@budibase/server 1.0.49-alpha.6 → 1.0.49

package/src/middleware/currentapp.js

@@ -11,9 +11,9 @@ const { generateUserMetadataID, isDevAppID } = require("../db/utils")
 const { dbExists } = require("@budibase/backend-core/db")
 const { isUserInAppTenant } = require("@budibase/backend-core/tenancy")
 const { getCachedSelf } = require("../utilities/global")
+const CouchDB = require("../db")
 const env = require("../environment")
 const { isWebhookEndpoint } = require("./utils")
-const { doInAppContext } = require("@budibase/backend-core/context")
 
 module.exports = async (ctx, next) => {
   // try to get the appID from the request
@@ -31,7 +31,7 @@ module.exports = async (ctx, next) => {
   // check the app exists referenced in cookie
   if (appCookie) {
     const appId = appCookie.appId
-    const exists = await dbExists(appId)
+    const exists = await dbExists(CouchDB, appId)
     if (!exists) {
       clearCookie(ctx, Cookies.CurrentApp)
       return next()
@@ -41,15 +41,13 @@ module.exports = async (ctx, next) => {
   }
 
   // deny access to application preview
-  if (!env.isTest()) {
-    if (
-      isDevAppID(requestAppId) &&
-      !isWebhookEndpoint(ctx) &&
-      (!ctx.user || !ctx.user.builder || !ctx.user.builder.global)
-    ) {
-      clearCookie(ctx, Cookies.CurrentApp)
-      return ctx.redirect("/")
-    }
+  if (
+    isDevAppID(requestAppId) &&
+    !isWebhookEndpoint(ctx) &&
+    (!ctx.user || !ctx.user.builder || !ctx.user.builder.global)
+  ) {
+    clearCookie(ctx, Cookies.CurrentApp)
+    return ctx.redirect("/")
   }
 
   let appId,
@@ -70,46 +68,44 @@ module.exports = async (ctx, next) => {
     return next()
   }
 
-  return doInAppContext(appId, async () => {
-    let noCookieSet = false
-    // if the user not in the right tenant then make sure they have no permissions
-    // need to judge this only based on the request app ID,
-    if (
-      env.MULTI_TENANCY &&
-      ctx.user &&
-      requestAppId &&
-      !isUserInAppTenant(requestAppId)
-    ) {
-      // don't error, simply remove the users rights (they are a public user)
-      delete ctx.user.builder
-      delete ctx.user.admin
-      delete ctx.user.roles
-      roleId = BUILTIN_ROLE_IDS.PUBLIC
-      noCookieSet = true
-    }
+  let noCookieSet = false
+  // if the user not in the right tenant then make sure they have no permissions
+  // need to judge this only based on the request app ID,
+  if (
+    env.MULTI_TENANCY &&
+    ctx.user &&
+    requestAppId &&
+    !isUserInAppTenant(requestAppId)
+  ) {
+    // don't error, simply remove the users rights (they are a public user)
+    delete ctx.user.builder
+    delete ctx.user.admin
+    delete ctx.user.roles
+    roleId = BUILTIN_ROLE_IDS.PUBLIC
+    noCookieSet = true
+  }
 
-    ctx.appId = appId
-    if (roleId) {
-      ctx.roleId = roleId
-      const userId = ctx.user ? generateUserMetadataID(ctx.user._id) : null
-      ctx.user = {
-        ...ctx.user,
-        // override userID with metadata one
-        _id: userId,
-        userId,
-        roleId,
-        role: await getRole(roleId),
-      }
-    }
-    if (
-      (requestAppId !== appId ||
-        appCookie == null ||
-        appCookie.appId !== requestAppId) &&
-      !noCookieSet
-    ) {
-      setCookie(ctx, { appId }, Cookies.CurrentApp)
+  ctx.appId = appId
+  if (roleId) {
+    ctx.roleId = roleId
+    const userId = ctx.user ? generateUserMetadataID(ctx.user._id) : null
+    ctx.user = {
+      ...ctx.user,
+      // override userID with metadata one
+      _id: userId,
+      userId,
+      roleId,
+      role: await getRole(appId, roleId),
     }
+  }
+  if (
+    (requestAppId !== appId ||
+      appCookie == null ||
+      appCookie.appId !== requestAppId) &&
+    !noCookieSet
+  ) {
+    setCookie(ctx, { appId }, Cookies.CurrentApp)
+  }
 
