@budibase/server 1.0.78 → 1.0.79-alpha.10

package/dist/integrations/oracle.js

@@ -74,6 +74,7 @@ var OracleModule;
     class OracleIntegration extends sql_1.default {
         constructor(config) {
             super(utils_1.SqlClients.ORACLE);
+            this.index = 1;
             this.tables = {};
             this.schemaErrors = {};
             this.COLUMNS_SQL = `
@@ -116,6 +117,9 @@ var OracleModule;
             });
             this.config = config;
         }
+        getBindingIdentifier() {
+            return `:${this.index++}`;
+        }
         /**
          * Map the flat tabular columns and constraints data into a nested object
          */
@@ -167,24 +171,18 @@ var OracleModule;
             }
             return oracleTables;
         }
-        isSupportedColumn(column) {
-            if (UNSUPPORTED_TYPES.includes(column.type)) {
-                return false;
-            }
-            return true;
+        static isSupportedColumn(column) {
+            return !UNSUPPORTED_TYPES.includes(column.type);
         }
-        isAutoColumn(column) {
-            if (column.default && column.default.toLowerCase().includes("nextval")) {
-                return true;
-            }
-            return false;
+        static isAutoColumn(column) {
+            return !!(column.default && column.default.toLowerCase().includes("nextval"));
         }
         /**
          * No native boolean in oracle. Best we can do is to check if a manual 1 or 0 number constraint has been set up
          * This matches the default behaviour for generating DDL used in knex.
          */
         isBooleanType(column) {
-            if (column.type.toLowerCase() === "number" &&
+            return (column.type.toLowerCase() === "number" &&
                 Object.values(column.constraints).filter(c => {
                     if (c.type === OracleContraintTypes.NOT_NULL_OR_CHECK &&
                         c.searchCondition) {
@@ -197,10 +195,7 @@ var OracleModule;
                         }
                     }
                     return false;
-                }).length > 0) {
-                return true;
-            }
-            return false;
+                }).length > 0);
         }
         internalConvertType(column) {
             if (this.isBooleanType(column)) {
@@ -235,7 +230,7 @@ var OracleModule;
                     // iterate each column on the table
                     Object.values(oracleTable.columns)
                         // remove columns that we can't read / save
-                        .filter(oracleColumn => this.isSupportedColumn(oracleColumn))
+                        .filter(oracleColumn => OracleIntegration.isSupportedColumn(oracleColumn))
                         // match the order of the columns in the db
                         .sort((c1, c2) => c1.id - c2.id)
                         .forEach(oracleColumn => {
@@ -243,7 +238,7 @@ var OracleModule;
                         let fieldSchema = table.schema[columnName];
                         if (!fieldSchema) {
                             fieldSchema = {
-                                autocolumn: this.isAutoColumn(oracleColumn),
+                                autocolumn: OracleIntegration.isAutoColumn(oracleColumn),
                                 name: columnName,
                                 type: this.internalConvertType(oracleColumn),
                             };
@@ -266,11 +261,11 @@ var OracleModule;
             return __awaiter(this, void 0, void 0, function* () {
                 let connection;
                 try {
+                    this.index = 1;
                     connection = yield this.getConnection();
                     const options = { autoCommit: true };
                     const bindings = query.bindings || [];
-                    const result = yield connection.execute(query.sql, bindings, options);
-                    return result;
+                    return yield connection.execute(query.sql, bindings, options);
                 }
                 finally {
                     if (connection) {

