@budibase/server 1.0.49-alpha.6 → 1.0.49

package/dist/db/linkedRows/index.js

@@ -11,12 +11,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 const LinkController = require("./LinkController");
 const { IncludeDocs, getLinkDocuments, createLinkView, getUniqueByProp, getRelatedTableForField, getLinkedTableIDs, getLinkedTable, } = require("./linkUtils");
 const { flatten } = require("lodash");
+const CouchDB = require("../../db");
 const { FieldTypes } = require("../../constants");
 const { getMultiIDParams, USER_METDATA_PREFIX } = require("../../db/utils");
 const { partition } = require("lodash");
 const { getGlobalUsersFromMetadata } = require("../../utilities/global");
 const { processFormulas } = require("../../utilities/rowProcessor/utils");
-const { getAppDB } = require("@budibase/backend-core/context");
 /**
  * This functionality makes sure that when rows with links are created, updated or deleted they are processed
  * correctly - making sure that no stale links are left around and that all links have been made successfully.
@@ -45,11 +45,12 @@ function clearRelationshipFields(table, rows) {
     }
     return rows;
 }
-function getLinksForRows(rows) {
+function getLinksForRows(appId, rows) {
     return __awaiter(this, void 0, void 0, function* () {
         const tableIds = [...new Set(rows.map(el => el.tableId))];
         // start by getting all the link values for performance reasons
         const responses = flatten(yield Promise.all(tableIds.map(tableId => getLinkDocuments({
+            appId,
             tableId: tableId,
             includeDocs: IncludeDocs.EXCLUDE,
         }))));
@@ -60,10 +61,10 @@ function getLinksForRows(rows) {
             .map(el => (Object.assign(Object.assign({}, el), { unique: el.id + el.thisId + el.fieldName }))), "unique");
     });
 }
-function getFullLinkedDocs(links) {
+function getFullLinkedDocs(ctx, appId, links) {
     return __awaiter(this, void 0, void 0, function* () {
         // create DBs
-        const db = getAppDB();
+        const db = new CouchDB(appId);
         const linkedRowIds = links.map(link => link.id);
         const uniqueRowIds = [...new Set(linkedRowIds)];
         let dbRows = (yield db.allDocs(getMultiIDParams(uniqueRowIds))).rows.map(row => row.doc);
@@ -73,7 +74,7 @@ function getFullLinkedDocs(links) {
             .filter(row => row != null);
         // need to handle users as specific cases
         let [users, other] = partition(linked, linkRow => linkRow._id.startsWith(USER_METDATA_PREFIX));
-        users = yield getGlobalUsersFromMetadata(users);
+        users = yield getGlobalUsersFromMetadata(appId, users);
         return [...other, ...users];
     });
 }
@@ -81,17 +82,21 @@ function getFullLinkedDocs(links) {
  * Update link documents for a row or table - this is to be called by the API controller when a change is occurring.
  * @param {string} args.eventType states what type of change which is occurring, means this can be expanded upon in the
  * future quite easily (all updates go through one function).
+ * @param {string} args.appId The ID of the instance in which the change is occurring.
  * @param {string} args.tableId The ID of the of the table which is being changed.
- * @param {object|undefined} args.row The row which is changing, e.g. created, updated or deleted.
- * @param {object|undefined} args.table If the table has already been retrieved this can be used to reduce database gets.
- * @param {object|undefined} args.oldTable If the table is being updated then the old table can be provided for differencing.
+ * @param {object|null} args.row The row which is changing, e.g. created, updated or deleted.
+ * @param {object|null} args.table If the table has already been retrieved this can be used to reduce database gets.
+ * @param {object|null} args.oldTable If the table is being updated then the old table can be provided for differencing.
  * @returns {Promise<object>} When the update is complete this will respond successfully. Returns the row for
  * row operations and the table for table operations.
  */
 exports.updateLinks = function (args) {
     return __awaiter(this, void 0, void 0, function* () {
-        const { eventType, row, tableId, table, oldTable } = args;
+        const { eventType, appId, row, tableId, table, oldTable } = args;
         const baseReturnObj = row == null ? table : row;
+        if (appId == null) {
