@budibase/server 1.0.79 → 1.0.80-alpha.2

package/src/api/controllers/public/utils.ts

@@ -0,0 +1,38 @@
+const { getAppDB } = require("@budibase/backend-core/context")
+import { isExternalTable } from "../../../integrations/utils"
+
+export async function addRev(
+  body: { _id?: string; _rev?: string },
+  tableId?: string
+) {
+  if (!body._id || (tableId && isExternalTable(tableId))) {
+    return body
+  }
+  const db = getAppDB()
+  const dbDoc = await db.get(body._id)
+  body._rev = dbDoc._rev
+  return body
+}
+
+/**
+ * Performs a case insensitive search on the provided documents, using the
+ * provided key and value. This will be a string based search, using the
+ * startsWith function.
+ */
+export function search(docs: any[], value: any, key = "name") {
+  if (!value || typeof value !== "string") {
+    return docs
+  }
+  value = value.toLowerCase()
+  const filtered = []
+  for (let doc of docs) {
+    if (typeof doc[key] !== "string") {
+      continue
+    }
+    const toTest = doc[key].toLowerCase()
+    if (toTest.startsWith(value)) {
+      filtered.push(doc)
+    }
+  }
+  return filtered
+}

package/src/api/controllers/row/ExternalRequest.ts

@@ -58,7 +58,7 @@ module External {
   ) {
     const primary = table.primary
     // if passed in array need to copy for shifting etc
-    let idCopy = cloneDeep(id)
+    let idCopy: undefined | string | any[] = cloneDeep(id)
     if (filters) {
       // need to map over the filters and make sure the _id field isn't present
       for (let filter of Object.values(filters)) {

package/src/api/controllers/row/internal.js

@@ -2,6 +2,7 @@ const linkRows = require("../../../db/linkedRows")
 const {
   generateRowID,
   getRowParams,
+  getTableIDFromRowID,
   DocumentTypes,
   InternalTables,
 } = require("../../../db/utils")
@@ -386,6 +387,9 @@ exports.fetchEnrichedRow = async ctx => {
   let groups = {},
     tables = {}
   for (let row of response) {
+    if (!row.tableId) {
+      row.tableId = getTableIDFromRowID(row._id)
+    }
     const linkedTableId = row.tableId
     if (groups[linkedTableId] == null) {
       groups[linkedTableId] = [row]

package/src/api/controllers/table/index.js

@@ -48,7 +48,7 @@ exports.fetch = async function (ctx) {
 }
 
 exports.find = async function (ctx) {
-  const tableId = ctx.params.id
+  const tableId = ctx.params.tableId
   ctx.body = await getTable(tableId)
 }
 
@@ -70,6 +70,7 @@ exports.destroy = async function (ctx) {
   ctx.eventEmitter &&
     ctx.eventEmitter.emitTable(`table:delete`, appId, deletedTable)
   ctx.status = 200
+  ctx.table = deletedTable
   ctx.body = { message: `Table ${tableId} deleted.` }
 }
 

package/src/api/controllers/webhook.js

@@ -1,6 +1,7 @@
 const { generateWebhookID, getWebhookParams } = require("../../db/utils")
 const toJsonSchema = require("to-json-schema")
 const validate = require("jsonschema").validate
+const { WebhookType } = require("../../constants")
 const triggers = require("../../automations/triggers")
 const { getProdAppID } = require("@budibase/backend-core/db")
 const { getAppDB, updateAppId } = require("@budibase/backend-core/context")
@@ -18,10 +19,6 @@ function Webhook(name, type, target) {
 
 exports.Webhook = Webhook
 
-exports.WebhookType = {
-  AUTOMATION: "automation",
-}
-
 exports.fetch = async ctx => {
   const db = getAppDB()
   const response = await db.allDocs(
@@ -62,7 +59,7 @@ exports.buildSchema = async ctx => {
   const webhook = await db.get(ctx.params.id)
   webhook.bodySchema = toJsonSchema(ctx.request.body)
   // update the automation outputs
-  if (webhook.action.type === exports.WebhookType.AUTOMATION) {
+  if (webhook.action.type === WebhookType.AUTOMATION) {
     let automation = await db.get(webhook.action.target)
     const autoOutputs = automation.definition.trigger.schema.outputs
     let properties = webhook.bodySchema.properties
@@ -92,7 +89,7 @@ exports.trigger = async ctx => {
       validate(ctx.request.body, webhook.bodySchema)
     }
     const target = await db.get(webhook.action.target)
-    if (webhook.action.type === exports.WebhookType.AUTOMATION) {
+    if (webhook.action.type === WebhookType.AUTOMATION) {
       // trigger with both the pure request and then expand it
       // incase the user has produced a schema to bind to
       await triggers.externalTrigger(target, {

