@budibase/server 1.0.80-alpha.1 → 1.0.80

package/src/api/routes/role.js

@@ -1,13 +1,34 @@
 const Router = require("@koa/router")
 const controller = require("../controllers/role")
 const authorized = require("../../middleware/authorized")
-const { BUILDER } = require("@budibase/backend-core/permissions")
-const { roleValidator } = require("./utils/validators")
+const Joi = require("joi")
+const joiValidator = require("../../middleware/joi-validator")
+const {
+  BUILTIN_PERMISSION_IDS,
+  BUILDER,
+  PermissionLevels,
+} = require("@budibase/backend-core/permissions")
 
 const router = Router()
 
+function generateValidator() {
+  const permLevelArray = Object.values(PermissionLevels)
+  // prettier-ignore
+  return joiValidator.body(Joi.object({
+    _id: Joi.string().optional(),
+    _rev: Joi.string().optional(),
+    name: Joi.string().required(),
+    // this is the base permission ID (for now a built in)
+    permissionId: Joi.string().valid(...Object.values(BUILTIN_PERMISSION_IDS)).required(),
+    permissions: Joi.object()
+      .pattern(/.*/, [Joi.string().valid(...permLevelArray)])
+      .optional(),
+    inherits: Joi.string().optional(),
+  }).unknown(true))
+}
+
 router
-  .post("/api/roles", authorized(BUILDER), roleValidator(), controller.save)
+  .post("/api/roles", authorized(BUILDER), generateValidator(), controller.save)
   .get("/api/roles", authorized(BUILDER), controller.fetch)
   .get("/api/roles/:roleId", authorized(BUILDER), controller.find)
   .delete("/api/roles/:roleId/:rev", authorized(BUILDER), controller.destroy)

package/src/api/routes/row.js

@@ -10,7 +10,6 @@ const {
   PermissionLevels,
   PermissionTypes,
 } = require("@budibase/backend-core/permissions")
-const { internalSearchValidator } = require("./utils/validators")
 
 const router = Router()
 
@@ -120,6 +119,8 @@ router
    *    "notEqual": {},
    *    "empty": {},
    *    "notEmpty": {},
+   *    "contains": {},
+   *    "notContains": {}
    *    "oneOf": {
    *      "columnName": ["value"]
    *    }
@@ -139,7 +140,6 @@ router
    */
   .post(
     "/api/:tableId/search",
-    internalSearchValidator(),
     paramResource("tableId"),
     authorized(PermissionTypes.TABLE, PermissionLevels.READ),
     rowController.search
@@ -195,7 +195,6 @@ router
     "/api/:tableId/rows",
     paramResource("tableId"),
     authorized(PermissionTypes.TABLE, PermissionLevels.WRITE),
-    usage,
     rowController.patch
   )
   /**

package/src/api/routes/screen.js

@@ -2,13 +2,40 @@ const Router = require("@koa/router")
 const controller = require("../controllers/screen")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
-const { screenValidator } = require("./utils/validators")
+const joiValidator = require("../../middleware/joi-validator")
+const Joi = require("joi")
 
 const router = Router()
 
+function generateSaveValidation() {
+  // prettier-ignore
+  return joiValidator.body(Joi.object({
+    name: Joi.string().required(),
+    routing: Joi.object({
+      route: Joi.string().required(),
+      roleId: Joi.string().required().allow(""),
+    }).required().unknown(true),
+    props: Joi.object({
+      _id: Joi.string().required(),
+      _component: Joi.string().required(),
+      _children: Joi.array().required(),
+      _instanceName: Joi.string().required(),
+      _styles: Joi.object().required(),
+      type: Joi.string().optional(),
+      table: Joi.string().optional(),
+      layoutId: Joi.string().optional(),
+    }).required().unknown(true),
+  }).unknown(true))
+}
+
 router
   .get("/api/screens", authorized(BUILDER), controller.fetch)
-  .post("/api/screens", authorized(BUILDER), screenValidator(), controller.save)
+  .post(
+    "/api/screens",
+    authorized(BUILDER),
+    generateSaveValidation(),
+    controller.save
+  )
   .delete(
     "/api/screens/:screenId/:screenRev",
     authorized(BUILDER),

package/src/api/routes/table.js

@@ -7,10 +7,25 @@ const {
   PermissionLevels,
   PermissionTypes,
 } = require("@budibase/backend-core/permissions")
-const { tableValidator } = require("./utils/validators")
+const joiValidator = require("../../middleware/joi-validator")
+const Joi = require("joi")
 
 const router = Router()
 