+            throw "Cannot operate without an instance ID.";
+        }
         // make sure table ID is set
         if (tableId == null && table != null) {
             args.tableId = table._id;
@@ -127,21 +132,25 @@ exports.updateLinks = function (args) {
 /**
  * Given a table and a list of rows this will retrieve all of the attached docs and enrich them into the row.
  * This is required for formula fields, this may only be utilised internally (for now).
+ * @param {object} ctx The request which is looking for rows.
  * @param {object} table The table from which the rows originated.
  * @param {array<object>} rows The rows which are to be enriched.
  * @return {Promise<*>} returns the rows with all of the enriched relationships on it.
  */
-exports.attachFullLinkedDocs = (table, rows) => __awaiter(void 0, void 0, void 0, function* () {
+exports.attachFullLinkedDocs = (ctx, table, rows) => __awaiter(void 0, void 0, void 0, function* () {
+    const appId = ctx.appId;
     const linkedTableIds = getLinkedTableIDs(table);
     if (linkedTableIds.length === 0) {
         return rows;
     }
+    // create DBs
+    const db = new CouchDB(appId);
     // get all the links
-    const links = (yield getLinksForRows(rows)).filter(link => rows.some(row => row._id === link.thisId));
+    const links = (yield getLinksForRows(appId, rows)).filter(link => rows.some(row => row._id === link.thisId));
     // clear any existing links that could be dupe'd
     rows = clearRelationshipFields(table, rows);
     // now get the docs and combine into the rows
-    let linked = yield getFullLinkedDocs(links);
+    let linked = yield getFullLinkedDocs(ctx, appId, links);
     const linkedTables = [];
     for (let row of rows) {
         for (let link of links.filter(link => link.thisId === row._id)) {
@@ -151,7 +160,7 @@ exports.attachFullLinkedDocs = (table, rows) => __awaiter(void 0, void 0, void 0
             const linkedRow = linked.find(row => row._id === link.id);
             if (linkedRow) {
                 const linkedTableId = linkedRow.tableId || getRelatedTableForField(table, link.fieldName);
-                const linkedTable = yield getLinkedTable(linkedTableId, linkedTables);
+                const linkedTable = yield getLinkedTable(db, linkedTableId, linkedTables);
                 if (linkedTable) {
                     row[link.fieldName].push(processFormulas(linkedTable, linkedRow));
                 }
@@ -162,16 +171,18 @@ exports.attachFullLinkedDocs = (table, rows) => __awaiter(void 0, void 0, void 0
 });
 /**
  * This function will take the given enriched rows and squash the links to only contain the primary display field.
+ * @param {string} appId The app in which the tables/rows/links exist.
  * @param {object} table The table from which the rows originated.
  * @param {array<object>} enriched The pre-enriched rows (full docs) which are to be squashed.
  * @returns {Promise<Array>} The rows after having their links squashed to only contain the ID and primary display.
  */
-exports.squashLinksToPrimaryDisplay = (table, enriched) => __awaiter(void 0, void 0, void 0, function* () {
+exports.squashLinksToPrimaryDisplay = (appId, table, enriched) => __awaiter(void 0, void 0, void 0, function* () {
+    const db = new CouchDB(appId);
     // will populate this as we find them
     const linkedTables = [table];
     for (let row of enriched) {
         // this only fetches the table if its not already in array
-        const rowTable = yield getLinkedTable(row.tableId, linkedTables);
+        const rowTable = yield getLinkedTable(db, row.tableId, linkedTables);
         for (let [column, schema] of Object.entries(rowTable.schema)) {
             if (schema.type !== FieldTypes.LINK || !Array.isArray(row[column])) {
                 continue;
@@ -179,7 +190,7 @@ exports.squashLinksToPrimaryDisplay = (table, enriched) => __awaiter(void 0, voi
             const newLinks = [];
             for (let link of row[column]) {
                 const linkTblId = link.tableId || getRelatedTableForField(table, column);
-                const linkedTable = yield getLinkedTable(linkTblId, linkedTables);
+                const linkedTable = yield getLinkedTable(db, linkTblId, linkedTables);
                 const obj = { _id: link._id };
                 if (link[linkedTable.primaryDisplay]) {
                     obj.primaryDisplay = link[linkedTable.primaryDisplay];