package/dist/integrations/postgres.js

@@ -84,31 +84,10 @@ var PostgresModule;
             },
         },
     };
-    function internalQuery(client, query) {
-        return __awaiter(this, void 0, void 0, function* () {
-            // need to handle a specific issue with json data types in postgres,
-            // new lines inside the JSON data will break it
-            if (query && query.sql) {
-                const matches = query.sql.match(JSON_REGEX);
-                if (matches && matches.length > 0) {
-                    for (let match of matches) {
-                        const escaped = escapeDangerousCharacters(match);
-                        query.sql = query.sql.replace(match, escaped);
-                    }
-                }
-            }
-            try {
-                return yield client.query(query.sql, query.bindings || []);
-            }
-            catch (err) {
-                // @ts-ignore
-                throw new Error(err);
-            }
-        });
-    }
     class PostgresIntegration extends Sql {
         constructor(config) {
             super(utils_1.SqlClients.POSTGRES);
+            this.index = 1;
             this.tables = {};
             this.schemaErrors = {};
             this.PRIMARY_KEYS_SQL = `
@@ -133,6 +112,33 @@ var PostgresModule;
             this.client = this.pool;
             this.setSchema();
         }
+        getBindingIdentifier() {
+            return `$${this.index++}`;
+        }
+        internalQuery(query) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const client = this.client;
+                this.index = 1;
+                // need to handle a specific issue with json data types in postgres,
+                // new lines inside the JSON data will break it
+                if (query && query.sql) {
+                    const matches = query.sql.match(JSON_REGEX);
+                    if (matches && matches.length > 0) {
+                        for (let match of matches) {
+                            const escaped = escapeDangerousCharacters(match);
+                            query.sql = query.sql.replace(match, escaped);
+                        }
+                    }
+                }
+                try {
+                    return yield client.query(query.sql, query.bindings || []);
+                }
+                catch (err) {
+                    // @ts-ignore
+                    throw new Error(err);
+                }
+            });
+        }
         setSchema() {
             if (!this.config.schema) {
                 this.config.schema = "public";
@@ -202,25 +208,25 @@ var PostgresModule;
         }
         create(query) {
             return __awaiter(this, void 0, void 0, function* () {
-                const response = yield internalQuery(this.client, utils_1.getSqlQuery(query));
+                const response = yield this.internalQuery(utils_1.getSqlQuery(query));
                 return response.rows.length ? response.rows : [{ created: true }];
             });
         }
         read(query) {
             return __awaiter(this, void 0, void 0, function* () {
-                const response = yield internalQuery(this.client, utils_1.getSqlQuery(query));
+                const response = yield this.internalQuery(utils_1.getSqlQuery(query));
                 return response.rows;
             });
         }
         update(query) {
             return __awaiter(this, void 0, void 0, function* () {
-                const response = yield internalQuery(this.client, utils_1.getSqlQuery(query));
+                const response = yield this.internalQuery(utils_1.getSqlQuery(query));
                 return response.rows.length ? response.rows : [{ updated: true }];
             });
         }
         delete(query) {
             return __awaiter(this, void 0, void 0, function* () {
-                const response = yield internalQuery(this.client, utils_1.getSqlQuery(query));
+                const response = yield this.internalQuery(utils_1.getSqlQuery(query));
                 return response.rows.length ? response.rows : [{ deleted: true }];
             });
         }
@@ -231,12 +237,12 @@ var PostgresModule;
                 if (Array.isArray(input)) {
                     const responses = [];
                     for (let query of input) {
-                        responses.push(yield internalQuery(this.client, query));
+                        responses.push(yield this.internalQuery(query));
                     }
                     return responses;
                 }
                 else {
-                    const response = yield internalQuery(this.client, input);
+                    const response = yield this.internalQuery(input);
                     return response.rows.length ? response.rows : [{ [operation]: true }];
                 }
             });