+function generateSaveValidator() {
+  // prettier-ignore
+  return joiValidator.body(Joi.object({
+    _id: Joi.string(),
+    _rev: Joi.string(),
+    type: Joi.string().valid("table", "internal", "external"),
+    primaryDisplay: Joi.string(),
+    schema: Joi.object().required(),
+    name: Joi.string().required(),
+    views: Joi.object(),
+    dataImport: Joi.object(),
+  }).unknown(true))
+}
+
 router
   /**
    * @api {get} /api/tables Fetch all tables
@@ -38,8 +53,8 @@ router
    * @apiSuccess {object[]} body The response body will be the table that was found.
    */
   .get(
-    "/api/tables/:tableId",
-    paramResource("tableId"),
+    "/api/tables/:id",
+    paramResource("id"),
     authorized(PermissionTypes.TABLE, PermissionLevels.READ),
     tableController.find
   )
@@ -121,7 +136,7 @@ router
     // allows control over updating a table
     bodyResource("_id"),
     authorized(BUILDER),
-    tableValidator(),
+    generateSaveValidator(),
     tableController.save
   )
   /**

package/src/api/routes/tests/utilities/index.js

@@ -2,18 +2,6 @@ const TestConfig = require("../../../../tests/utilities/TestConfiguration")
 const structures = require("../../../../tests/utilities/structures")
 const env = require("../../../../environment")
 
-function user() {
-  return {
-    _id: "user",
-    _rev: "rev",
-    createdAt: Date.now(),
-    email: "test@test.com",
-    roles: {},
-    tenantId: "default",
-    status: "active",
-  }
-}
-
 jest.mock("../../../../utilities/workerRequests", () => ({
   getGlobalUsers: jest.fn(() => {
     return {
@@ -25,18 +13,6 @@ jest.mock("../../../../utilities/workerRequests", () => ({
       _id: "us_uuid1",
     }
   }),
-  allGlobalUsers: jest.fn(() => {
-    return [user()]
-  }),
-  readGlobalUser: jest.fn(() => {
-    return user()
-  }),
-  saveGlobalUser: jest.fn(() => {
-    return { _id: "user", _rev: "rev" }
-  }),
-  deleteGlobalUser: jest.fn(() => {
-    return { message: "deleted user" }
-  }),
   removeAppFromUserRoles: jest.fn(),
 }))
 

package/src/api/routes/webhook.js

@@ -1,17 +1,33 @@
 const Router = require("@koa/router")
 const controller = require("../controllers/webhook")
 const authorized = require("../../middleware/authorized")
+const joiValidator = require("../../middleware/joi-validator")
 const { BUILDER } = require("@budibase/backend-core/permissions")
-const { webhookValidator } = require("./utils/validators")
+const Joi = require("joi")
 
 const router = Router()
 
+function generateSaveValidator() {
+  // prettier-ignore
+  return joiValidator.body(Joi.object({
+    live: Joi.bool(),
+    _id: Joi.string().optional(),
+    _rev: Joi.string().optional(),
+    name: Joi.string().required(),
+    bodySchema: Joi.object().optional(),
+    action: Joi.object({
+      type: Joi.string().required().valid(controller.WebhookType.AUTOMATION),
+      target: Joi.string().required(),
+    }).required(),
+  }).unknown(true))
+}
+
 router
   .get("/api/webhooks", authorized(BUILDER), controller.fetch)
   .put(
     "/api/webhooks",
     authorized(BUILDER),
-    webhookValidator(),
+    generateSaveValidator(),
     controller.save
   )
   .delete("/api/webhooks/:id/:rev", authorized(BUILDER), controller.destroy)

package/src/automations/steps/filter.js

@@ -16,11 +16,10 @@ exports.FilterConditions = FilterConditions
 exports.PrettyFilterConditions = PrettyFilterConditions
 
 exports.definition = {
-  name: "Condition",
+  name: "Filter",
   tagline: "{{inputs.field}} {{inputs.condition}} {{inputs.value}}",
   icon: "Branch2",
-  description:
-    "Conditionally halt automations which do not meet certain conditions",
+  description: "Filter any automations which do not meet certain conditions",
   type: "LOGIC",
   internal: true,
   stepId: "FILTER",