package/dist/db/linkedRows/linkUtils.js

@@ -8,11 +8,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+const CouchDB = require("../index");
 const Sentry = require("@sentry/node");
 const { ViewNames, getQueryIndex } = require("../utils");
 const { FieldTypes } = require("../../constants");
 const { createLinkView } = require("../views/staticViews");
-const { getAppDB } = require("@budibase/backend-core/context");
 /**
  * Only needed so that boolean parameters are being used for includeDocs
  * @type {{EXCLUDE: boolean, INCLUDE: boolean}}
@@ -24,6 +24,7 @@ exports.IncludeDocs = {
 exports.createLinkView = createLinkView;
 /**
  * Gets the linking documents, not the linked documents themselves.
+ * @param {string} args.appId The instance in which we are searching for linked rows.
  * @param {string} args.tableId The table which we are searching for linked rows against.
  * @param {string|null} args.fieldName The name of column/field which is being altered, only looking for
  * linking documents that are related to it. If this is not specified then the table level will be assumed.
@@ -37,8 +38,8 @@ exports.createLinkView = createLinkView;
  */
 exports.getLinkDocuments = function (args) {
     return __awaiter(this, arguments, void 0, function* () {
-        const { tableId, rowId, includeDocs } = args;
-        const db = getAppDB();
+        const { appId, tableId, rowId, includeDocs } = args;
+        const db = new CouchDB(appId);
         let params;
         if (rowId != null) {
             params = { key: [tableId, rowId] };
@@ -74,7 +75,7 @@ exports.getLinkDocuments = function (args) {
         catch (err) {
             // check if the view doesn't exist, it should for all new instances
             if (err != null && err.name === "not_found") {
-                yield exports.createLinkView();
+                yield exports.createLinkView(appId);
                 return exports.getLinkDocuments(arguments[0]);
             }
             else {
@@ -94,8 +95,7 @@ exports.getLinkedTableIDs = table => {
         .filter(column => column.type === FieldTypes.LINK)
         .map(column => column.tableId);
 };
-exports.getLinkedTable = (id, tables) => __awaiter(void 0, void 0, void 0, function* () {
-    const db = getAppDB();
+exports.getLinkedTable = (db, id, tables) => __awaiter(void 0, void 0, void 0, function* () {
     let linkedTable = tables.find(table => table._id === id);
     if (linkedTable) {
         return linkedTable;

package/dist/db/views/staticViews.js

@@ -8,7 +8,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-const { getAppDB } = require("@budibase/backend-core/context");
+const CouchDB = require("../index");
 const { DocumentTypes, SEPARATOR, ViewNames, SearchIndexes, } = require("../utils");
 const SCREEN_PREFIX = DocumentTypes.SCREEN + SEPARATOR;
 /**************************************************
@@ -24,11 +24,12 @@ const SCREEN_PREFIX = DocumentTypes.SCREEN + SEPARATOR;
 /**
  * Creates the link view for the instance, this will overwrite the existing one, but this should only
  * be called if it is found that the view does not exist.
+ * @param {string} appId The instance to which the view should be added.
  * @returns {Promise<void>} The view now exists, please note that the next view of this query will actually build it,
  * so it may be slow.
  */
-exports.createLinkView = () => __awaiter(void 0, void 0, void 0, function* () {
-    const db = getAppDB();
+exports.createLinkView = (appId) => __awaiter(void 0, void 0, void 0, function* () {
+    const db = new CouchDB(appId);
     const designDoc = yield db.get("_design/database");
     const view = {
         map: function (doc) {
@@ -55,8 +56,8 @@ exports.createLinkView = () => __awaiter(void 0, void 0, void 0, function* () {
     designDoc.views = Object.assign(Object.assign({}, designDoc.views), { [ViewNames.LINK]: view });
     yield db.put(designDoc);
 });
-exports.createRoutingView = () => __awaiter(void 0, void 0, void 0, function* () {
-    const db = getAppDB();
+exports.createRoutingView = (appId) => __awaiter(void 0, void 0, void 0, function* () {
+    const db = new CouchDB(appId);
     const designDoc = yield db.get("_design/database");
     const view = {
         // if using variables in a map function need to inject them before use
@@ -72,9 +73,9 @@ exports.createRoutingView = () => __awaiter(void 0, void 0, void 0, function* ()
     designDoc.views = Object.assign(Object.assign({}, designDoc.views), { [ViewNames.ROUTING]: view });
     yield db.put(designDoc);
 });
-function searchIndex(indexName, fnString) {
+function searchIndex(appId, indexName, fnString) {
     return __awaiter(this, void 0, void 0, function* () {
-        const db = getAppDB();
+        const db = new CouchDB(appId);
         const designDoc = yield db.get("_design/database");
         designDoc.indexes = {
             [indexName]: {
@@ -85,8 +86,8 @@ function searchIndex(indexName, fnString) {
         yield db.put(designDoc);
     });
 }
-exports.createAllSearchIndex = () => __awaiter(void 0, void 0, void 0, function* () {
-    yield searchIndex(SearchIndexes.ROWS, function (doc) {
+exports.createAllSearchIndex = (appId) => __awaiter(void 0, void 0, void 0, function* () {
+    yield searchIndex(appId, SearchIndexes.ROWS, function (doc) {
         function idx(input, prev) {
             for (let key of Object.keys(input)) {
                 let idxKey = prev != null ? `${prev}.${key}` : key;