-    return next()
-  })
+  return next()
 }

package/src/middleware/tests/authorized.spec.js

@@ -11,33 +11,26 @@ const authorizedMiddleware = require("../authorized")
 const env = require("../../environment")
 const { PermissionTypes, PermissionLevels } = require("@budibase/backend-core/permissions")
 require("@budibase/backend-core").init(require("../../db"))
-const { doInAppContext } = require("@budibase/backend-core/context")
-
-const APP_ID = ""
 
 class TestConfiguration {
   constructor(role) {
     this.middleware = authorizedMiddleware(role)
     this.next = jest.fn()
     this.throw = jest.fn()
-    this.headers = {}
     this.ctx = {
       headers: {},
       request: {
         url: ""
       },
-      appId: APP_ID,
+      appId: "",
       auth: {},
       next: this.next,
-      throw: this.throw,
-      get: (name) => this.headers[name],
+      throw: this.throw
     }
   }
 
   executeMiddleware() {
-    return doInAppContext(APP_ID, () => {
-      return this.middleware(this.ctx, this.next)
-    })
+    return this.middleware(this.ctx, this.next)
   }
 
   setUser(user) {
@@ -53,7 +46,7 @@ class TestConfiguration {
   }
 
   setAuthenticated(isAuthed) {
-    this.ctx.isAuthenticated = isAuthed
+    this.ctx.auth = { authenticated: isAuthed }
   }
 
   setRequestUrl(url) {
@@ -114,7 +107,7 @@ describe("Authorization middleware", () => {
       expect(config.next).toHaveBeenCalled()
     })
     
-    it("throws if the user does not have builder permissions", async () => {
+    it("throws if the user has only builder permissions", async () => {
       config.setEnvironment(false)
       config.setMiddlewareRequiredPermission(PermissionTypes.BUILDER)
       config.setUser({
@@ -140,7 +133,7 @@ describe("Authorization middleware", () => {
       expect(config.next).toHaveBeenCalled()
     })
 
-    it("throws if the user session is not authenticated", async () => {
+    it("throws if the user session is not authenticated after permission checks", async () => {
       config.setUser({
         role: {
           _id: ""

package/src/middleware/tests/currentapp.spec.js

@@ -1,11 +1,6 @@
 mockAuthWithNoCookie()
 mockWorker()
 
-jest.mock("@budibase/backend-core/db", () => ({
-  ...jest.requireActual("@budibase/backend-core/db"),
-  dbExists: () => true,
-}))
-
 function mockWorker() {
   jest.mock("../../utilities/workerRequests", () => ({
     getGlobalSelf: () => {
@@ -55,7 +50,6 @@ function mockAuthWithCookie() {
       return "app_test"
     },
     setCookie: jest.fn(),
-    clearCookie: jest.fn(),
     getCookie: () => ({appId: "app_different", roleId: "PUBLIC"}),
   }))
   jest.mock("@budibase/backend-core/constants", () => ({

package/src/middleware/tests/usageQuota.spec.js

@@ -1,5 +1,11 @@
 jest.mock("../../db")
 jest.mock("../../utilities/usageQuota")
+jest.mock("../../environment", () => ({
+  isTest: () => true,
+  isProd: () => false,
+  isDev: () => true,
+  _set: () => {},
+}))
 jest.mock("@budibase/backend-core/tenancy", () => ({
   getTenantId: () => "testing123"
 }))
@@ -23,10 +29,9 @@ class TestConfiguration {
       },
       req: {
         method: "POST",
-        url: "/applications"
+        url: "/rows"
       }
     }
-    usageQuota.useQuotas = () => true
   }
 
   executeMiddleware() {
@@ -108,6 +113,7 @@ describe("usageQuota middleware", () => {
 
   it("calculates and persists the correct usage quota for the relevant action", async () => {
     config.setUrl("/rows")
+    config.setProd(true)
 
     await config.executeMiddleware()
 
@@ -115,20 +121,20 @@ describe("usageQuota middleware", () => {
     expect(config.next).toHaveBeenCalled()
   })
 