package/src/automations/steps/queryRows.js

@@ -74,7 +74,7 @@ exports.definition = {
 async function getTable(appId, tableId) {
   const ctx = buildCtx(appId, null, {
     params: {
-      tableId,
+      id: tableId,
     },
   })
   await tableController.find(ctx)

package/src/automations/utils.js

@@ -5,7 +5,7 @@ const CouchDB = require("../db")
 const { queue } = require("./bullboard")
 const newid = require("../db/newid")
 const { updateEntityMetadata } = require("../utilities")
-const { MetadataTypes, WebhookType } = require("../constants")
+const { MetadataTypes } = require("../constants")
 const { getProdAppID } = require("@budibase/backend-core/db")
 const { cloneDeep } = require("lodash/fp")
 const { getAppDB, getAppId } = require("@budibase/backend-core/context")
@@ -159,7 +159,7 @@ exports.checkForWebhooks = async ({ oldAuto, newAuto }) => {
       request: {
         body: new webhooks.Webhook(
           "Automation webhook",
-          WebhookType.AUTOMATION,
+          webhooks.WebhookType.AUTOMATION,
           newAuto._id
         ),
       },

package/src/constants/index.js

@@ -186,9 +186,5 @@ exports.BuildSchemaErrors = {
   INVALID_COLUMN: "invalid_column",
 }
 
-exports.WebhookType = {
-  AUTOMATION: "automation",
-}
-
 // pass through the list from the auth/core lib
 exports.ObjectStoreBuckets = ObjectStoreBuckets

package/src/db/utils.js

@@ -146,18 +146,6 @@ exports.getRowParams = (tableId = null, rowId = null, otherProps = {}) => {
   return getDocParams(DocumentTypes.ROW, endOfKey, otherProps)
 }
 
-/**
- * Given a row ID this will find the table ID within it (only works for internal tables).
- * @param {string} rowId The ID of the row.
- * @returns {string} The table ID.
- */
-exports.getTableIDFromRowID = rowId => {
-  const components = rowId
-    .split(DocumentTypes.TABLE + SEPARATOR)[1]
-    .split(SEPARATOR)
-  return `${DocumentTypes.TABLE}${SEPARATOR}${components[0]}`
-}
-
 /**
  * Gets a new row ID for the specified table.
  * @param {string} tableId The table which the row is being created for.

package/src/definitions/common.ts

@@ -5,10 +5,6 @@ export interface Base {
   _rev?: string
 }
 
-export interface Application extends Base {
-  appId?: string
-}
-
 export interface FieldSchema {
   // TODO: replace with field types enum when done
   type: string

package/src/environment.js

@@ -45,7 +45,6 @@ module.exports = {
   INTERNAL_API_KEY: process.env.INTERNAL_API_KEY,
   MULTI_TENANCY: process.env.MULTI_TENANCY,
   HTTP_MIGRATIONS: process.env.HTTP_MIGRATIONS,
-  API_REQ_LIMIT_PER_SEC: process.env.API_REQ_LIMIT_PER_SEC,
   // environment
   NODE_ENV: process.env.NODE_ENV,
   JEST_WORKER_ID: process.env.JEST_WORKER_ID,

package/src/integrations/base/datasourcePlus.ts

@@ -5,8 +5,5 @@ export interface DatasourcePlus extends IntegrationBase {
   tables: Record<string, Table>
   schemaErrors: Record<string, string>
 
-  // if the datasource supports the use of bindings directly (to protect against SQL injection)
-  // this returns the format of the identifier
-  getBindingIdentifier(): string
   buildSchema(datasourceId: string, entities: Record<string, Table>): any
 }

package/src/integrations/googlesheets.ts

@@ -6,10 +6,11 @@ import {
 } from "../definitions/datasource"
 import { OAuth2Client } from "google-auth-library"
 import { DatasourcePlus } from "./base/datasourcePlus"
-import { Table, TableSchema } from "../definitions/common"
+import { Row, Table, TableSchema } from "../definitions/common"
 import { buildExternalTableId } from "./utils"
 import { DataSourceOperation, FieldTypes } from "../constants"
 import { GoogleSpreadsheet } from "google-spreadsheet"
+import { table } from "console"
 
 module GoogleSheetsModule {
   const { getGlobalDB } = require("@budibase/backend-core/tenancy")
@@ -111,10 +112,6 @@ module GoogleSheetsModule {
       this.client = new GoogleSpreadsheet(spreadsheetId)
     }
 