package/dist/definitions/datasource.js

@@ -49,7 +49,6 @@ var SourceNames;
     SourceNames["ARANGODB"] = "ARANGODB";
     SourceNames["REST"] = "REST";
     SourceNames["ORACLE"] = "ORACLE";
-    SourceNames["GOOGLE_SHEETS"] = "GOOGLE_SHEETS";
 })(SourceNames = exports.SourceNames || (exports.SourceNames = {}));
 var IncludeRelationships;
 (function (IncludeRelationships) {

package/dist/environment.js

@@ -2,8 +2,7 @@
 function isTest() {
     return (process.env.NODE_ENV === "jest" ||
         process.env.NODE_ENV === "cypress" ||
-        (process.env.JEST_WORKER_ID != null &&
-            process.env.JEST_WORKER_ID !== "null"));
+        process.env.JEST_WORKER_ID != null);
 }
 function isDev() {
     return (process.env.NODE_ENV !== "production" &&
@@ -31,12 +30,10 @@ module.exports = {
     MINIO_ACCESS_KEY: process.env.MINIO_ACCESS_KEY,
     MINIO_SECRET_KEY: process.env.MINIO_SECRET_KEY,
     USE_QUOTAS: process.env.USE_QUOTAS,
-    EXCLUDE_QUOTAS_TENANTS: process.env.EXCLUDE_QUOTAS_TENANTS,
     REDIS_URL: process.env.REDIS_URL,
     REDIS_PASSWORD: process.env.REDIS_PASSWORD,
     INTERNAL_API_KEY: process.env.INTERNAL_API_KEY,
     MULTI_TENANCY: process.env.MULTI_TENANCY,
-    HTTP_MIGRATIONS: process.env.HTTP_MIGRATIONS,
     // environment
     NODE_ENV: process.env.NODE_ENV,
     JEST_WORKER_ID: process.env.JEST_WORKER_ID,

package/dist/integrations/base/sql.js

@@ -69,16 +69,10 @@ class InternalBuilder {
         this.client = client;
     }
     // right now we only do filters on the specific table being queried
-    addFilters(query, filters, opts) {
+    addFilters(tableName, query, filters) {
         function iterate(structure, fn) {
             for (let [key, value] of Object.entries(structure)) {
-                const isRelationshipField = key.includes(".");
-                if (!opts.relationship && !isRelationshipField) {
-                    fn(`${opts.tableName}.${key}`, value);
-                }
-                if (opts.relationship && isRelationshipField) {
-                    fn(key, value);
-                }
+                fn(`${tableName}.${key}`, value);
             }
         }
         if (!filters) {
@@ -254,7 +248,7 @@ class InternalBuilder {
         if (foundOffset) {
             query = query.offset(foundOffset);
         }
-        query = this.addFilters(query, filters, { tableName });
+        query = this.addFilters(tableName, query, filters);
         // add sorting to pre-query
         query = this.addSorting(query, json);
         // @ts-ignore
@@ -267,14 +261,13 @@ class InternalBuilder {
             preQuery = this.addSorting(preQuery, json);
         }
         // handle joins
-        query = this.addRelationships(knex, preQuery, selectStatement, tableName, relationships);
-        return this.addFilters(query, filters, { relationship: true });
+        return this.addRelationships(knex, preQuery, selectStatement, tableName, relationships);
     }
     update(knex, json, opts) {
         const { endpoint, body, filters } = json;
         let query = knex(endpoint.entityId);
         const parsedBody = parseBody(body);
-        query = this.addFilters(query, filters, { tableName: endpoint.entityId });
+        query = this.addFilters(endpoint.entityId, query, filters);
         // mysql can't use returning
         if (opts.disableReturning) {
             return query.update(parsedBody);
@@ -286,7 +279,7 @@ class InternalBuilder {
     delete(knex, json, opts) {
         const { endpoint, filters } = json;
         let query = knex(endpoint.entityId);
-        query = this.addFilters(query, filters, { tableName: endpoint.entityId });
+        query = this.addFilters(endpoint.entityId, query, filters);
         // mysql can't use returning
         if (opts.disableReturning) {
             return query.delete();

