@budibase/server 1.0.80-alpha.3 → 1.0.80

package/dist/utilities/workerRequests.js

@@ -36,31 +36,10 @@ function request(ctx, request) {
         delete request.body;
     }
     if (ctx && ctx.headers) {
-        request.headers = ctx.headers;
+        request.headers.cookie = ctx.headers.cookie;
     }
     return request;
 }
-function checkResponse(response, errorMsg, { ctx } = {}) {
-    return __awaiter(this, void 0, void 0, function* () {
-        if (response.status !== 200) {
-            let error;
-            try {
-                error = yield response.json();
-            }
-            catch (err) {
-                error = yield response.text();
-            }
-            const msg = `Unable to ${errorMsg} - ${error.message ? error.message : error}`;
-            if (ctx) {
-                ctx.throw(400, msg);
-            }
-            else {
-                throw msg;
-            }
-        }
-        return response.json();
-    });
-}
 exports.request = request;
 // have to pass in the tenant ID as this could be coming from an automation
 exports.sendSmtpEmail = (to, from, subject, contents, automation) => __awaiter(void 0, void 0, void 0, function* () {
@@ -76,14 +55,21 @@ exports.sendSmtpEmail = (to, from, subject, contents, automation) => __awaiter(v
             automation,
         },
     }));
-    return checkResponse(response, "send email");
+    if (response.status !== 200) {
+        const error = yield response.text();
+        throw `Unable to send email - ${error}`;
+    }
+    return response.json();
 });
 exports.getGlobalSelf = (ctx, appId = null) => __awaiter(void 0, void 0, void 0, function* () {
-    const endpoint = `/api/global/self`;
+    const endpoint = `/api/global/users/self`;
     const response = yield fetch(checkSlashesInUrl(env.WORKER_URL + endpoint), 
     // we don't want to use API key when getting self
     request(ctx, { method: "GET" }));
-    let json = yield checkResponse(response, "get self globally", { ctx });
+    if (response.status !== 200) {
+        ctx.throw(400, "Unable to get self globally.");
+    }
+    let json = yield response.json();
     if (appId) {
         json = updateAppRole(json);
     }
@@ -94,29 +80,8 @@ exports.removeAppFromUserRoles = (ctx, appId) => __awaiter(void 0, void 0, void
     const response = yield fetch(checkSlashesInUrl(env.WORKER_URL + `/api/global/roles/${prodAppId}`), request(ctx, {
         method: "DELETE",
     }));
-    return checkResponse(response, "remove app role");
-});
-exports.allGlobalUsers = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
-    const response = yield fetch(checkSlashesInUrl(env.WORKER_URL + "/api/global/users"), 
-    // we don't want to use API key when getting self
-    request(ctx, { method: "GET" }));
-    return checkResponse(response, "get users", { ctx });
-});
-exports.saveGlobalUser = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
-    const response = yield fetch(checkSlashesInUrl(env.WORKER_URL + "/api/global/users"), 
-    // we don't want to use API key when getting self
-    request(ctx, { method: "POST", body: ctx.request.body }));
-    return checkResponse(response, "save user", { ctx });
-});
-exports.deleteGlobalUser = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
-    const response = yield fetch(checkSlashesInUrl(env.WORKER_URL + `/api/global/users/${ctx.params.userId}`), 
-    // we don't want to use API key when getting self
