@budibase/server 1.0.93 → 1.0.96

package/dist/api/routes/static.js

@@ -42,7 +42,6 @@ router
     .get("/builder/:file*", controller.serveBuilder)
     .post("/api/attachments/process", authorized(BUILDER), controller.uploadFile)
     .post("/api/attachments/:tableId/upload", paramResource("tableId"), authorized(PermissionTypes.TABLE, PermissionLevels.WRITE), controller.uploadFile)
-    // TODO: this likely needs to be secured in some way
-    .get("/:appId/:path*", controller.serveApp)
+    .get("/app/:appUrl/:path*", controller.serveApp)
     .post("/api/attachments/:datasourceId/url", authorized(PermissionTypes.TABLE, PermissionLevels.READ), controller.getSignedUploadURL);
 module.exports = router;

package/dist/automations/steps/queryRows.js

@@ -93,7 +93,7 @@ exports.run = function ({ inputs, appId }) {
         const { tableId, filters, sortColumn, sortOrder, limit } = inputs;
         const table = yield getTable(appId, tableId);
         let sortType = FieldTypes.STRING;
-        if (table && table.schema && sortColumn) {
+        if (table && table.schema && table.schema[sortColumn] && sortColumn) {
             const fieldType = table.schema[sortColumn].type;
             sortType =
                 fieldType === FieldTypes.NUMBER ? FieldTypes.NUMBER : FieldTypes.STRING;

package/dist/db/views/staticViews.js

@@ -36,6 +36,7 @@ exports.createLinkView = () => __awaiter(void 0, void 0, void 0, function* () {
             if (doc.type === "link") {
                 let doc1 = doc.doc1;
                 let doc2 = doc.doc2;
+                // eslint-disable-next-line no-undef
                 emit([doc1.tableId, doc1.rowId], {
                     id: doc2.rowId,
                     thisId: doc1.rowId,
@@ -43,6 +44,7 @@ exports.createLinkView = () => __awaiter(void 0, void 0, void 0, function* () {
                 });
                 // if linking to same table can't emit twice
                 if (doc1.tableId !== doc2.tableId) {
+                    // eslint-disable-next-line no-undef
                     emit([doc2.tableId, doc2.rowId], {
                         id: doc1.rowId,
                         thisId: doc2.rowId,

package/dist/environment.js

@@ -62,6 +62,7 @@ module.exports = {
     ALLOW_DEV_AUTOMATIONS: process.env.ALLOW_DEV_AUTOMATIONS,
     DISABLE_THREADING: process.env.DISABLE_THREADING,
     QUERY_THREAD_TIMEOUT: process.env.QUERY_THREAD_TIMEOUT,
+    SQL_MAX_ROWS: process.env.SQL_MAX_ROWS,
     _set(key, value) {
         process.env[key] = value;
         module.exports[key] = value;

package/dist/integrations/base/sql.js

@@ -16,7 +16,11 @@ const knex_1 = require("knex");
 const datasource_1 = require("../../definitions/datasource");
 const utils_1 = require("../utils");
 const sqlTable_1 = __importDefault(require("./sqlTable"));
-const BASE_LIMIT = 5000;
+const environment_1 = __importDefault(require("../../environment"));
+const envLimit = environment_1.default.SQL_MAX_ROWS
+    ? parseInt(environment_1.default.SQL_MAX_ROWS)
+    : null;
+const BASE_LIMIT = envLimit || 5000;
 // these are invalid dates sent by the client, need to convert them to a real max date
 const MIN_ISO_DATE = "0000-00-00T00:00:00.000Z";
 const MAX_ISO_DATE = "9999-00-00T00:00:00.000Z";

package/dist/middleware/currentapp.js

@@ -8,7 +8,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-const { getAppId, setCookie, getCookie, clearCookie, } = require("@budibase/backend-core/utils");
+const { getAppIdFromCtx, setCookie, getCookie, clearCookie, } = require("@budibase/backend-core/utils");
 const { Cookies } = require("@budibase/backend-core/constants");
 const { getRole } = require("@budibase/backend-core/roles");
 const { BUILTIN_ROLE_IDS } = require("@budibase/backend-core/roles");
@@ -21,7 +21,7 @@ const { isWebhookEndpoint } = require("./utils");
 const { doInAppContext } = require("@budibase/backend-core/context");
 module.exports = (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
     // try to get the appID from the request
-    let requestAppId = getAppId(ctx);
+    let requestAppId = yield getAppIdFromCtx(ctx);
     // get app cookie if it exists
     let appCookie = null;
     try {
@@ -70,19 +70,20 @@ module.exports = (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
         return next();
     }
     return doInAppContext(appId, () => __awaiter(void 0, void 0, void 0, function* () {
-        let noCookieSet = false;
+        let skipCookie = false;
         // if the user not in the right tenant then make sure they have no permissions
         // need to judge this only based on the request app ID,
         if (env.MULTI_TENANCY &&
             ctx.user &&
             requestAppId &&
-            !isUserInAppTenant(requestAppId)) {
+            !isUserInAppTenant(requestAppId, ctx.user)) {
             // don't error, simply remove the users rights (they are a public user)
             delete ctx.user.builder;
             delete ctx.user.admin;
             delete ctx.user.roles;
+            ctx.isAuthenticated = false;
             roleId = BUILTIN_ROLE_IDS.PUBLIC;
-            noCookieSet = true;
+            skipCookie = true;
         }
         ctx.appId = appId;
         if (roleId) {
@@ -96,7 +97,7 @@ module.exports = (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
         if ((requestAppId !== appId ||
             appCookie == null ||
             appCookie.appId !== requestAppId) &&
-            !noCookieSet) {
+            !skipCookie) {
             setCookie(ctx, { appId }, Cookies.CurrentApp);
         }
         return next();