package/dist/integrations/index.js

@@ -10,7 +10,6 @@ const airtable = require("./airtable");
 const mysql = require("./mysql");
 const arangodb = require("./arangodb");
 const rest = require("./rest");
-const googlesheets = require("./googlesheets");
 const { SourceNames } = require("../definitions/datasource");
 const DEFINITIONS = {
     [SourceNames.POSTGRES]: postgres.schema,
@@ -24,7 +23,6 @@ const DEFINITIONS = {
     [SourceNames.MYSQL]: mysql.schema,
     [SourceNames.ARANGODB]: arangodb.schema,
     [SourceNames.REST]: rest.schema,
-    [SourceNames.GOOGLE_SHEETS]: googlesheets.schema,
 };
 const INTEGRATIONS = {
     [SourceNames.POSTGRES]: postgres.integration,
@@ -38,7 +36,6 @@ const INTEGRATIONS = {
     [SourceNames.MYSQL]: mysql.integration,
     [SourceNames.ARANGODB]: arangodb.integration,
     [SourceNames.REST]: rest.integration,
-    [SourceNames.GOOGLE_SHEETS]: googlesheets.integration,
 };
 // optionally add oracle integration if the oracle binary can be installed
 if (!(process.arch === "arm64" && process.platform === "darwin")) {