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@budibase/server",
     "email": "hi@budibase.com",
-    "version": "1.0.77",
+    "version": "1.0.79-alpha.9",
     "description": "Budibase Web Server",
     "main": "src/index.ts",
     "repository": {
@@ -21,10 +21,8 @@
         "dev:stack:down": "node scripts/dev/manage.js down",
         "dev:stack:nuke": "node scripts/dev/manage.js nuke",
         "dev:builder": "yarn run dev:stack:up && nodemon",
-        "generate:proxy:compose": "node scripts/proxy/generateProxyConfig compose",
-        "generate:proxy:preprod": "node scripts/proxy/generateProxyConfig preprod",
-        "generate:proxy:prod": "node scripts/proxy/generateProxyConfig prod",
         "format": "prettier --config ../../.prettierrc.json 'src/**/*.ts' --write",
+        "specs": "node specs/generate.js && openapi-typescript specs/openapi.yaml --output src/definitions/openapi.ts",
         "lint": "eslint --fix src/",
         "lint:fix": "yarn run format && yarn run lint",
         "initialise": "node scripts/initialise.js",
@@ -73,9 +71,9 @@
     "license": "GPL-3.0",
     "dependencies": {
         "@apidevtools/swagger-parser": "^10.0.3",
-        "@budibase/backend-core": "^1.0.77",
-        "@budibase/client": "^1.0.77",
-        "@budibase/string-templates": "^1.0.77",
+        "@budibase/backend-core": "^1.0.79-alpha.9",
+        "@budibase/client": "^1.0.79-alpha.9",
+        "@budibase/string-templates": "^1.0.79-alpha.9",
         "@bull-board/api": "^3.7.0",
         "@bull-board/koa": "^3.7.0",
         "@elastic/elasticsearch": "7.10.0",
@@ -157,12 +155,15 @@
         "docker-compose": "^0.23.6",
         "eslint": "^6.8.0",
         "jest": "^27.0.5",
+        "jest-openapi": "^0.14.2",
         "nodemon": "^2.0.4",
         "openapi-types": "^9.3.1",
+        "openapi-typescript": "^5.2.0",
         "path-to-regexp": "^6.2.0",
         "prettier": "^2.3.1",
         "rimraf": "^3.0.2",
         "supertest": "^4.0.2",
+        "swagger-jsdoc": "^6.1.0",
         "ts-jest": "^27.0.3",
         "ts-node": "^10.0.0",
         "typescript": "^4.3.5",

package/dist/tests/utilities/TestConfiguration.js

@@ -24,6 +24,8 @@ const { createASession } = require("@budibase/backend-core/sessions");
 const { user: userCache } = require("@budibase/backend-core/cache");
 const newid = require("../../db/newid");
 const context = require("@budibase/backend-core/context");
+const { generateDevInfoID, SEPARATOR } = require("@budibase/backend-core/db");
+const { encrypt } = require("@budibase/backend-core/encryption");
 const GLOBAL_USER_ID = "us_uuid1";
 const EMAIL = "babs@babs.com";
 const CSRF_TOKEN = "e3727778-7af0-4226-b5eb-f43cbe60a306";
@@ -42,6 +44,9 @@ class TestConfiguration {
     getRequest() {
         return this.request;
     }
+    getApp() {
+        return this.app;
+    }
     getAppId() {
         return this.appId;
     }
@@ -80,6 +85,22 @@ class TestConfiguration {
             }
         });
     }
+    generateApiKey(userId = GLOBAL_USER_ID) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const db = getGlobalDB(TENANT_ID);
+            const id = generateDevInfoID(userId);
+            let devInfo;
+            try {
+                devInfo = yield db.get(id);
+            }
+            catch (err) {
+                devInfo = { _id: id, userId };
+            }
+            devInfo.apiKey = encrypt(`${TENANT_ID}${SEPARATOR}${newid()}`);
+            yield db.put(devInfo);
+            return devInfo.apiKey;
+        });
+    }
     globalUser({ id = GLOBAL_USER_ID, builder = true, email = EMAIL, roles, } = {}) {
         return __awaiter(this, void 0, void 0, function* () {
             const db = getGlobalDB(TENANT_ID);
@@ -122,7 +143,7 @@ class TestConfiguration {
         }
         cleanup(this.allApps.map(app => app.appId));
     }
-    defaultHeaders() {
+    defaultHeaders(extras = {}) {
         const auth = {
             userId: GLOBAL_USER_ID,
             sessionId: "sessionid",
@@ -134,14 +155,10 @@ class TestConfiguration {
         };
         const authToken = jwt.sign(auth, env.JWT_SECRET);
         const appToken = jwt.sign(app, env.JWT_SECRET);
-        const headers = {
-            Accept: "application/json",
-            Cookie: [
+        const headers = Object.assign({ Accept: "application/json", Cookie: [
                 `${Cookies.Auth}=${authToken}`,
                 `${Cookies.CurrentApp}=${appToken}`,
-            ],
-            [Headers.CSRF_TOKEN]: CSRF_TOKEN,
-        };
+            ], [Headers.CSRF_TOKEN]: CSRF_TOKEN }, extras);
         if (this.appId) {
             headers[Headers.APP_ID] = this.appId;
         }
@@ -204,7 +221,7 @@ class TestConfiguration {
     getTable(tableId = null) {
         return __awaiter(this, void 0, void 0, function* () {
             tableId = tableId || this.table._id;
-            return this._req(null, { id: tableId }, controllers.table.find);
+            return this._req(null, { tableId }, controllers.table.find);
         });
     }
     createLinkedTable(relationshipType = null, links = ["link"]) {