-    request(ctx, { method: "DELETE" }));
-    return checkResponse(response, "delete user", { ctx, body: ctx.request.body });
-});
-exports.readGlobalUser = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
-    const response = yield fetch(checkSlashesInUrl(env.WORKER_URL + `/api/global/users/${ctx.params.userId}`), 
-    // we don't want to use API key when getting self
-    request(ctx, { method: "GET" }));
-    return checkResponse(response, "get user", { ctx });
+    if (response.status !== 200) {
+        throw "Unable to remove app role";
+    }
+    return response.json();
 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/server",
   "email": "hi@budibase.com",
-  "version": "1.0.80-alpha.3",
+  "version": "1.0.80",
   "description": "Budibase Web Server",
   "main": "src/index.ts",
   "repository": {
@@ -21,8 +21,10 @@
     "dev:stack:down": "node scripts/dev/manage.js down",
     "dev:stack:nuke": "node scripts/dev/manage.js nuke",
     "dev:builder": "yarn run dev:stack:up && nodemon",
+    "generate:proxy:compose": "node scripts/proxy/generateProxyConfig compose",
+    "generate:proxy:preprod": "node scripts/proxy/generateProxyConfig preprod",
+    "generate:proxy:prod": "node scripts/proxy/generateProxyConfig prod",
     "format": "prettier --config ../../.prettierrc.json 'src/**/*.ts' --write",
-    "specs": "node specs/generate.js && openapi-typescript specs/openapi.yaml --output src/definitions/openapi.ts",
     "lint": "eslint --fix src/",
     "lint:fix": "yarn run format && yarn run lint",
     "initialise": "node scripts/initialise.js",
@@ -71,9 +73,9 @@
   "license": "GPL-3.0",
   "dependencies": {
     "@apidevtools/swagger-parser": "^10.0.3",
-    "@budibase/backend-core": "^1.0.80-alpha.3",
-    "@budibase/client": "^1.0.80-alpha.3",
-    "@budibase/string-templates": "^1.0.80-alpha.3",
+    "@budibase/backend-core": "^1.0.80",
+    "@budibase/client": "^1.0.80",
+    "@budibase/string-templates": "^1.0.80",
     "@bull-board/api": "^3.7.0",
     "@bull-board/koa": "^3.7.0",
     "@elastic/elasticsearch": "7.10.0",
@@ -108,7 +110,6 @@
     "koa-send": "5.0.0",
     "koa-session": "5.12.0",
     "koa-static": "5.0.0",
-    "koa2-ratelimit": "^1.1.0",
     "lodash": "4.17.21",
     "memorystream": "^0.3.1",
     "mongodb": "3.6.3",
@@ -124,7 +125,6 @@
     "pouchdb-all-dbs": "1.0.2",
     "pouchdb-find": "^7.2.2",
     "pouchdb-replication-stream": "1.2.9",
-    "redis": "4",
     "server-destroy": "1.0.1",
     "svelte": "^3.38.2",
     "swagger-parser": "^10.0.3",
@@ -150,7 +150,6 @@
     "@types/koa-router": "^7.4.2",
     "@types/node": "^15.12.4",
     "@types/oracledb": "^5.2.1",
-    "@types/redis": "^4.0.11",
     "@typescript-eslint/parser": "4.28.0",
     "apidoc": "^0.50.2",
     "babel-jest": "^27.0.2",
@@ -158,15 +157,12 @@
     "docker-compose": "^0.23.6",
     "eslint": "^6.8.0",
     "jest": "^27.0.5",
-    "jest-openapi": "^0.14.2",
     "nodemon": "^2.0.4",
     "openapi-types": "^9.3.1",
-    "openapi-typescript": "^5.2.0",
     "path-to-regexp": "^6.2.0",
     "prettier": "^2.3.1",
     "rimraf": "^3.0.2",
     "supertest": "^4.0.2",
-    "swagger-jsdoc": "^6.1.0",
     "ts-jest": "^27.0.3",
     "ts-node": "^10.0.0",
     "typescript": "^4.3.5",
@@ -175,5 +171,5 @@
   "optionalDependencies": {
     "oracledb": "^5.3.0"
   },
-  "gitHead": "f7de7ed349ad3413966e5790a2801d1e7e306142"
+  "gitHead": "0295a18622fdb95e1d279a0d54962d9e2762bc75"
 }

