@budibase/server 1.0.93 → 1.0.96

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/server",
   "email": "hi@budibase.com",
-  "version": "1.0.93",
+  "version": "1.0.96",
   "description": "Budibase Web Server",
   "main": "src/index.ts",
   "repository": {
@@ -21,10 +21,7 @@
     "dev:stack:down": "node scripts/dev/manage.js down",
     "dev:stack:nuke": "node scripts/dev/manage.js nuke",
     "dev:builder": "yarn run dev:stack:up && nodemon",
-    "format": "prettier --config ../../.prettierrc.json 'src/**/*.ts' --write",
     "specs": "node specs/generate.js && openapi-typescript specs/openapi.yaml --output src/definitions/openapi.ts",
-    "lint": "eslint --fix src/",
-    "lint:fix": "yarn run format && yarn run lint",
     "initialise": "node scripts/initialise.js",
     "env:multi:enable": "node scripts/multiTenancy.js enable",
     "env:multi:disable": "node scripts/multiTenancy.js disable",
@@ -71,9 +68,9 @@
   "license": "GPL-3.0",
   "dependencies": {
     "@apidevtools/swagger-parser": "^10.0.3",
-    "@budibase/backend-core": "^1.0.93",
-    "@budibase/client": "^1.0.93",
-    "@budibase/string-templates": "^1.0.93",
+    "@budibase/backend-core": "^1.0.96",
+    "@budibase/client": "^1.0.96",
+    "@budibase/string-templates": "^1.0.96",
     "@bull-board/api": "^3.7.0",
     "@bull-board/koa": "^3.7.0",
     "@elastic/elasticsearch": "7.10.0",
@@ -151,7 +148,6 @@
     "@types/node": "^15.12.4",
     "@types/oracledb": "^5.2.1",
     "@types/redis": "^4.0.11",
-    "@typescript-eslint/parser": "4.28.0",
     "apidoc": "^0.50.2",
     "babel-jest": "^27.0.2",
     "copyfiles": "^2.4.1",
@@ -175,5 +171,5 @@
   "optionalDependencies": {
     "oracledb": "^5.3.0"
   },
-  "gitHead": "38f53a4148845f1aded8a72311363032c177d2c6"
+  "gitHead": "eecd09718a3d1561324234b34faf4b8a4579d6ea"
 }

package/scripts/integrations/customer-categories/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   db:
     container_name: postgres
     image: postgres
-    restart: always
+    restart: unless-stopped
     environment:
       POSTGRES_USER: root
       POSTGRES_PASSWORD: root
@@ -17,7 +17,7 @@ services:
   pgadmin:
     container_name: pgadmin-pg
     image: dpage/pgadmin4
-    restart: always
+    restart: unless-stopped
     environment:
       PGADMIN_DEFAULT_EMAIL: root@root.com
       PGADMIN_DEFAULT_PASSWORD: root

package/scripts/integrations/oracle/docker-compose.yml

@@ -4,7 +4,7 @@
 version: "3.8"
 services:
   db:
-    restart: always
+    restart: unless-stopped
     platform: linux/x86_64
     image: container-registry.oracle.com/database/express:18.4.0-xe
     environment:

package/scripts/integrations/postgres/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   db:
     container_name: postgres
     image: postgres
-    restart: always
+    restart: unless-stopped
     environment:
       POSTGRES_USER: root
       POSTGRES_PASSWORD: root
@@ -17,7 +17,7 @@ services:
   pgadmin:
     container_name: pgadmin-pg
     image: dpage/pgadmin4
-    restart: always
+    restart: unless-stopped
     environment:
       PGADMIN_DEFAULT_EMAIL: root@root.com
       PGADMIN_DEFAULT_PASSWORD: root

package/scripts/integrations/service-vehicles/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   db:
     container_name: postgres-vehicle
     image: postgres
-    restart: always
+    restart: unless-stopped
     environment:
       POSTGRES_USER: root
       POSTGRES_PASSWORD: root
@@ -17,7 +17,7 @@ services:
   pgadmin:
     container_name: pgadmin
     image: dpage/pgadmin4
-    restart: always
+    restart: unless-stopped
     environment:
       PGADMIN_DEFAULT_EMAIL: root@root.com
       PGADMIN_DEFAULT_PASSWORD: root

package/src/api/controllers/auth.js

@@ -7,7 +7,7 @@ const { getAppDB, getAppId } = require("@budibase/backend-core/context")
 exports.fetchSelf = async ctx => {
   let userId = ctx.user.userId || ctx.user._id
   /* istanbul ignore next */
-  if (!userId) {
+  if (!userId || !ctx.isAuthenticated) {
     ctx.body = {}
     return
   }