package/src/api/index.js

@@ -8,7 +8,7 @@ const {
 const currentApp = require("../middleware/currentapp")
 const compress = require("koa-compress")
 const zlib = require("zlib")
-const { mainRoutes, staticRoutes } = require("./routes")
+const { mainRoutes, staticRoutes, publicRoutes } = require("./routes")
 const pkg = require("../../package.json")
 const env = require("../environment")
 
@@ -82,6 +82,9 @@ for (let route of mainRoutes) {
   router.use(route.allowedMethods())
 }
 
+router.use(publicRoutes.routes())
+router.use(publicRoutes.allowedMethods())
+
 // WARNING - static routes will catch everything else after them this must be last
 router.use(staticRoutes.routes())
 router.use(staticRoutes.allowedMethods())

package/src/api/routes/automation.js

@@ -1,50 +1,20 @@
 const Router = require("@koa/router")
 const controller = require("../controllers/automation")
 const authorized = require("../../middleware/authorized")
-const joiValidator = require("../../middleware/joi-validator")
 const {
   BUILDER,
   PermissionLevels,
   PermissionTypes,
 } = require("@budibase/backend-core/permissions")
-const Joi = require("joi")
 const { bodyResource, paramResource } = require("../../middleware/resourceId")
 const {
   middleware: appInfoMiddleware,
   AppType,
 } = require("../../middleware/appInfo")
+const { automationValidator } = require("./utils/validators")
 
 const router = Router()
 
-// prettier-ignore
-function generateStepSchema(allowStepTypes) {
-  return Joi.object({
-    stepId: Joi.string().required(),
-    id: Joi.string().required(),
-    description: Joi.string().required(),
-    name: Joi.string().required(),
-    tagline: Joi.string().required(),
-    icon: Joi.string().required(),
-    params: Joi.object(),
-    args: Joi.object(),
-    type: Joi.string().required().valid(...allowStepTypes),
-  }).unknown(true)
-}
-
-function generateValidator(existing = false) {
-  // prettier-ignore
-  return joiValidator.body(Joi.object({
-    _id: existing ? Joi.string().required() : Joi.string(),
-    _rev: existing ? Joi.string().required() : Joi.string(),
-    name: Joi.string().required(),
-    type: Joi.string().valid("automation").required(),
-    definition: Joi.object({
-      steps: Joi.array().required().items(generateStepSchema(["ACTION", "LOGIC"])),
-      trigger: generateStepSchema(["TRIGGER"]).allow(null),
-    }).required().unknown(true),
-  }).unknown(true))
-}
-
 router
   .get(
     "/api/automations/trigger/list",
@@ -72,13 +42,13 @@ router
     "/api/automations",
     bodyResource("_id"),
     authorized(BUILDER),
-    generateValidator(true),
+    automationValidator(true),
     controller.update
   )
   .post(
     "/api/automations",
     authorized(BUILDER),
-    generateValidator(false),
+    automationValidator(false),
     controller.create
   )
   .delete(

package/src/api/routes/datasource.js

@@ -1,64 +1,18 @@
 const Router = require("@koa/router")
 const datasourceController = require("../controllers/datasource")
 const authorized = require("../../middleware/authorized")
-const joiValidator = require("../../middleware/joi-validator")
 const {
   BUILDER,
   PermissionLevels,
   PermissionTypes,
 } = require("@budibase/backend-core/permissions")
-const Joi = require("joi")
-const { DataSourceOperation } = require("../../constants")
+const {
+  datasourceValidator,
+  datasourceQueryValidator,
+} = require("./utils/validators")
 
 const router = Router()
 