package/scripts/integrations/mssql/data/setup.sql

@@ -1,10 +1,5 @@
 USE master;
-
-IF NOT EXISTS(SELECT 1 FROM sys.schemas WHERE name = 'Chains')
-BEGIN
-    EXEC sys.sp_executesql N'CREATE SCHEMA Chains;'
-END
-
+  
 IF OBJECT_ID ('dbo.products', 'U') IS NOT NULL  
   DROP TABLE products;  
 GO  
@@ -66,15 +61,3 @@ VALUES ('Bob', '30'),
   ('Bobert', '99'),
   ('Jan', '22'),
   ('Megan', '11');
-
-
-IF OBJECT_ID ('Chains.sizes', 'U') IS NOT NULL
-  DROP TABLE Chains.sizes;
-GO
-CREATE TABLE Chains.sizes
-(
-  sizeid int IDENTITY(1, 1),
-  name varchar(30),
-  CONSTRAINT pk_size PRIMARY KEY NONCLUSTERED (sizeid)
-);
-

package/scripts/integrations/oracle/oracle.md

@@ -8,9 +8,9 @@
 
 To install oracle express edition simply run `docker-compose up`
 
-- A single instance pluggable database (PDB) will be created named `xepdb1`
+- A single instance pluggable database (PDB) will be created named `xepdb`
 - The default password is configured in the compose file as `oracle`
-  - The `system` and `pdbadmin` users share this password
+  - The `system`, `sys` and `pdbadmin` users all share this password
 
 ## Instant Client 
 

package/scripts/integrations/postgres/init.sql

@@ -1,14 +1,11 @@
 SELECT 'CREATE DATABASE main'
 WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'main')\gexec
-CREATE SCHEMA test;
-CREATE TYPE person_job AS ENUM ('qa', 'programmer', 'designer');
 CREATE TABLE Persons (
     PersonID SERIAL PRIMARY KEY,
     LastName varchar(255),
     FirstName varchar(255),
     Address varchar(255),
-    City varchar(255) DEFAULT 'Belfast',
-    Type person_job
+    City varchar(255) DEFAULT 'Belfast'
 );
 CREATE TABLE Tasks (
     TaskID SERIAL PRIMARY KEY,
@@ -38,12 +35,8 @@ CREATE TABLE Products_Tasks (
             REFERENCES Tasks(TaskID),
     PRIMARY KEY (ProductID, TaskID)
 );
-CREATE TABLE test.table1 (
-  id SERIAL PRIMARY KEY,
-  Name varchar(255)
-);
-INSERT INTO Persons (FirstName, LastName, Address, City, Type) VALUES ('Mike', 'Hughes', '123 Fake Street', 'Belfast', 'qa');
-INSERT INTO Persons (FirstName, LastName, Address, City, Type) VALUES ('John', 'Smith', '64 Updown Road', 'Dublin', 'programmer');
+INSERT INTO Persons (FirstName, LastName, Address, City) VALUES ('Mike', 'Hughes', '123 Fake Street', 'Belfast');
+INSERT INTO Persons (FirstName, LastName, Address, City) Values ('John', 'Smith', '64 Updown Road', 'Dublin');
 INSERT INTO Tasks (ExecutorID, QaID, TaskName, Completed) VALUES (1, 2, 'assembling', TRUE);
 INSERT INTO Tasks (ExecutorID, QaID, TaskName, Completed) VALUES (2, 1, 'processing', FALSE);
 INSERT INTO Products (ProductName) VALUES ('Computers');
@@ -53,4 +46,3 @@ INSERT INTO Products_Tasks (ProductID, TaskID) VALUES (1, 1);
 INSERT INTO Products_Tasks (ProductID, TaskID) VALUES (2, 1);
 INSERT INTO Products_Tasks (ProductID, TaskID) VALUES (3, 1);
 INSERT INTO Products_Tasks (ProductID, TaskID) VALUES (1, 2);
-INSERT INTO test.table1 (Name) VALUES ('Test');

package/scripts/likeCypress.ts

@@ -2,13 +2,14 @@
  * This script just makes it easy to re-create        *
  * a cypress like environment for testing the backend *
  ******************************************************/
-import path from "path"
+const path = require("path")
 const tmpdir = path.join(require("os").tmpdir(), ".budibase")
 