package/dist/integrations/utils.js

@@ -52,9 +52,6 @@ function buildExternalTableId(datasourceId, tableName) {
 }
 exports.buildExternalTableId = buildExternalTableId;
 function breakExternalTableId(tableId) {
-    if (!tableId) {
-        return {};
-    }
     const parts = tableId.split(DOUBLE_SEPARATOR);
     let tableName = parts.pop();
     // if they need joined
@@ -128,12 +125,7 @@ function isSQL(datasource) {
     if (!datasource || !datasource.source) {
         return false;
     }
-    const SQL = [
-        datasource_1.SourceNames.POSTGRES,
-        datasource_1.SourceNames.SQL_SERVER,
-        datasource_1.SourceNames.MYSQL,
-        datasource_1.SourceNames.ORACLE,
-    ];
+    const SQL = [datasource_1.SourceNames.POSTGRES, datasource_1.SourceNames.SQL_SERVER, datasource_1.SourceNames.MYSQL];
     return SQL.indexOf(datasource.source) !== -1;
 }
 exports.isSQL = isSQL;
@@ -145,44 +137,8 @@ function isIsoDateString(str) {
     return d.toISOString() === str;
 }
 exports.isIsoDateString = isIsoDateString;
-/**
- * This function will determine whether a column is a relationship and whether it
- * is currently valid. The reason for the validity check is that tables can be deleted
- * outside of Budibase control and if this is the case it will break Budibase relationships.
- * The tableIds is a list passed down from the main finalise tables function, which is
- * based on the tables that have just been fetched. This will only really be used on subsequent
- * fetches to the first one - if the user is periodically refreshing Budibase knowledge of tables.
- * @param column The column to check, to see if it is a valid relationship.
- * @param tableIds The IDs of the tables which currently exist.
- */
-function shouldCopyRelationship(column, tableIds) {
-    return (column.type === constants_1.FieldTypes.LINK &&
-        column.tableId &&
-        tableIds.includes(column.tableId));
-}
-/**
- * Similar function to the shouldCopyRelationship function, but instead this looks for options and boolean
- * types. It is possible to switch a string -> options and a number -> boolean (and vice versus) need to make
- * sure that these get copied over when tables are fetched. Also checks whether they are still valid, if a
- * column has changed type in the external database then copying it over may not be possible.
- * @param column The column to check for options or boolean type.
- * @param fetchedColumn The fetched column to check for the type in the external database.
- */
-function shouldCopySpecialColumn(column, fetchedColumn) {
-    return (column.type === constants_1.FieldTypes.OPTIONS ||
-        column.type === constants_1.FieldTypes.ARRAY ||
-        ((!fetchedColumn || fetchedColumn.type === constants_1.FieldTypes.NUMBER) &&
-            column.type === constants_1.FieldTypes.BOOLEAN));
-}
-/**
- * Looks for columns which need to be copied over into the new table definitions, like relationships
- * and options types.
- * @param tableName The name of the table which is being checked.
- * @param table The specific table which is being checked.
- * @param entities All the tables that existed before - the old table definitions.
- * @param tableIds The IDs of the tables which exist now, to check if anything has been removed.
- */
-function copyExistingPropsOver(tableName, table, entities, tableIds) {
+// add the existing relationships from the entities if they exist, to prevent them from being overridden
+function copyExistingPropsOver(tableName, table, entities) {
     if (entities && entities[tableName]) {
         if (entities[tableName].primaryDisplay) {
             table.primaryDisplay = entities[tableName].primaryDisplay;
@@ -192,28 +148,21 @@ function copyExistingPropsOver(tableName, table, entities, tableIds) {
             if (!existingTableSchema.hasOwnProperty(key)) {
                 continue;
             }
-            const column = existingTableSchema[key];
-            if (shouldCopyRelationship(column, tableIds) ||
-                shouldCopySpecialColumn(column, table.schema[key])) {
+            if (existingTableSchema[key].type === constants_1.FieldTypes.LINK ||
+                existingTableSchema[key].type === constants_1.FieldTypes.OPTIONS ||
+                existingTableSchema[key].type === constants_1.FieldTypes.ARRAY ||
+                ((!table.schema[key] || table.schema[key].type === constants_1.FieldTypes.NUMBER) &&
+                    existingTableSchema[key].type === constants_1.FieldTypes.BOOLEAN)) {
                 table.schema[key] = existingTableSchema[key];
             }
         }
     }
     return table;
 }
-/**
- * Look through the final table definitions to see if anything needs to be
- * copied over from the old and if any errors have occurred mark them so
- * that the user can be made aware.
- * @param tables The list of tables that have been retrieved from the external database.
- * @param entities The old list of tables, if there was any to look for definitions in.
- */
 function finaliseExternalTables(tables, entities) {
     const invalidColumns = Object.values(constants_1.InvalidColumns);
     let finalTables = {};
     const errors = {};
-    // @ts-ignore
-    const tableIds = Object.values(tables).map(table => table._id);
     for (let [name, table] of Object.entries(tables)) {
         const schemaFields = Object.keys(table.schema);
         // make sure every table has a key
@@ -226,7 +175,7 @@ function finaliseExternalTables(tables, entities) {
             continue;
         }
         // make sure all previous props have been added back
-        finalTables[name] = copyExistingPropsOver(name, table, entities, tableIds);
+        finalTables[name] = copyExistingPropsOver(name, table, entities);
     }
     // sort the tables by name
     finalTables = Object.entries(finalTables)