package/src/api/controllers/static/index.js

@@ -5,7 +5,6 @@ const { resolve, join } = require("../../../utilities/centralPath")
 const uuid = require("uuid")
 const { ObjectStoreBuckets } = require("../../../constants")
 const { processString } = require("@budibase/string-templates")
-const { getAllApps } = require("@budibase/backend-core/db")
 const {
   loadHandlebarsFile,
   NODE_MODULES_PATH,
@@ -16,7 +15,7 @@ const { clientLibraryPath } = require("../../../utilities")
 const { upload } = require("../../../utilities/fileSystem")
 const { attachmentsRelativeURL } = require("../../../utilities")
 const { DocumentTypes } = require("../../../db/utils")
-const { getAppDB, updateAppId } = require("@budibase/backend-core/context")
+const { getAppDB, getAppId } = require("@budibase/backend-core/context")
 const AWS = require("aws-sdk")
 const AWS_REGION = env.AWS_REGION ? env.AWS_REGION : "eu-west-1"
 
@@ -39,21 +38,6 @@ async function prepareUpload({ s3Key, bucket, metadata, file }) {
   }
 }
 
-async function getAppIdFromUrl(ctx) {
-  // the "appId" component of the URL can be the id or the custom url
-  let possibleAppUrl = `/${encodeURI(ctx.params.appId).toLowerCase()}`
-
-  // search prod apps for a url that matches, exclude dev where id is always used
-  const apps = await getAllApps({ dev: false })
-  const app = apps.filter(
-    a => a.url && a.url.toLowerCase() === possibleAppUrl
-  )[0]
-
-  const appId = app && app.appId ? app.appId : ctx.params.appId
-  updateAppId(appId)
-  return appId
-}
-
 exports.serveBuilder = async function (ctx) {
   let builderPath = resolve(TOP_LEVEL_PATH, "builder")
   await send(ctx, ctx.file, { root: builderPath })
@@ -81,10 +65,10 @@ exports.uploadFile = async function (ctx) {
 }
 
 exports.serveApp = async function (ctx) {
-  let appId = await getAppIdFromUrl(ctx)
   const App = require("./templates/BudibaseApp.svelte").default
   const db = getAppDB({ skip_setup: true })
   const appInfo = await db.get(DocumentTypes.APP_METADATA)
+  let appId = getAppId()
 
   const { head, html, css } = App.render({
     title: appInfo.name,

package/src/api/index.js

@@ -3,7 +3,6 @@ const {
   buildAuthMiddleware,
   auditLog,
   buildTenancyMiddleware,
-  buildAppTenancyMiddleware,
 } = require("@budibase/backend-core/auth")
 const currentApp = require("../middleware/currentapp")
 const compress = require("koa-compress")
@@ -14,6 +13,9 @@ const env = require("../environment")
 
 const router = new Router()
 
+router.get("/health", ctx => (ctx.status = 200))
+router.get("/version", ctx => (ctx.body = pkg.version))
+
 router
   .use(
     compress({
@@ -34,8 +36,6 @@ router
     }
     await next()
   })
-  .use("/health", ctx => (ctx.status = 200))
-  .use("/version", ctx => (ctx.body = pkg.version))
   // re-direct before any middlewares occur
   .redirect("/", "/builder")
   .use(
@@ -52,8 +52,6 @@ router
     })
   )
   .use(currentApp)
-  // this middleware will try to use the app ID to determine the tenancy
-  .use(buildAppTenancyMiddleware())
   .use(auditLog)
 
 // error handling middleware
@@ -74,8 +72,6 @@ router.use(async (ctx, next) => {
   }
 })
 
-router.get("/health", ctx => (ctx.status = 200))
-
 // authenticated routes
 for (let route of mainRoutes) {
   router.use(route.routes())

package/src/api/routes/static.js

@@ -44,8 +44,7 @@ router
     authorized(PermissionTypes.TABLE, PermissionLevels.WRITE),
     controller.uploadFile
   )
-  // TODO: this likely needs to be secured in some way
-  .get("/:appId/:path*", controller.serveApp)
+  .get("/app/:appUrl/:path*", controller.serveApp)
   .post(
     "/api/attachments/:datasourceId/url",
     authorized(PermissionTypes.TABLE, PermissionLevels.READ),