-const SERVER_PORT = "4100"
-const WORKER_PORT = "4200"
+const MAIN_PORT = "10001"
+const WORKER_PORT = "10002"
 
 // @ts-ignore
+process.env.PORT = MAIN_PORT
 process.env.BUDIBASE_API_KEY = "6BE826CB-6B30-4AEC-8777-2E90464633DE"
 process.env.NODE_ENV = "cypress"
 process.env.ENABLE_ANALYTICS = "false"
@@ -26,11 +27,7 @@ process.env.ALLOW_DEV_AUTOMATIONS = "1"
 
 // don't make this a variable or top level require
 // it will cause environment module to be loaded prematurely
-
-// override the port with the worker port temporarily
+const server = require("../src/app")
 process.env.PORT = WORKER_PORT
 const worker = require("../../worker/src/index")
-
-// override the port with the server port
-process.env.PORT = SERVER_PORT
-const server = require("../src/app")
+process.env.PORT = MAIN_PORT

package/scripts/proxy/generateProxyConfig.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+const path = require("path")
+const fs = require("fs")
+const { processStringSync } = require("@budibase/string-templates")
+
+const Configs = {
+  prod: {
+    k8s: true,
+    apps: "app-service.budibase.svc.cluster.local",
+    worker: "worker-service.budibase.svc.cluster.local",
+    minio: "minio-service.budibase.svc.cluster.local",
+    couchdb: "budibase-prod-svc-couchdb",
+  },
+  preprod: {
+    k8s: true,
+    apps: "app-service.budibase.svc.cluster.local",
+    worker: "worker-service.budibase.svc.cluster.local",
+    minio: "minio-service.budibase.svc.cluster.local",
+    couchdb: "budibase-preprod-svc-couchdb",
+  },
+  compose: {
+    compose: true,
+    apps: "app-service",
+    worker: "worker-service",
+    minio: "minio-service",
+    couchdb: "couchdb-service",
+    watchtower: "watchtower-service",
+  },
+}
+
+const Commands = {
+  Prod: "prod",
+  Preprod: "preprod",
+  Compose: "compose",
+}
+
+async function init(managementCommand) {
+  const config = Configs[managementCommand]
+  const hostingPath = path.join(process.cwd(), "..", "..", "hosting")
+  const nginxHbsPath = path.join(hostingPath, "nginx.prod.conf.hbs")
+  const nginxOutputPath = path.join(
+    hostingPath,
+    "proxy",
+    ".generated-nginx.prod.conf"
+  )
+  const contents = fs.readFileSync(nginxHbsPath, "utf8")
+  fs.writeFileSync(nginxOutputPath, processStringSync(contents, config))
+}
+
+const managementCommand = process.argv.slice(2)[0]
+
+if (
+  !managementCommand ||
+  !Object.values(Commands).some(command => managementCommand === command)
+) {
+  throw new Error(
+    "You must supply either a 'compose', 'preprod' or 'prod' commmand to generate an NGINX config."
+  )
+}
+
+init(managementCommand)
+  .then(() => {
+    console.log("Done! 🎉")
+  })
+  .catch(err => {
+    console.error(
+      "Something went wrong while creating the nginx configuration",
+      err.message
+    )
+  })

package/src/api/controllers/application.js

@@ -263,7 +263,6 @@ exports.create = async ctx => {
     tenantId: getTenantId(),
     updatedAt: new Date().toISOString(),
     createdAt: new Date().toISOString(),
-    status: AppStatus.DEV,
   }
   const response = await db.put(newApplication, { force: true })
   newApplication._rev = response.rev