package/dist/threads/query.js

@@ -12,8 +12,9 @@ const threadUtils = require("./utils");
 threadUtils.threadSetup();
 const ScriptRunner = require("../utilities/scriptRunner");
 const { integrations } = require("../integrations");
-const { processStringSync } = require("@budibase/string-templates");
+const { processStringSync, findHBSBlocks, } = require("@budibase/string-templates");
 const { doInAppContext, getAppDB } = require("@budibase/backend-core/context");
+const { isSQL } = require("../integrations/utils");
 class QueryRunner {
     constructor(input, flags = { noRecursiveQuery: false }) {
         this.datasource = input.datasource;
@@ -31,21 +32,45 @@ class QueryRunner {
         this.queryResponse = {};
         this.hasRerun = false;
     }
+    interpolateSQL(fields, parameters, integration) {
+        let sql = fields.sql;
+        if (!sql) {
+            return fields;
+        }
+        const bindings = findHBSBlocks(sql);
+        let variables = [];
+        for (let binding of bindings) {
+            let variable = integration.getBindingIdentifier();
+            variables.push(binding);
+            sql = sql.replace(binding, variable);
+        }
+        // replicate the knex structure
+        fields.sql = sql;
+        fields.bindings = this.enrichQueryFields(variables, parameters);
+        return fields;
+    }
     execute() {
         return __awaiter(this, void 0, void 0, function* () {
             let { datasource, fields, queryVerb, transformer } = this;
+            const Integration = integrations[datasource.source];
+            if (!Integration) {
+                throw "Integration type does not exist.";
+            }
+            const integration = new Integration(datasource.config);
             // pre-query, make sure datasource variables are added to parameters
             const parameters = yield this.addDatasourceVariables();
-            let query = this.enrichQueryFields(fields, parameters);
+            let query;
+            // handle SQL injections by interpolating the variables
+            if (isSQL(datasource)) {
+                query = this.interpolateSQL(fields, parameters, integration);
+            }
+            else {
+                query = this.enrichQueryFields(fields, parameters);
+            }
             // Add pagination values for REST queries
             if (this.pagination) {
                 query.paginationValues = this.pagination;
             }
-            const Integration = integrations[datasource.source];
-            if (!Integration) {
-                throw "Integration type does not exist.";
-            }
-            const integration = new Integration(datasource.config);
             let output = threadUtils.formatResponse(yield integration[queryVerb](query));
             let rows = output, info = undefined, extra = undefined, pagination = undefined;
             if (threadUtils.hasExtraData(output)) {
@@ -168,7 +193,7 @@ class QueryRunner {
         });
     }
     enrichQueryFields(fields, parameters = {}) {
-        const enrichedQuery = {};
+        const enrichedQuery = Array.isArray(fields) ? [] : {};
         // enrich the fields with dynamic parameters
         for (let key of Object.keys(fields)) {
             if (fields[key] == null) {