doesn't exist
+        // exit early instead of failing the migration
+        console.error("Error retrieving app metadata. Skipping", e);
+        return;
+    }
+    if (!metadata.url) {
+        const context = {
+            request: {
+                body: {
+                    name: metadata.name,
+                },
+            },
+        };
+        metadata.url = application_1.getAppUrl(context);
+        console.log(`Adding url to app: ${metadata.url}`);
+        yield appDb.put(metadata);
+    }
+});
+exports.run = run;

package/dist/migrations/functions/quotas1.js

@@ -0,0 +1,50 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = void 0;
+const usageQuotas_1 = require("./usageQuotas");
+const syncApps = __importStar(require("./usageQuotas/syncApps"));
+const syncRows = __importStar(require("./usageQuotas/syncRows"));
+/**
+ * Date:
+ * January 2022
+ *
+ * Description:
+ * Synchronise the app and row quotas to the state of the db after it was
+ * discovered that the quota resets were still in place and the row quotas
+ * weren't being decremented correctly.
+ */
+const run = () => __awaiter(void 0, void 0, void 0, function* () {
+    yield usageQuotas_1.runQuotaMigration(() => __awaiter(void 0, void 0, void 0, function* () {
+        yield syncApps.run();
+        yield syncRows.run();
+    }));
+});
+exports.run = run;

package/dist/migrations/functions/usageQuotas/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runQuotaMigration = void 0;
+const { useQuotas } = require("../../../utilities/usageQuota");
+const runQuotaMigration = (migration) => __awaiter(void 0, void 0, void 0, function* () {
+    if (!useQuotas()) {
+        return;
+    }
+    yield migration();
+});
+exports.runQuotaMigration = runQuotaMigration;

package/dist/migrations/functions/usageQuotas/syncApps.js

@@ -0,0 +1,32 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = void 0;
+const { getGlobalDB, getTenantId } = require("@budibase/backend-core/tenancy");
+const { getAllApps } = require("@budibase/backend-core/db");
+const db_1 = __importDefault(require("../../../db"));
+const usageQuota_1 = require("../../../utilities/usageQuota");
+const run = () => __awaiter(void 0, void 0, void 0, function* () {
+    const db = getGlobalDB();
+    // get app count
+    const devApps = yield getAllApps(db_1.default, { dev: true });
+    const appCount = devApps ? devApps.length : 0;
+    // sync app count
+    const tenantId = getTenantId();
+    console.log(`[Tenant: ${tenantId}] Syncing app count: ${appCount}`);
+    const usageDoc = yield usageQuota_1.getUsageQuotaDoc(db);
+    usageDoc.usageQuota.apps = appCount;
+    yield db.put(usageDoc);
+});
+exports.run = run;

package/dist/migrations/functions/usageQuotas/syncRows.js

@@ -0,0 +1,35 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = void 0;
+const { getGlobalDB, getTenantId } = require("@budibase/backend-core/tenancy");
+const { getAllApps } = require("@budibase/backend-core/db");
+const db_1 = __importDefault(require("../../../db"));
+const usageQuota_1 = require("../../../utilities/usageQuota");
+const rows_1 = require("../../../utilities/usageQuota/rows");
+const run = () => __awaiter(void 0, void 0, void 0, function* () {
+    const db = getGlobalDB();
+    // get all rows in all apps
+    const allApps = yield getAllApps(db_1.default, { all: true });
+    const appIds = allApps ? allApps.map((app) => app.appId) : [];
+    const rows = yield rows_1.getUniqueRows(appIds);
+    const rowCount = rows ? rows.length : 0;
+    // sync row count
+    const tenantId = getTenantId();
+    console.log(`[Tenant: ${tenantId}] Syncing row count: ${rowCount}`);
+    const usageDoc = yield usageQuota_1.getUsageQuotaDoc(db);
+    usageDoc.usageQuota.rows = rowCount;
+    yield db.put(usageDoc);
+});
+exports.run = run;

package/dist/migrations/functions/userEmailViewCasing.js

@@ -0,0 +1,24 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = void 0;
+const { createUserEmailView } = require("@budibase/backend-core/db");
+/**
+ * Date:
+ * October 2021
+ *
+ * Description:
+ * Recreate the user email view to include latest changes i.e. lower casing the email address
+ */
+const run = (db) => __awaiter(void 0, void 0, void 0, function* () {
+    yield createUserEmailView(db);
+});
+exports.run = run;

package/dist/migrations/index.js

@@ -0,0 +1,62 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrate = exports.MIGRATIONS = void 0;
+const db_1 = __importDefault(require("../db"));
+const { MIGRATION_TYPES, runMigrations, } = require("@budibase/backend-core/migrations");
+// migration functions
+const userEmailViewCasing = __importStar(require("./functions/userEmailViewCasing"));
+const quota1 = __importStar(require("./functions/quotas1"));
+const appUrls = __importStar(require("./functions/appUrls"));
+exports.MIGRATIONS = [
+    {
+        type: MIGRATION_TYPES.GLOBAL,
+        name: "user_email_view_casing",
+        fn: userEmailViewCasing.run,
+    },
+    {
+        type: MIGRATION_TYPES.GLOBAL,
+        name: "quotas_1",
+        fn: quota1.run,
+    },
+    {
+        type: MIGRATION_TYPES.APP,
+        name: "app_urls",
+        opts: { all: true },
+        fn: appUrls.run,
+    },
+];
+const migrate = (options) => __awaiter(void 0, void 0, void 0, function* () {
+    yield runMigrations(db_1.default, exports.MIGRATIONS, options);
+});
+exports.migrate = migrate;