-function generateDatasourceSchema() {
-  // prettier-ignore
-  return joiValidator.body(Joi.object({
-    _id: Joi.string(),
-    _rev: Joi.string(),
-    // source: Joi.string().valid("POSTGRES_PLUS"),
-    type: Joi.string().allow("datasource_plus"),
-    relationships: Joi.array().items(Joi.object({
-      from: Joi.string().required(),
-      to: Joi.string().required(),
-      cardinality: Joi.valid("1:N", "1:1", "N:N").required()
-    })),
-    // entities: Joi.array().items(Joi.object({
-    //   type: Joi.string().valid(...Object.values(FieldTypes)).required(),
-    //   name: Joi.string().required(),
-    // })),
-  }).unknown(true))
-}
-
-function generateQueryDatasourceSchema() {
-  // prettier-ignore
-  return joiValidator.body(Joi.object({
-    endpoint: Joi.object({
-      datasourceId: Joi.string().required(),
-      operation: Joi.string().required().valid(...Object.values(DataSourceOperation)),
-      entityId: Joi.string().required(),
-    }).required(),
-    resource: Joi.object({
-      fields: Joi.array().items(Joi.string()).optional(),
-    }).optional(),
-    body: Joi.object().optional(),
-    sort: Joi.object().optional(),
-    filters: Joi.object({
-      string: Joi.object().optional(),
-      range: Joi.object().optional(),
-      equal: Joi.object().optional(),
-      notEqual: Joi.object().optional(),
-      empty: Joi.object().optional(),
-      notEmpty: Joi.object().optional(),
-    }).optional(),
-    paginate: Joi.object({
-      page: Joi.string().alphanum().optional(),
-      limit: Joi.number().optional(),
-    }).optional(),
-  }))
-}
-
 router
   .get("/api/datasources", authorized(BUILDER), datasourceController.fetch)
   .get(
@@ -74,7 +28,7 @@ router
   .post(
     "/api/datasources/query",
     authorized(PermissionTypes.TABLE, PermissionLevels.READ),
-    generateQueryDatasourceSchema(),
+    datasourceQueryValidator(),
     datasourceController.query
   )
   .post(
@@ -85,7 +39,7 @@ router
   .post(
     "/api/datasources",
     authorized(BUILDER),
-    generateDatasourceSchema(),
+    datasourceValidator(),
     datasourceController.save
   )
   .delete(

package/src/api/routes/index.js

@@ -25,6 +25,7 @@ const metadataRoutes = require("./metadata")
 const devRoutes = require("./dev")
 const cloudRoutes = require("./cloud")
 const migrationRoutes = require("./migrations")
+const publicRoutes = require("./public")
 
 exports.mainRoutes = [
   authRoutes,
@@ -57,4 +58,5 @@ exports.mainRoutes = [
   migrationRoutes,
 ]
 
+exports.publicRoutes = publicRoutes
 exports.staticRoutes = staticRoutes

package/src/api/routes/permission.js

@@ -1,25 +1,11 @@
 const Router = require("@koa/router")
 const controller = require("../controllers/permission")
 const authorized = require("../../middleware/authorized")
-const {
-  BUILDER,
-  PermissionLevels,
-} = require("@budibase/backend-core/permissions")
-const Joi = require("joi")
-const joiValidator = require("../../middleware/joi-validator")
+const { BUILDER } = require("@budibase/backend-core/permissions")
+const { permissionValidator } = require("./utils/validators")
 
 const router = Router()
 
-function generateValidator() {
-  const permLevelArray = Object.values(PermissionLevels)
-  // prettier-ignore
-  return joiValidator.params(Joi.object({
-    level: Joi.string().valid(...permLevelArray).required(),
-    resourceId: Joi.string(),
-    roleId: Joi.string(),
-  }).unknown(true))
-}
-
 router
   .get("/api/permission/builtin", authorized(BUILDER), controller.fetchBuiltin)
   .get("/api/permission/levels", authorized(BUILDER), controller.fetchLevels)
@@ -33,14 +19,14 @@ router
   .post(
     "/api/permission/:roleId/:resourceId/:level",
     authorized(BUILDER),
-    generateValidator(),
+    permissionValidator(),
     controller.addPermission
   )
   // deleting the level defaults it back the underlying access control for the resource
   .delete(
     "/api/permission/:roleId/:resourceId/:level",
     authorized(BUILDER),
-    generateValidator(),
+    permissionValidator(),
     controller.removePermission
   )
 