-  // it("calculates the correct file size from a file upload call and adds it to quota", async () => {
-  //   config.setUrl("/upload")
-  //   config.setProd(true)
-  //   config.setFiles([
-  //     {
-  //       size: 100
-  //     },
-  //     {
-  //       size: 10000
-  //     },
-  //   ])
-  //   await config.executeMiddleware()
-
-  //   expect(usageQuota.update).toHaveBeenCalledWith("storage", 10100)
-  //   expect(config.next).toHaveBeenCalled()
-  // })
+  it("calculates the correct file size from a file upload call and adds it to quota", async () => {
+    config.setUrl("/upload")
+    config.setProd(true)
+    config.setFiles([
+      {
+        size: 100
+      },
+      {
+        size: 10000
+      },
+    ])
+    await config.executeMiddleware()
+
+    expect(usageQuota.update).toHaveBeenCalledWith("storage", 10100)
+    expect(config.next).toHaveBeenCalled()
+  })
 })

package/src/middleware/usageQuota.js

@@ -1,10 +1,14 @@
+const CouchDB = require("../db")
 const usageQuota = require("../utilities/usageQuota")
-const { getUniqueRows } = require("../utilities/usageQuota/rows")
+const env = require("../environment")
+const { getTenantId } = require("@budibase/backend-core/tenancy")
 const {
   isExternalTable,
   isRowId: isExternalRowId,
 } = require("../integrations/utils")
-const { getAppDB } = require("@budibase/backend-core/context")
+
+// tenants without limits
+const EXCLUDED_TENANTS = ["bb", "default", "bbtest", "bbstaging"]
 
 // currently only counting new writes and deletes
 const METHOD_MAP = {
@@ -14,13 +18,13 @@ const METHOD_MAP = {
 
 const DOMAIN_MAP = {
   rows: usageQuota.Properties.ROW,
-  // upload: usageQuota.Properties.UPLOAD,            // doesn't work yet
-  // views: usageQuota.Properties.VIEW,               // doesn't work yet
-  // users: usageQuota.Properties.USER,               // doesn't work yet
+  upload: usageQuota.Properties.UPLOAD,
+  views: usageQuota.Properties.VIEW,
+  users: usageQuota.Properties.USER,
   applications: usageQuota.Properties.APPS,
   // this will not be updated by endpoint calls
   // instead it will be updated by triggerInfo
-  // automationRuns: usageQuota.Properties.AUTOMATION, // doesn't work yet
+  automationRuns: usageQuota.Properties.AUTOMATION,
 }
 
 function getProperty(url) {
@@ -32,7 +36,10 @@ function getProperty(url) {
 }
 
 module.exports = async (ctx, next) => {
-  if (!usageQuota.useQuotas()) {
+  const tenantId = getTenantId()
+
+  // if in development or a self hosted cloud usage quotas should not be executed
+  if (env.isDev() || env.SELF_HOSTED || EXCLUDED_TENANTS.includes(tenantId)) {
     return next()
   }
 