package/dist/middleware/publicApi.js

@@ -9,10 +9,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 const { Headers } = require("@budibase/backend-core/constants");
-const { getAppId } = require("@budibase/backend-core/utils");
+const { getAppIdFromCtx } = require("@budibase/backend-core/utils");
 module.exports = function ({ requiresAppId } = {}) {
     return (ctx, next) => __awaiter(this, void 0, void 0, function* () {
-        const appId = getAppId(ctx);
+        const appId = yield getAppIdFromCtx(ctx);
         if (requiresAppId && !appId) {
             ctx.throw(400, `Invalid app ID provided, please check the ${Headers.APP_ID} header.`);
         }

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@budibase/server",
     "email": "hi@budibase.com",
-    "version": "1.0.92",
+    "version": "1.0.95",
     "description": "Budibase Web Server",
     "main": "src/index.ts",
     "repository": {
@@ -21,10 +21,7 @@
         "dev:stack:down": "node scripts/dev/manage.js down",
         "dev:stack:nuke": "node scripts/dev/manage.js nuke",
         "dev:builder": "yarn run dev:stack:up && nodemon",
-        "format": "prettier --config ../../.prettierrc.json 'src/**/*.ts' --write",
         "specs": "node specs/generate.js && openapi-typescript specs/openapi.yaml --output src/definitions/openapi.ts",
-        "lint": "eslint --fix src/",
-        "lint:fix": "yarn run format && yarn run lint",
         "initialise": "node scripts/initialise.js",
         "env:multi:enable": "node scripts/multiTenancy.js enable",
         "env:multi:disable": "node scripts/multiTenancy.js disable",
@@ -71,9 +68,9 @@
     "license": "GPL-3.0",
     "dependencies": {
         "@apidevtools/swagger-parser": "^10.0.3",
-        "@budibase/backend-core": "^1.0.92",
-        "@budibase/client": "^1.0.92",
-        "@budibase/string-templates": "^1.0.92",
+        "@budibase/backend-core": "^1.0.95",
+        "@budibase/client": "^1.0.95",
+        "@budibase/string-templates": "^1.0.95",
         "@bull-board/api": "^3.7.0",
         "@bull-board/koa": "^3.7.0",
         "@elastic/elasticsearch": "7.10.0",
@@ -151,7 +148,6 @@
         "@types/node": "^15.12.4",
         "@types/oracledb": "^5.2.1",
         "@types/redis": "^4.0.11",
-        "@typescript-eslint/parser": "4.28.0",
         "apidoc": "^0.50.2",
         "babel-jest": "^27.0.2",
         "copyfiles": "^2.4.1",

package/dist/tests/utilities/TestConfiguration.js

@@ -75,7 +75,7 @@ class TestConfiguration {
                 });
             }
             // check if already in a context
-            if (context.getAppId() == null) {
+            if (context.getAppId() == null && this.appId !== null) {
                 return context.doInAppContext(this.appId, () => __awaiter(this, void 0, void 0, function* () {
                     return run();
                 }));

package/dist/threads/query.js

@@ -38,10 +38,11 @@ class QueryRunner {
             return fields;
         }
         const bindings = findHBSBlocks(sql);
-        let variables = [];
+        let variables = [], arrays = [];
         for (let binding of bindings) {
-            let variable = integration.getBindingIdentifier();
-            variables.push(binding);
+            // look for array/list operations in the SQL statement, which will need handled later
+            const listRegex = new RegExp(`(in|IN|In|iN)( )+${binding}`);
+            const listRegexMatch = sql.match(listRegex);
             // check if the variable was used as part of a string concat e.g. 'Hello {{binding}}'
             const charConstRegex = new RegExp(`'[^']*${binding}[^']*'`);
             const charConstMatch = sql.match(charConstRegex);
@@ -49,15 +50,41 @@ class QueryRunner {
                 let [part1, part2] = charConstMatch[0].split(binding);
                 part1 = `'${part1.substring(1)}'`;
                 part2 = `'${part2.substring(0, part2.length - 1)}'`;
-                sql = sql.replace(charConstMatch[0], integration.getStringConcat([part1, variable, part2]));
+                sql = sql.replace(charConstMatch[0], integration.getStringConcat([
+                    part1,
+                    integration.getBindingIdentifier(),
+                    part2,
+                ]));
+            }
+            // generate SQL parameterised array
+            else if (listRegexMatch) {
+                arrays.push(binding);
+                // determine the length of the array
+                const value = this.enrichQueryFields([binding], parameters)[0].split(",");
+                // build a string like ($1, $2, $3)
+                sql = sql.replace(binding, `(${Array.apply(null, Array(value.length))
+                    .map(() => integration.getBindingIdentifier())
+                    .join(",")})`);
             }
             else {
-                sql = sql.replace(binding, variable);
+                sql = sql.replace(binding, integration.getBindingIdentifier());
             }
+            variables.push(binding);
         }
         // replicate the knex structure
         fields.sql = sql;
         fields.bindings = this.enrichQueryFields(variables, parameters);
+        // check for arrays in the data
+        let updated = [];
+        for (let i = 0; i < variables.length; i++) {
+            if (arrays.includes(variables[i])) {
+                updated = updated.concat(fields.bindings[i].split(","));
+            }
+            else {
+                updated.push(fields.bindings[i]);
+            }
+        }
+        fields.bindings = updated;
         return fields;
     }
     execute() {