package/src/automations/steps/queryRows.js

@@ -85,7 +85,7 @@ exports.run = async function ({ inputs, appId }) {
   const { tableId, filters, sortColumn, sortOrder, limit } = inputs
   const table = await getTable(appId, tableId)
   let sortType = FieldTypes.STRING
-  if (table && table.schema && sortColumn) {
+  if (table && table.schema && table.schema[sortColumn] && sortColumn) {
     const fieldType = table.schema[sortColumn].type
     sortType =
       fieldType === FieldTypes.NUMBER ? FieldTypes.NUMBER : FieldTypes.STRING

package/src/db/views/staticViews.js

@@ -33,6 +33,7 @@ exports.createLinkView = async () => {
       if (doc.type === "link") {
         let doc1 = doc.doc1
         let doc2 = doc.doc2
+        // eslint-disable-next-line no-undef
         emit([doc1.tableId, doc1.rowId], {
           id: doc2.rowId,
           thisId: doc1.rowId,
@@ -40,6 +41,7 @@ exports.createLinkView = async () => {
         })
         // if linking to same table can't emit twice
         if (doc1.tableId !== doc2.tableId) {
+          // eslint-disable-next-line no-undef
           emit([doc2.tableId, doc2.rowId], {
             id: doc1.rowId,
             thisId: doc2.rowId,

package/src/environment.js

@@ -70,6 +70,7 @@ module.exports = {
   ALLOW_DEV_AUTOMATIONS: process.env.ALLOW_DEV_AUTOMATIONS,
   DISABLE_THREADING: process.env.DISABLE_THREADING,
   QUERY_THREAD_TIMEOUT: process.env.QUERY_THREAD_TIMEOUT,
+  SQL_MAX_ROWS: process.env.SQL_MAX_ROWS,
   _set(key, value) {
     process.env[key] = value
     module.exports[key] = value

package/src/integrations/base/sql.ts

@@ -9,8 +9,12 @@ import {
 } from "../../definitions/datasource"
 import { isIsoDateString, SqlClients } from "../utils"
 import SqlTableQueryBuilder from "./sqlTable"
+import environment from "../../environment"
 
-const BASE_LIMIT = 5000
+const envLimit = environment.SQL_MAX_ROWS
+  ? parseInt(environment.SQL_MAX_ROWS)
+  : null
+const BASE_LIMIT = envLimit || 5000
 
 type KnexQuery = Knex.QueryBuilder | Knex
 // these are invalid dates sent by the client, need to convert them to a real max date

package/src/middleware/currentapp.js

@@ -1,5 +1,5 @@
 const {
-  getAppId,
+  getAppIdFromCtx,
   setCookie,
   getCookie,
   clearCookie,
@@ -17,7 +17,7 @@ const { doInAppContext } = require("@budibase/backend-core/context")
 
 module.exports = async (ctx, next) => {
   // try to get the appID from the request
-  let requestAppId = getAppId(ctx)
+  let requestAppId = await getAppIdFromCtx(ctx)
   // get app cookie if it exists
   let appCookie = null
   try {
@@ -71,21 +71,22 @@ module.exports = async (ctx, next) => {
   }
 
   return doInAppContext(appId, async () => {
-    let noCookieSet = false
+    let skipCookie = false
     // if the user not in the right tenant then make sure they have no permissions
     // need to judge this only based on the request app ID,
     if (
       env.MULTI_TENANCY &&
       ctx.user &&
       requestAppId &&
-      !isUserInAppTenant(requestAppId)
+      !isUserInAppTenant(requestAppId, ctx.user)
     ) {
       // don't error, simply remove the users rights (they are a public user)
       delete ctx.user.builder
       delete ctx.user.admin
       delete ctx.user.roles
+      ctx.isAuthenticated = false
       roleId = BUILTIN_ROLE_IDS.PUBLIC
-      noCookieSet = true
+      skipCookie = true
     }
 
     ctx.appId = appId
@@ -105,7 +106,7 @@ module.exports = async (ctx, next) => {
       (requestAppId !== appId ||
         appCookie == null ||
         appCookie.appId !== requestAppId) &&
-      !noCookieSet
+      !skipCookie
     ) {
       setCookie(ctx, { appId }, Cookies.CurrentApp)
     }

package/src/middleware/publicApi.js

@@ -1,9 +1,9 @@
 const { Headers } = require("@budibase/backend-core/constants")
-const { getAppId } = require("@budibase/backend-core/utils")
+const { getAppIdFromCtx } = require("@budibase/backend-core/utils")
 
 module.exports = function ({ requiresAppId } = {}) {
   return async (ctx, next) => {
-    const appId = getAppId(ctx)
+    const appId = await getAppIdFromCtx(ctx)
     if (requiresAppId && !appId) {
       ctx.throw(
         400,