package/src/api/routes/public/applications.ts

@@ -0,0 +1,156 @@
+import controller from "../../controllers/public/applications"
+import Endpoint from "./utils/Endpoint"
+const { nameValidator, applicationValidator } = require("../utils/validators")
+
+const read = [],
+  write = []
+
+/**
+ * @openapi
+ * /applications:
+ *   post:
+ *     summary: Create an application
+ *     tags:
+ *       - applications
+ *     parameters:
+ *       - $ref: '#/components/parameters/appId'
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             $ref: '#/components/schemas/application'
+ *     responses:
+ *       200:
+ *         description: Returns the created application.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               $ref: '#/components/schemas/applicationOutput'
+ *             examples:
+ *               application:
+ *                 $ref: '#/components/examples/application'
+ */
+write.push(
+  new Endpoint("post", "/applications", controller.create).addMiddleware(
+    applicationValidator()
+  )
+)
+
+/**
+ * @openapi
+ * /applications/{appId}:
+ *   put:
+ *     summary: Update an application
+ *     tags:
+ *       - applications
+ *     parameters:
+ *       - $ref: '#/components/parameters/appIdUrl'
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             $ref: '#/components/schemas/application'
+ *     responses:
+ *       200:
+ *         description: Returns the updated application.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               $ref: '#/components/schemas/applicationOutput'
+ *             examples:
+ *               application:
+ *                 $ref: '#/components/examples/application'
+ */
+write.push(
+  new Endpoint("put", "/applications/:appId", controller.update).addMiddleware(
+    applicationValidator()
+  )
+)
+
+/**
+ * @openapi
+ * /applications/{appId}:
+ *   delete:
+ *     summary: Delete an application
+ *     tags:
+ *       - applications
+ *     parameters:
+ *       - $ref: '#/components/parameters/appIdUrl'
+ *     responses:
+ *       200:
+ *         description: Returns the deleted application.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               $ref: '#/components/schemas/applicationOutput'
+ *             examples:
+ *               application:
+ *                 $ref: '#/components/examples/application'
+ */
+write.push(new Endpoint("delete", "/applications/:appId", controller.destroy))
+
+/**
+ * @openapi
+ * /applications/{appId}:
+ *   get:
+ *     summary: Retrieve an application
+ *     tags:
+ *       - applications
+ *     parameters:
+ *       - $ref: '#/components/parameters/appIdUrl'
+ *     responses:
+ *       200:
+ *         description: Returns the retrieved application.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               $ref: '#/components/schemas/applicationOutput'
+ *             examples:
+ *               application:
+ *                 $ref: '#/components/examples/application'
+ */
+read.push(new Endpoint("get", "/applications/:appId", controller.read))
+
+/**
+ * @openapi
+ * /applications/search:
+ *   post:
+ *     summary: Search for applications
+ *     description: Based on application properties (currently only name) search for applications.
+ *     tags:
+ *       - applications
+ *     parameters:
+ *       - $ref: '#/components/parameters/appId'
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             $ref: '#/components/schemas/nameSearch'
+ *     responses:
+ *       200:
+ *         description: Returns the applications that were found based on the search parameters.
+ *         content:
+ *           application/json:
+ *             schema:
+ *               type: object
+ *               required:
+ *                 - data
+ *               properties:
+ *                 data:
+ *                   type: array
+ *                   items:
+ *                     $ref: '#/components/schemas/application'
+ *             examples:
+ *               applications:
+ *                 $ref: '#/components/examples/applications'
+ */
+read.push(
+  new Endpoint("post", "/applications/search", controller.search).addMiddleware(
+    nameValidator()
+  )
+)
+
+export default { read, write }