@@ -46,7 +53,7 @@ module.exports = async (ctx, next) => {
     const usageId = ctx.request.body._id
     try {
       if (ctx.appId) {
-        const db = getAppDB()
+        const db = new CouchDB(ctx.appId)
         await db.get(usageId)
       }
       return next()
@@ -73,92 +80,9 @@ module.exports = async (ctx, next) => {
     usage = files.map(file => file.size).reduce((total, size) => total + size)
   }
   try {
-    await performRequest(ctx, next, property, usage)
+    await usageQuota.update(property, usage)
+    return next()
   } catch (err) {
     ctx.throw(400, err)
   }
 }
-
-const performRequest = async (ctx, next, property, usage) => {
-  const usageContext = {
-    skipNext: false,
-    skipUsage: false,
-    [usageQuota.Properties.APPS]: {},
-  }
-
-  if (usage === -1) {
-    if (PRE_DELETE[property]) {
-      await PRE_DELETE[property](ctx, usageContext)
-    }
-  } else {
-    if (PRE_CREATE[property]) {
-      await PRE_CREATE[property](ctx, usageContext)
-    }
-  }
-
-  // run the request
-  if (!usageContext.skipNext) {
-    await usageQuota.update(property, usage, { dryRun: true })
-    await next()
-  }
-
-  if (usage === -1) {
-    if (POST_DELETE[property]) {
-      await POST_DELETE[property](ctx, usageContext)
-    }
-  } else {
-    if (POST_CREATE[property]) {
-      await POST_CREATE[property](ctx, usageContext)
-    }
-  }
-
-  // update the usage
-  if (!usageContext.skipUsage) {
-    await usageQuota.update(property, usage)
-  }
-}
-
-const appPreDelete = async (ctx, usageContext) => {
-  if (ctx.query.unpublish) {
-    // don't run usage decrement for unpublish
-    usageContext.skipUsage = true
-    return
-  }
-
-  // store the row count to delete
-  const rows = await getUniqueRows([ctx.appId])
-  if (rows.length) {
-    usageContext[usageQuota.Properties.APPS] = { rowCount: rows.length }
-  }
-}
-
-const appPostDelete = async (ctx, usageContext) => {
-  // delete the app rows from usage
-  const rowCount = usageContext[usageQuota.Properties.APPS].rowCount
-  if (rowCount) {
-    await usageQuota.update(usageQuota.Properties.ROW, -rowCount)
-  }
-}
-
-const appPostCreate = async ctx => {
-  // app import & template creation
-  if (ctx.request.body.useTemplate === "true") {
-    const rows = await getUniqueRows([ctx.response.body.appId])
-    const rowCount = rows ? rows.length : 0
-    await usageQuota.update(usageQuota.Properties.ROW, rowCount)
-  }
-}
-
-const PRE_DELETE = {
-  [usageQuota.Properties.APPS]: appPreDelete,
-}
-
-const POST_DELETE = {
-  [usageQuota.Properties.APPS]: appPostDelete,
-}
-
-const PRE_CREATE = {}
-
-const POST_CREATE = {
-  [usageQuota.Properties.APPS]: appPostCreate,
-}

package/src/tests/utilities/TestConfiguration.js

@@ -1,6 +1,3 @@
-const core = require("@budibase/backend-core")
-const CouchDB = require("../../db")
-core.init(CouchDB)
 const { BUILTIN_ROLE_IDS } = require("@budibase/backend-core/roles")
 const env = require("../../environment")
 const {
@@ -20,15 +17,15 @@ const supertest = require("supertest")
 const { cleanup } = require("../../utilities/fileSystem")
 const { Cookies, Headers } = require("@budibase/backend-core/constants")
 const { jwt } = require("@budibase/backend-core/auth")
+const core = require("@budibase/backend-core")
 const { getGlobalDB } = require("@budibase/backend-core/tenancy")
 const { createASession } = require("@budibase/backend-core/sessions")
 const { user: userCache } = require("@budibase/backend-core/cache")
-const newid = require("../../db/newid")
-const context = require("@budibase/backend-core/context")
+const CouchDB = require("../../db")
+core.init(CouchDB)
 
 const GLOBAL_USER_ID = "us_uuid1"
 const EMAIL = "babs@babs.com"
-const CSRF_TOKEN = "e3727778-7af0-4226-b5eb-f43cbe60a306"
 
 class TestConfiguration {
   constructor(openServer = true) {
@@ -51,10 +48,6 @@ class TestConfiguration {
     return this.appId
   }
 
-  getCouch() {
-    return CouchDB
-  }
-
   async _req(config, params, controlFunc) {
     const request = {}
     // fake cookies, we don't need them
@@ -66,21 +59,11 @@ class TestConfiguration {
     request.request = {
       body: config,
     }
-    async function run() {
-      if (params) {
-        request.params = params
-      }
-      await controlFunc(request)
-      return request.body
-    }
-    // check if already in a context
-    if (context.getAppId() == null) {
-      return context.doInAppContext(this.appId, async () => {
-        return run()
-      })
-    } else {
-      return run()
+    if (params) {
+      request.params = params
     }
+    await controlFunc(request)
+    return request.body
   }
 
   async globalUser({
@@ -102,11 +85,7 @@ class TestConfiguration {
       roles: roles || {},
       tenantId: TENANT_ID,
     }
-    await createASession(id, {
-      sessionId: "sessionid",
-      tenantId: TENANT_ID,
-      csrfToken: CSRF_TOKEN,
-    })
+    await createASession(id, { sessionId: "sessionid", tenantId: TENANT_ID })
     if (builder) {
       user.builder = { global: true }
     } else {
@@ -119,8 +98,7 @@ class TestConfiguration {
     }
   }
 