-    getBindingIdentifier() {
-      return ""
-    }
-
     /**
      * Pull the spreadsheet ID out from a valid google sheets URL
      * @param spreadsheetId - the URL or standard spreadsheetId of the google sheet

package/src/integrations/microsoftSqlServer.ts

@@ -79,9 +79,34 @@ module MSSQLModule {
     },
   }
 
+  async function internalQuery(
+    client: any,
+    query: SqlQuery,
+    operation: string | undefined = undefined
+  ) {
+    const request = client.request()
+    try {
+      if (Array.isArray(query.bindings)) {
+        let count = 0
+        for (let binding of query.bindings) {
+          request.input(`p${count++}`, binding)
+        }
+      }
+      // this is a hack to get the inserted ID back,
+      //  no way to do this with Knex nicely
+      const sql =
+        operation === Operation.CREATE
+          ? `${query.sql}; SELECT SCOPE_IDENTITY() AS id;`
+          : query.sql
+      return await request.query(sql)
+    } catch (err) {
+      // @ts-ignore
+      throw new Error(err)
+    }
+  }
+
   class SqlServerIntegration extends Sql implements DatasourcePlus {
     private readonly config: MSSQLConfig
-    private index: number = 0
     static pool: any
     public tables: Record<string, Table> = {}
     public schemaErrors: Record<string, string> = {}
@@ -96,33 +121,6 @@ module MSSQLModule {
     TABLES_SQL =
       "SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE='BASE TABLE'"
 
-    async internalQuery(
-      query: SqlQuery,
-      operation: string | undefined = undefined
-    ) {
-      const client = this.client
-      const request = client.request()
-      this.index = 0
-      try {
-        if (Array.isArray(query.bindings)) {
-          let count = 0
-          for (let binding of query.bindings) {
-            request.input(`p${count++}`, binding)
-          }
-        }
-        // this is a hack to get the inserted ID back,
-        //  no way to do this with Knex nicely
-        const sql =
-          operation === Operation.CREATE
-            ? `${query.sql}; SELECT SCOPE_IDENTITY() AS id;`
-            : query.sql
-        return await request.query(sql)
-      } catch (err) {
-        // @ts-ignore
-        throw new Error(err)
-      }
-    }
-
     getDefinitionSQL(tableName: string) {
       return `select *
               from INFORMATION_SCHEMA.COLUMNS
@@ -167,10 +165,6 @@ module MSSQLModule {
       }
     }
 
-    getBindingIdentifier(): string {
-      return `(@p${this.index++})`
-    }
-
     async connect() {
       try {
         this.client = await this.pool.connect()
@@ -181,7 +175,7 @@ module MSSQLModule {
     }
 
     async runSQL(sql: string) {
-      return (await this.internalQuery(getSqlQuery(sql))).recordset
+      return (await internalQuery(this.client, getSqlQuery(sql))).recordset
     }
 
     /**
@@ -244,32 +238,33 @@ module MSSQLModule {
 
     async read(query: SqlQuery | string) {
       await this.connect()
-      const response = await this.internalQuery(getSqlQuery(query))
+      const response = await internalQuery(this.client, getSqlQuery(query))
       return response.recordset
     }
 
     async create(query: SqlQuery | string) {
       await this.connect()
-      const response = await this.internalQuery(getSqlQuery(query))
+      const response = await internalQuery(this.client, getSqlQuery(query))
       return response.recordset || [{ created: true }]
     }
 
     async update(query: SqlQuery | string) {
       await this.connect()
-      const response = await this.internalQuery(getSqlQuery(query))
+      const response = await internalQuery(this.client, getSqlQuery(query))
       return response.recordset || [{ updated: true }]
     }
 
     async delete(query: SqlQuery | string) {
       await this.connect()
-      const response = await this.internalQuery(getSqlQuery(query))
+      const response = await internalQuery(this.client, getSqlQuery(query))
       return response.recordset || [{ deleted: true }]
     }
 
     async query(json: QueryJson) {
       await this.connect()
       const operation = this._operation(json)
-      const queryFn = (query: any, op: string) => this.internalQuery(query, op)
+      const queryFn = (query: any, op: string) =>
+        internalQuery(this.client, query, op)
       const processFn = (result: any) =>
         result.recordset ? result.recordset : [{ [operation]: true }]
       return this.queryWithReturning(json, queryFn, processFn)