package/src/api/routes/public/index.ts

@@ -0,0 +1,118 @@
+import appEndpoints from "./applications"
+import queryEndpoints from "./queries"
+import tableEndpoints from "./tables"
+import rowEndpoints from "./rows"
+import userEndpoints from "./users"
+import usage from "../../../middleware/usageQuota"
+import authorized from "../../../middleware/authorized"
+import { paramResource, paramSubResource } from "../../../middleware/resourceId"
+import { CtxFn } from "./utils/Endpoint"
+import mapperMiddleware from "./middleware/mapper"
+import env from "../../../environment"
+// below imports don't have declaration files
+const Router = require("@koa/router")
+const { RateLimit, Stores } = require("koa2-ratelimit")
+const {
+  PermissionLevels,
+  PermissionTypes,
+} = require("@budibase/backend-core/permissions")
+const { getRedisOptions } = require("@budibase/backend-core/redis").utils
+
+const PREFIX = "/api/public/v1"
+// allow a lot more requests when in test
+const DEFAULT_API_REQ_LIMIT_PER_SEC = env.isTest() ? 100 : 10
+
+function getApiLimitPerSecond(): number {
+  if (!env.API_REQ_LIMIT_PER_SEC) {
+    return DEFAULT_API_REQ_LIMIT_PER_SEC
+  }
+  return parseInt(env.API_REQ_LIMIT_PER_SEC)
+}
+
+if (!env.isTest()) {
+  const REDIS_OPTS = getRedisOptions()
+  RateLimit.defaultOptions({
+    store: new Stores.Redis({
+      // @ts-ignore
+      socket: {
+        host: REDIS_OPTS.host,
+        port: REDIS_OPTS.port,
+      },
+      password: REDIS_OPTS.opts.password,
+      database: 1,
+    }),
+  })
+}
+// rate limiting, allows for 2 requests per second
+const limiter = RateLimit.middleware({
+  interval: { sec: 1 },
+  // per ip, per interval
+  max: getApiLimitPerSecond(),
+})
+
+const publicRouter = new Router({
+  prefix: PREFIX,
+})
+
+publicRouter.use(limiter)
+
+function addMiddleware(
+  endpoints: any,
+  middleware: CtxFn,
+  opts: { output: boolean } = { output: false }
+) {
+  if (!endpoints) {
+    return
+  }
+  if (!Array.isArray(endpoints)) {
+    endpoints = [endpoints]
+  }
+  for (let endpoint of endpoints) {
+    if (opts?.output) {
+      endpoint.addOutputMiddleware(middleware)
+    } else {
+      endpoint.addMiddleware(middleware)
+    }
+  }
+}
+
+function addToRouter(endpoints: any) {
+  if (endpoints) {
+    for (let endpoint of endpoints) {
+      endpoint.apply(publicRouter)
+    }
+  }
+}
+
+function applyRoutes(
+  endpoints: any,
+  permType: string,
+  resource: string,
+  subResource?: string
+) {
+  const paramMiddleware = subResource
+    ? paramSubResource(resource, subResource)
+    : paramResource(resource)
+  // add the parameter capture middleware
+  addMiddleware(endpoints.read, paramMiddleware)
+  addMiddleware(endpoints.write, paramMiddleware)
+  // add the authorization middleware, using the correct perm type
+  addMiddleware(endpoints.read, authorized(permType, PermissionLevels.READ))
+  addMiddleware(endpoints.write, authorized(permType, PermissionLevels.WRITE))
+  // add the usage quota middleware
+  addMiddleware(endpoints.write, usage)
+  // add the output mapper middleware
+  addMiddleware(endpoints.read, mapperMiddleware, { output: true })
+  addMiddleware(endpoints.write, mapperMiddleware, { output: true })
+  addToRouter(endpoints.read)
+  addToRouter(endpoints.write)
+}
+
+applyRoutes(appEndpoints, PermissionTypes.APP, "appId")
+applyRoutes(tableEndpoints, PermissionTypes.TABLE, "tableId")
+applyRoutes(userEndpoints, PermissionTypes.USER, "userId")
+applyRoutes(queryEndpoints, PermissionTypes.QUERY, "queryId")
+// needs to be applied last for routing purposes, don't override other endpoints
+applyRoutes(rowEndpoints, PermissionTypes.TABLE, "tableId", "rowId")
+
+module.exports = publicRouter