package/src/api/controllers/row/ExternalRequest.ts

@@ -58,7 +58,7 @@ module External {
   ) {
     const primary = table.primary
     // if passed in array need to copy for shifting etc
-    let idCopy: undefined | string | any[] = cloneDeep(id)
+    let idCopy = cloneDeep(id)
     if (filters) {
       // need to map over the filters and make sure the _id field isn't present
       for (let filter of Object.values(filters)) {

package/src/api/controllers/row/internal.js

@@ -2,7 +2,6 @@ const linkRows = require("../../../db/linkedRows")
 const {
   generateRowID,
   getRowParams,
-  getTableIDFromRowID,
   DocumentTypes,
   InternalTables,
 } = require("../../../db/utils")
@@ -387,9 +386,6 @@ exports.fetchEnrichedRow = async ctx => {
   let groups = {},
     tables = {}
   for (let row of response) {
-    if (!row.tableId) {
-      row.tableId = getTableIDFromRowID(row._id)
-    }
     const linkedTableId = row.tableId
     if (groups[linkedTableId] == null) {
       groups[linkedTableId] = [row]

package/src/api/controllers/table/index.js

@@ -48,7 +48,7 @@ exports.fetch = async function (ctx) {
 }
 
 exports.find = async function (ctx) {
-  const tableId = ctx.params.tableId
+  const tableId = ctx.params.id
   ctx.body = await getTable(tableId)
 }
 
@@ -70,7 +70,6 @@ exports.destroy = async function (ctx) {
   ctx.eventEmitter &&
     ctx.eventEmitter.emitTable(`table:delete`, appId, deletedTable)
   ctx.status = 200
-  ctx.table = deletedTable
   ctx.body = { message: `Table ${tableId} deleted.` }
 }
 

package/src/api/controllers/webhook.js

@@ -1,7 +1,6 @@
 const { generateWebhookID, getWebhookParams } = require("../../db/utils")
 const toJsonSchema = require("to-json-schema")
 const validate = require("jsonschema").validate
-const { WebhookType } = require("../../constants")
 const triggers = require("../../automations/triggers")
 const { getProdAppID } = require("@budibase/backend-core/db")
 const { getAppDB, updateAppId } = require("@budibase/backend-core/context")
@@ -19,6 +18,10 @@ function Webhook(name, type, target) {
 
 exports.Webhook = Webhook
 
+exports.WebhookType = {
+  AUTOMATION: "automation",
+}
+
 exports.fetch = async ctx => {
   const db = getAppDB()
   const response = await db.allDocs(
@@ -59,7 +62,7 @@ exports.buildSchema = async ctx => {
   const webhook = await db.get(ctx.params.id)
   webhook.bodySchema = toJsonSchema(ctx.request.body)
   // update the automation outputs
-  if (webhook.action.type === WebhookType.AUTOMATION) {
+  if (webhook.action.type === exports.WebhookType.AUTOMATION) {
     let automation = await db.get(webhook.action.target)
     const autoOutputs = automation.definition.trigger.schema.outputs
     let properties = webhook.bodySchema.properties
@@ -89,7 +92,7 @@ exports.trigger = async ctx => {
       validate(ctx.request.body, webhook.bodySchema)
     }
     const target = await db.get(webhook.action.target)
-    if (webhook.action.type === WebhookType.AUTOMATION) {
+    if (webhook.action.type === exports.WebhookType.AUTOMATION) {
       // trigger with both the pure request and then expand it
       // incase the user has produced a schema to bind to
       await triggers.externalTrigger(target, {

package/src/api/index.js

@@ -8,7 +8,7 @@ const {
 const currentApp = require("../middleware/currentapp")
 const compress = require("koa-compress")
 const zlib = require("zlib")
-const { mainRoutes, staticRoutes, publicRoutes } = require("./routes")
+const { mainRoutes, staticRoutes } = require("./routes")
 const pkg = require("../../package.json")
 const env = require("../environment")
 