package/src/middleware/tests/authorized.spec.js

@@ -35,9 +35,7 @@ class TestConfiguration {
   }
 
   executeMiddleware() {
-    return doInAppContext(APP_ID, () => {
-      return this.middleware(this.ctx, this.next)
-    })
+    return this.middleware(this.ctx, this.next)
   }
 
   setUser(user) {

package/src/middleware/tests/currentapp.spec.js

@@ -38,7 +38,7 @@ function mockAuthWithNoCookie() {
     },
   }))
   jest.mock("@budibase/backend-core/utils", () => ({
-    getAppId: jest.fn(),
+    getAppIdFromCtx: jest.fn(),
     setCookie: jest.fn(),
     getCookie: jest.fn(),
   }))
@@ -51,7 +51,7 @@ function mockAuthWithCookie() {
   jest.resetModules()
   mockWorker()
   jest.mock("@budibase/backend-core/utils", () => ({
-    getAppId: () => {
+    getAppIdFromCtx: () => {
       return "app_test"
     },
     setCookie: jest.fn(),
@@ -143,7 +143,7 @@ describe("Current app middleware", () => {
     it("should perform correct when no cookie exists", async () => {
       mockReset()
       jest.mock("@budibase/backend-core/utils", () => ({
-        getAppId: () => {
+        getAppIdFromCtx: () => {
           return "app_test"
         },
         setCookie: jest.fn(),
@@ -158,7 +158,7 @@ describe("Current app middleware", () => {
     it("lastly check what occurs when cookie doesn't need updated", async () => {
       mockReset()
       jest.mock("@budibase/backend-core/utils", () => ({
-        getAppId: () => {
+        getAppIdFromCtx: () => {
           return "app_test"
         },
         setCookie: jest.fn(),

package/src/tests/utilities/TestConfiguration.js

@@ -80,7 +80,7 @@ class TestConfiguration {
       return request.body
     }
     // check if already in a context
-    if (context.getAppId() == null) {
+    if (context.getAppId() == null && this.appId !== null) {
       return context.doInAppContext(this.appId, async () => {
         return run()
       })

package/src/threads/query.js

@@ -33,10 +33,12 @@ class QueryRunner {
       return fields
     }
     const bindings = findHBSBlocks(sql)
-    let variables = []
+    let variables = [],
+      arrays = []
     for (let binding of bindings) {
-      let variable = integration.getBindingIdentifier()
-      variables.push(binding)
+      // look for array/list operations in the SQL statement, which will need handled later
+      const listRegex = new RegExp(`(in|IN|In|iN)( )+${binding}`)
+      const listRegexMatch = sql.match(listRegex)
       // check if the variable was used as part of a string concat e.g. 'Hello {{binding}}'
       const charConstRegex = new RegExp(`'[^']*${binding}[^']*'`)
       const charConstMatch = sql.match(charConstRegex)
@@ -46,15 +48,45 @@ class QueryRunner {
         part2 = `'${part2.substring(0, part2.length - 1)}'`
         sql = sql.replace(
           charConstMatch[0],
-          integration.getStringConcat([part1, variable, part2])
+          integration.getStringConcat([
+            part1,
+            integration.getBindingIdentifier(),
+            part2,
+          ])
+        )
+      }
+      // generate SQL parameterised array
+      else if (listRegexMatch) {
+        arrays.push(binding)
+        // determine the length of the array
+        const value = this.enrichQueryFields([binding], parameters)[0].split(
+          ","
+        )
+        // build a string like ($1, $2, $3)
+        sql = sql.replace(
+          binding,
+          `(${Array.apply(null, Array(value.length))
+            .map(() => integration.getBindingIdentifier())
+            .join(",")})`
         )
       } else {
-        sql = sql.replace(binding, variable)
+        sql = sql.replace(binding, integration.getBindingIdentifier())
       }
+      variables.push(binding)
     }
     // replicate the knex structure
     fields.sql = sql
     fields.bindings = this.enrichQueryFields(variables, parameters)
+    // check for arrays in the data
+    let updated = []
+    for (let i = 0; i < variables.length; i++) {
+      if (arrays.includes(variables[i])) {
+        updated = updated.concat(fields.bindings[i].split(","))
+      } else {
+        updated.push(fields.bindings[i])
+      }
+    }
+    fields.bindings = updated
     return fields
   }
 

package/.eslintrc

@@ -1,13 +0,0 @@
-{
-  "globals": {
-    "emit": true,
-    "key": true
-  },
-  "parser": "@typescript-eslint/parser",
-  "env": {
-    "node": true
-  },
-  "extends": ["eslint:recommended"],
-  "rules": {
-  }
-}