package/src/integrations/mysql.ts

@@ -95,10 +95,6 @@ module MySQLModule {
       this.config = config
     }
 
-    getBindingIdentifier(): string {
-      return "?"
-    }
-
     async connect() {
       this.client = await mysql.createConnection(this.config)
     }

package/src/integrations/oracle.ts

@@ -1,24 +1,24 @@
 import {
-  DatasourceFieldTypes,
   Integration,
-  Operation,
-  QueryJson,
+  DatasourceFieldTypes,
   QueryTypes,
   SqlQuery,
+  QueryJson,
+  Operation,
 } from "../definitions/datasource"
 import {
-  buildExternalTableId,
-  convertSqlType,
   finaliseExternalTables,
   getSqlQuery,
+  buildExternalTableId,
+  convertSqlType,
   SqlClients,
 } from "./utils"
 import oracledb, {
-  BindParameters,
-  Connection,
-  ConnectionAttributes,
   ExecuteOptions,
   Result,
+  Connection,
+  ConnectionAttributes,
+  BindParameters,
 } from "oracledb"
 import Sql from "./base/sql"
 import { Table } from "../definitions/common"
@@ -137,7 +137,6 @@ module OracleModule {
 
   class OracleIntegration extends Sql implements DatasourcePlus {
     private readonly config: OracleConfig
-    private index: number = 1
 
     public tables: Record<string, Table> = {}
     public schemaErrors: Record<string, string> = {}
@@ -175,10 +174,6 @@ module OracleModule {
       this.config = config
     }
 
-    getBindingIdentifier(): string {
-      return `:${this.index++}`
-    }
-
     /**
      * Map the flat tabular columns and constraints data into a nested object
      */
@@ -238,14 +233,20 @@ module OracleModule {
       return oracleTables
     }
 
-    private static isSupportedColumn(column: OracleColumn) {
-      return !UNSUPPORTED_TYPES.includes(column.type)
+    private isSupportedColumn(column: OracleColumn) {
+      if (UNSUPPORTED_TYPES.includes(column.type)) {
+        return false
+      }
+
+      return true
     }
 
-    private static isAutoColumn(column: OracleColumn) {
-      return !!(
-        column.default && column.default.toLowerCase().includes("nextval")
-      )
+    private isAutoColumn(column: OracleColumn) {
+      if (column.default && column.default.toLowerCase().includes("nextval")) {
+        return true
+      }
+
+      return false
     }
 
     /**
@@ -253,7 +254,7 @@ module OracleModule {
      * This matches the default behaviour for generating DDL used in knex.
      */
     private isBooleanType(column: OracleColumn): boolean {
-      return (
+      if (
         column.type.toLowerCase() === "number" &&
         Object.values(column.constraints).filter(c => {
           if (
@@ -272,7 +273,11 @@ module OracleModule {
           }
           return false
         }).length > 0
-      )
+      ) {
+        return true
+      }
+
+      return false
     }
 
     private internalConvertType(column: OracleColumn): string {
@@ -312,9 +317,7 @@ module OracleModule {
         // iterate each column on the table
         Object.values(oracleTable.columns)
           // remove columns that we can't read / save
-          .filter(oracleColumn =>
-            OracleIntegration.isSupportedColumn(oracleColumn)
-          )
+          .filter(oracleColumn => this.isSupportedColumn(oracleColumn))
           // match the order of the columns in the db
           .sort((c1, c2) => c1.id - c2.id)
           .forEach(oracleColumn => {
@@ -322,7 +325,7 @@ module OracleModule {
             let fieldSchema = table.schema[columnName]
             if (!fieldSchema) {
               fieldSchema = {
-                autocolumn: OracleIntegration.isAutoColumn(oracleColumn),
+                autocolumn: this.isAutoColumn(oracleColumn),
                 name: columnName,
                 type: this.internalConvertType(oracleColumn),
               }
@@ -348,13 +351,18 @@ module OracleModule {
     private async internalQuery<T>(query: SqlQuery): Promise<Result<T>> {
       let connection
       try {
-        this.index = 1
         connection = await this.getConnection()
 
         const options: ExecuteOptions = { autoCommit: true }
         const bindings: BindParameters = query.bindings || []
 
-        return await connection.execute<T>(query.sql, bindings, options)
+        const result: Result<T> = await connection.execute<T>(
+          query.sql,
+          bindings,
+          options
+        )
+
+        return result
       } finally {
         if (connection) {
           try {