@@ -82,9 +82,6 @@ for (let route of mainRoutes) {
   router.use(route.allowedMethods())
 }
 
-router.use(publicRoutes.routes())
-router.use(publicRoutes.allowedMethods())
-
 // WARNING - static routes will catch everything else after them this must be last
 router.use(staticRoutes.routes())
 router.use(staticRoutes.allowedMethods())

package/src/api/routes/automation.js

@@ -1,20 +1,50 @@
 const Router = require("@koa/router")
 const controller = require("../controllers/automation")
 const authorized = require("../../middleware/authorized")
+const joiValidator = require("../../middleware/joi-validator")
 const {
   BUILDER,
   PermissionLevels,
   PermissionTypes,
 } = require("@budibase/backend-core/permissions")
+const Joi = require("joi")
 const { bodyResource, paramResource } = require("../../middleware/resourceId")
 const {
   middleware: appInfoMiddleware,
   AppType,
 } = require("../../middleware/appInfo")
-const { automationValidator } = require("./utils/validators")
 
 const router = Router()
 
+// prettier-ignore
+function generateStepSchema(allowStepTypes) {
+  return Joi.object({
+    stepId: Joi.string().required(),
+    id: Joi.string().required(),
+    description: Joi.string().required(),
+    name: Joi.string().required(),
+    tagline: Joi.string().required(),
+    icon: Joi.string().required(),
+    params: Joi.object(),
+    args: Joi.object(),
+    type: Joi.string().required().valid(...allowStepTypes),
+  }).unknown(true)
+}
+
+function generateValidator(existing = false) {
+  // prettier-ignore
+  return joiValidator.body(Joi.object({
+    _id: existing ? Joi.string().required() : Joi.string(),
+    _rev: existing ? Joi.string().required() : Joi.string(),
+    name: Joi.string().required(),
+    type: Joi.string().valid("automation").required(),
+    definition: Joi.object({
+      steps: Joi.array().required().items(generateStepSchema(["ACTION", "LOGIC"])),
+      trigger: generateStepSchema(["TRIGGER"]).allow(null),
+    }).required().unknown(true),
+  }).unknown(true))
+}
+
 router
   .get(
     "/api/automations/trigger/list",
@@ -42,13 +72,13 @@ router
     "/api/automations",
     bodyResource("_id"),
     authorized(BUILDER),
-    automationValidator(true),
+    generateValidator(true),
     controller.update
   )
   .post(
     "/api/automations",
     authorized(BUILDER),
-    automationValidator(false),
+    generateValidator(false),
     controller.create
   )
   .delete(

package/src/api/routes/datasource.js

@@ -1,18 +1,64 @@
 const Router = require("@koa/router")
 const datasourceController = require("../controllers/datasource")
 const authorized = require("../../middleware/authorized")
+const joiValidator = require("../../middleware/joi-validator")
 const {
   BUILDER,
   PermissionLevels,
   PermissionTypes,
 } = require("@budibase/backend-core/permissions")
-const {
-  datasourceValidator,
-  datasourceQueryValidator,
-} = require("./utils/validators")
+const Joi = require("joi")
+const { DataSourceOperation } = require("../../constants")
 
 const router = Router()
 