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@budibase/server",
     "email": "hi@budibase.com",
-    "version": "1.0.47",
+    "version": "1.0.49-alpha.2",
     "description": "Budibase Web Server",
     "main": "src/index.ts",
     "repository": {
@@ -70,9 +70,9 @@
     "license": "GPL-3.0",
     "dependencies": {
         "@apidevtools/swagger-parser": "^10.0.3",
-        "@budibase/backend-core": "^1.0.47",
-        "@budibase/client": "^1.0.47",
-        "@budibase/string-templates": "^1.0.47",
+        "@budibase/backend-core": "^1.0.49-alpha.2",
+        "@budibase/client": "^1.0.49-alpha.2",
+        "@budibase/string-templates": "^1.0.49-alpha.2",
         "@bull-board/api": "^3.7.0",
         "@bull-board/koa": "^3.7.0",
         "@elastic/elasticsearch": "7.10.0",
@@ -92,6 +92,8 @@
         "fix-path": "3.0.0",
         "form-data": "^4.0.0",
         "fs-extra": "8.1.0",
+        "google-auth-library": "^7.11.0",
+        "google-spreadsheet": "^3.2.0",
         "jimp": "0.16.1",
         "joi": "17.2.1",
         "js-yaml": "^4.1.0",
@@ -110,7 +112,7 @@
         "mongodb": "3.6.3",
         "mssql": "6.2.3",
         "mysql2": "^2.3.1",
-        "node-fetch": "2.6.0",
+        "node-fetch": "2.6.7",
         "open": "^8.4.0",
         "pg": "8.5.1",
         "pino-pretty": "4.0.0",
@@ -139,6 +141,7 @@
         "@jest/test-sequencer": "^24.8.0",
         "@types/apidoc": "^0.50.0",
         "@types/bull": "^3.15.1",
+        "@types/google-spreadsheet": "^3.1.5",
         "@types/jest": "^26.0.23",
         "@types/koa": "^2.13.3",
         "@types/koa-router": "^7.4.2",

package/dist/tests/utilities/TestConfiguration.js

@@ -21,9 +21,11 @@ const { getGlobalDB } = require("@budibase/backend-core/tenancy");
 const { createASession } = require("@budibase/backend-core/sessions");
 const { user: userCache } = require("@budibase/backend-core/cache");
 const CouchDB = require("../../db");
+const newid = require("../../db/newid");
 core.init(CouchDB);
 const GLOBAL_USER_ID = "us_uuid1";
 const EMAIL = "babs@babs.com";
+const CSRF_TOKEN = "e3727778-7af0-4226-b5eb-f43cbe60a306";
 class TestConfiguration {
     constructor(openServer = true) {
         if (openServer) {
@@ -42,6 +44,9 @@ class TestConfiguration {
     getAppId() {
         return this.appId;
     }
+    getCouch() {
+        return CouchDB;
+    }
     _req(config, params, controlFunc) {
         return __awaiter(this, void 0, void 0, function* () {
             const request = {};
@@ -72,7 +77,11 @@ class TestConfiguration {
                 existing = { email };
             }
             const user = Object.assign(Object.assign({ _id: id }, existing), { roles: roles || {}, tenantId: TENANT_ID });
-            yield createASession(id, { sessionId: "sessionid", tenantId: TENANT_ID });
+            yield createASession(id, {
+                sessionId: "sessionid",
+                tenantId: TENANT_ID,
+                csrfToken: CSRF_TOKEN,
+            });
             if (builder) {
                 user.builder = { global: true };
             }
@@ -83,7 +92,8 @@ class TestConfiguration {
             return Object.assign({ _rev: resp._rev }, user);
         });
     }
-    init(appName = "test_application") {
+    // use a new id as the name to avoid name collisions
+    init(appName = newid()) {
         return __awaiter(this, void 0, void 0, function* () {
             yield this.globalUser();
             return this.createApp(appName);
@@ -116,6 +126,7 @@ class TestConfiguration {
                 `${Cookies.Auth}=${authToken}`,
                 `${Cookies.CurrentApp}=${appToken}`,
             ],
+            [Headers.CSRF_TOKEN]: CSRF_TOKEN,
         };
         if (this.appId) {
             headers[Headers.APP_ID] = this.appId;
@@ -394,10 +405,6 @@ class TestConfiguration {
                     roles: { [this.prodAppId]: roleId },
                 });
             }
-            yield createASession(userId, {
-                sessionId: "sessionid",
-                tenantId: TENANT_ID,
-            });
             // have to fake this
             const auth = {
                 userId,

package/dist/threads/query.js

@@ -75,6 +75,10 @@ class QueryRunner {
                 yield threadUtils.invalidateDynamicVariables(this.cachedVariables);
                 return this.execute();
             }
+            // check for undefined response
+            if (!rows) {
+                rows = [];
+            }
             // needs to an array for next step
             if (!Array.isArray(rows)) {
                 rows = [rows];