-  // use a new id as the name to avoid name collisions
-  async init(appName = newid()) {
+  async init(appName = "test_application") {
     await this.globalUser()
     return this.createApp(appName)
   }
@@ -153,7 +131,6 @@ class TestConfiguration {
         `${Cookies.Auth}=${authToken}`,
         `${Cookies.CurrentApp}=${appToken}`,
       ],
-      [Headers.CSRF_TOKEN]: CSRF_TOKEN,
     }
     if (this.appId) {
       headers[Headers.APP_ID] = this.appId
@@ -186,7 +163,6 @@ class TestConfiguration {
     // create dev app
     this.app = await this._req({ name: appName }, null, controllers.app.create)
     this.appId = this.app.appId
-    context.updateAppId(this.appId)
 
     // create production app
     this.prodApp = await this.deploy()
@@ -199,16 +175,14 @@ class TestConfiguration {
   }
 
   async deploy() {
-    await this._req(null, null, controllers.deploy.deployApp)
-    const prodAppId = this.getAppId().replace("_dev", "")
-    return context.doInAppContext(prodAppId, async () => {
-      const appPackage = await this._req(
-        null,
-        { appId: prodAppId },
-        controllers.app.fetchAppPackage
-      )
-      return appPackage.application
-    })
+    const deployment = await this._req(null, null, controllers.deploy.deployApp)
+    const prodAppId = deployment.appId.replace("_dev", "")
+    const appPackage = await this._req(
+      null,
+      { appId: prodAppId },
+      controllers.app.fetchAppPackage
+    )
+    return appPackage.application
   }
 
   async updateTable(config = null) {
@@ -437,47 +411,46 @@ class TestConfiguration {
 
   async login({ roleId, userId, builder, prodApp = false } = {}) {
     const appId = prodApp ? this.prodAppId : this.appId
-    return context.doInAppContext(appId, async () => {
-      userId = !userId ? `us_uuid1` : userId
-      if (!this.request) {
-        throw "Server has not been opened, cannot login."
-      }
-      // make sure the user exists in the global DB
-      if (roleId !== BUILTIN_ROLE_IDS.PUBLIC) {
-        await this.globalUser({
-          id: userId,
-          builder,
-          roles: { [this.prodAppId]: roleId },
-        })
-      }
-      await createASession(userId, {
-        sessionId: "sessionid",
-        tenantId: TENANT_ID,
-      })
-      // have to fake this
-      const auth = {
+
+    userId = !userId ? `us_uuid1` : userId
+    if (!this.request) {
+      throw "Server has not been opened, cannot login."
+    }
+    // make sure the user exists in the global DB
+    if (roleId !== BUILTIN_ROLE_IDS.PUBLIC) {
+      await this.globalUser({
         userId,
-        sessionId: "sessionid",
-        tenantId: TENANT_ID,
-      }
-      const app = {
-        roleId: roleId,
-        appId,
-      }
-      const authToken = jwt.sign(auth, env.JWT_SECRET)
-      const appToken = jwt.sign(app, env.JWT_SECRET)
-
-      // returning necessary request headers
-      await userCache.invalidateUser(userId)
-      return {
-        Accept: "application/json",
-        Cookie: [
-          `${Cookies.Auth}=${authToken}`,
-          `${Cookies.CurrentApp}=${appToken}`,
-        ],
-        [Headers.APP_ID]: appId,
-      }
+        builder,
+        roles: { [this.prodAppId]: roleId },
+      })
+    }
+    await createASession(userId, {
+      sessionId: "sessionid",
+      tenantId: TENANT_ID,
     })
+    // have to fake this
+    const auth = {
+      userId,
+      sessionId: "sessionid",
+      tenantId: TENANT_ID,
+    }
+    const app = {
+      roleId: roleId,
+      appId,
+    }
+    const authToken = jwt.sign(auth, env.JWT_SECRET)
+    const appToken = jwt.sign(app, env.JWT_SECRET)
+
+    // returning necessary request headers
+    await userCache.invalidateUser(userId)
+    return {
+      Accept: "application/json",
+      Cookie: [
+        `${Cookies.Auth}=${authToken}`,
+        `${Cookies.CurrentApp}=${appToken}`,
+      ],
+      [Headers.APP_ID]: appId,
+    }
   }
 }