package/dist/middleware/authorized.js

@@ -12,50 +12,9 @@ const { getUserRoleHierarchy, getRequiredResourceRole, BUILTIN_ROLE_IDS, } = req
 const { PermissionTypes, doesHaveBasePermission, } = require("@budibase/backend-core/permissions");
 const builderMiddleware = require("./builder");
 const { isWebhookEndpoint } = require("./utils");
-const { buildCsrfMiddleware } = require("@budibase/backend-core/auth");
-const { getAppId } = require("@budibase/backend-core/context");
 function hasResource(ctx) {
     return ctx.resourceId != null;
 }
-const csrf = buildCsrfMiddleware();
-/**
- * Apply authorization to the requested resource:
- * - If this is a builder resource the user must be a builder.
- * - Builders can access all resources.
- * - Otherwise the user must have the required role.
- */
-const checkAuthorized = (ctx, resourceRoles, permType, permLevel) => __awaiter(void 0, void 0, void 0, function* () {
-    // check if this is a builder api and the user is not a builder
-    const isBuilder = ctx.user && ctx.user.builder && ctx.user.builder.global;
-    const isBuilderApi = permType === PermissionTypes.BUILDER;
-    if (isBuilderApi && !isBuilder) {
-        return ctx.throw(403, "Not Authorized");
-    }
-    // check for resource authorization
-    if (!isBuilder) {
-        yield checkAuthorizedResource(ctx, resourceRoles, permType, permLevel);
-    }
-});
-const checkAuthorizedResource = (ctx, resourceRoles, permType, permLevel) => __awaiter(void 0, void 0, void 0, function* () {
-    // get the user's roles
-    const roleId = ctx.roleId || BUILTIN_ROLE_IDS.PUBLIC;
-    const userRoles = yield getUserRoleHierarchy(roleId, {
-        idOnly: false,
-    });
-    const permError = "User does not have permission";
-    // check if the user has the required role
-    if (resourceRoles.length > 0) {
-        // deny access if the user doesn't have the required resource role
-        const found = userRoles.find(role => resourceRoles.indexOf(role._id) !== -1);
-        if (!found) {
-            ctx.throw(403, permError);
-        }
-        // fallback to the base permissions when no resource roles are found
-    }
-    else if (!doesHaveBasePermission(permType, permLevel, userRoles)) {
-        ctx.throw(403, permError);
-    }
-});
 module.exports =
     (permType, permLevel = null) => (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
         // webhooks don't need authentication, each webhook unique
@@ -69,23 +28,37 @@ module.exports =
         // check general builder stuff, this middleware is a good way
         // to find API endpoints which are builder focused
         yield builderMiddleware(ctx, permType);
-        // get the resource roles
-        let resourceRoles = [];
-        const appId = getAppId();
-        if (appId && hasResource(ctx)) {
-            resourceRoles = yield getRequiredResourceRole(permLevel, ctx);
-        }
-        // if the resource is public, proceed
-        const isPublicResource = resourceRoles.includes(BUILTIN_ROLE_IDS.PUBLIC);
-        if (isPublicResource) {
+        const isAuthed = ctx.isAuthenticated;
+        // builders for now have permission to do anything
+        let isBuilder = ctx.user && ctx.user.builder && ctx.user.builder.global;
+        const isBuilderApi = permType === PermissionTypes.BUILDER;
+        if (isBuilder) {
             return next();
         }
-        // check authenticated
-        if (!ctx.isAuthenticated) {
-            return ctx.throw(403, "Session not authenticated");
+        else if (isBuilderApi && !isBuilder) {
+            return ctx.throw(403, "Not Authorized");
+        }
+        // need to check this first, in-case public access, don't check authed until last
+        const roleId = ctx.roleId || BUILTIN_ROLE_IDS.PUBLIC;
+        const hierarchy = yield getUserRoleHierarchy(ctx.appId, roleId, {
+            idOnly: false,
+        });
+        const permError = "User does not have permission";
+        let possibleRoleIds = [];
+        if (hasResource(ctx)) {
+            possibleRoleIds = yield getRequiredResourceRole(ctx.appId, permLevel, ctx);
+        }
+        // check if we found a role, if not fallback to base permissions
+        if (possibleRoleIds.length > 0) {
+            const found = hierarchy.find(role => possibleRoleIds.indexOf(role._id) !== -1);
+            return found ? next() : ctx.throw(403, permError);
+        }
+        else if (!doesHaveBasePermission(permType, permLevel, hierarchy)) {
+            ctx.throw(403, permError);
+        }
+        // if they are not authed, then anything using the authorized middleware will fail
+        if (!isAuthed) {
+            ctx.throw(403, "Session not authenticated");
         }
-        // check authorized
-        yield checkAuthorized(ctx, resourceRoles, permType, permLevel);
-        // csrf protection
-        return csrf(ctx, next);
+        return next();
     });

package/dist/middleware/builder.js

@@ -10,7 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 const { APP_DEV_PREFIX } = require("../db/utils");
 const { doesUserHaveLock, updateLock, checkDebounce, setDebounce, } = require("../utilities/redis");
-const { getDB } = require("@budibase/backend-core/db");
+const CouchDB = require("../db");
 const { DocumentTypes } = require("../db/utils");
 const { PermissionTypes } = require("@budibase/backend-core/permissions");
 const { app: appCache } = require("@budibase/backend-core/cache");
@@ -49,7 +49,7 @@ function updateAppUpdatedAt(ctx) {
         if (ctx.method === "GET" || (yield checkDebounce(appId))) {
             return;
         }
-        const db = getDB(appId);
+        const db = new CouchDB(appId);
         const metadata = yield db.get(DocumentTypes.APP_METADATA);
         metadata.updatedAt = new Date().toISOString();
         const response = yield db.put(metadata);