+function generateDatasourceSchema() {
+  // prettier-ignore
+  return joiValidator.body(Joi.object({
+    _id: Joi.string(),
+    _rev: Joi.string(),
+    // source: Joi.string().valid("POSTGRES_PLUS"),
+    type: Joi.string().allow("datasource_plus"),
+    relationships: Joi.array().items(Joi.object({
+      from: Joi.string().required(),
+      to: Joi.string().required(),
+      cardinality: Joi.valid("1:N", "1:1", "N:N").required()
+    })),
+    // entities: Joi.array().items(Joi.object({
+    //   type: Joi.string().valid(...Object.values(FieldTypes)).required(),
+    //   name: Joi.string().required(),
+    // })),
+  }).unknown(true))
+}
+
+function generateQueryDatasourceSchema() {
+  // prettier-ignore
+  return joiValidator.body(Joi.object({
+    endpoint: Joi.object({
+      datasourceId: Joi.string().required(),
+      operation: Joi.string().required().valid(...Object.values(DataSourceOperation)),
+      entityId: Joi.string().required(),
+    }).required(),
+    resource: Joi.object({
+      fields: Joi.array().items(Joi.string()).optional(),
+    }).optional(),
+    body: Joi.object().optional(),
+    sort: Joi.object().optional(),
+    filters: Joi.object({
+      string: Joi.object().optional(),
+      range: Joi.object().optional(),
+      equal: Joi.object().optional(),
+      notEqual: Joi.object().optional(),
+      empty: Joi.object().optional(),
+      notEmpty: Joi.object().optional(),
+    }).optional(),
+    paginate: Joi.object({
+      page: Joi.string().alphanum().optional(),
+      limit: Joi.number().optional(),
+    }).optional(),
+  }))
+}
+
 router
   .get("/api/datasources", authorized(BUILDER), datasourceController.fetch)
   .get(
@@ -28,7 +74,7 @@ router
   .post(
     "/api/datasources/query",
     authorized(PermissionTypes.TABLE, PermissionLevels.READ),
-    datasourceQueryValidator(),
+    generateQueryDatasourceSchema(),
     datasourceController.query
   )
   .post(
@@ -39,7 +85,7 @@ router
   .post(
     "/api/datasources",
     authorized(BUILDER),
-    datasourceValidator(),
+    generateDatasourceSchema(),
     datasourceController.save
   )
   .delete(

package/src/api/routes/index.js

@@ -25,7 +25,6 @@ const metadataRoutes = require("./metadata")
 const devRoutes = require("./dev")
 const cloudRoutes = require("./cloud")
 const migrationRoutes = require("./migrations")
-const publicRoutes = require("./public")
 
 exports.mainRoutes = [
   authRoutes,
@@ -58,5 +57,4 @@ exports.mainRoutes = [
   migrationRoutes,
 ]
 
-exports.publicRoutes = publicRoutes
 exports.staticRoutes = staticRoutes

package/src/api/routes/permission.js

@@ -1,11 +1,25 @@
 const Router = require("@koa/router")
 const controller = require("../controllers/permission")
 const authorized = require("../../middleware/authorized")
-const { BUILDER } = require("@budibase/backend-core/permissions")
-const { permissionValidator } = require("./utils/validators")
+const {
+  BUILDER,
+  PermissionLevels,
+} = require("@budibase/backend-core/permissions")
+const Joi = require("joi")
+const joiValidator = require("../../middleware/joi-validator")
 
 const router = Router()
 
+function generateValidator() {
+  const permLevelArray = Object.values(PermissionLevels)
+  // prettier-ignore
+  return joiValidator.params(Joi.object({
+    level: Joi.string().valid(...permLevelArray).required(),
+    resourceId: Joi.string(),
+    roleId: Joi.string(),
+  }).unknown(true))
+}
+
 router
   .get("/api/permission/builtin", authorized(BUILDER), controller.fetchBuiltin)
   .get("/api/permission/levels", authorized(BUILDER), controller.fetchLevels)
@@ -19,14 +33,14 @@ router
   .post(
     "/api/permission/:roleId/:resourceId/:level",
     authorized(BUILDER),
-    permissionValidator(),
+    generateValidator(),
     controller.addPermission
   )
   // deleting the level defaults it back the underlying access control for the resource
   .delete(
     "/api/permission/:roleId/:resourceId/:level",
     authorized(BUILDER),
-    permissionValidator(),
+    generateValidator(),
     controller.removePermission
   )