@budibase/server 1.0.95 → 1.0.96

package/coverage/lcov.info

@@ -1,55 +1,52 @@
 TN:
 SF:src/api/index.js
-FN:30,(anonymous_0)
-FN:37,(anonymous_1)
-FN:38,(anonymous_2)
-FN:60,(anonymous_3)
-FN:77,(anonymous_4)
-FNF:5
+FN:16,(anonymous_0)
+FN:17,(anonymous_1)
+FN:32,(anonymous_2)
+FN:58,(anonymous_3)
+FNF:4
 FNH:4
-FNDA:190,(anonymous_0)
+FNDA:1,(anonymous_0)
 FNDA:1,(anonymous_1)
-FNDA:1,(anonymous_2)
+FNDA:188,(anonymous_2)
 FNDA:186,(anonymous_3)
-FNDA:0,(anonymous_4)
 DA:1,24
+DA:6,24
 DA:7,24
 DA:8,24
 DA:9,24
 DA:10,24
 DA:11,24
 DA:12,24
-DA:13,24
-DA:15,24
+DA:14,24
+DA:16,24
 DA:17,24
-DA:31,190
-DA:35,190
-DA:37,1
-DA:38,1
-DA:60,24
-DA:61,186
-DA:62,186
-DA:64,39
-DA:65,39
-DA:70,39
-DA:71,0
-DA:72,0
-DA:77,24
-DA:80,24
-DA:81,624
-DA:82,624
+DA:19,24
+DA:33,188
+DA:37,188
+DA:58,24
+DA:59,186
+DA:60,186
+DA:62,39
+DA:63,39
+DA:68,39
+DA:69,0
+DA:70,0
+DA:76,24
+DA:77,624
+DA:78,624
+DA:81,24
+DA:82,24
 DA:85,24
 DA:86,24
-DA:89,24
-DA:90,24
-DA:92,24
-LF:31
-LH:29
-BRDA:64,0,0,39
-BRDA:64,0,1,0
-BRDA:64,0,2,0
-BRDA:70,1,0,0
-BRDA:70,1,1,39
+DA:88,24
+LF:30
+LH:28
+BRDA:62,0,0,39
+BRDA:62,0,1,0
+BRDA:62,0,2,0
+BRDA:68,1,0,0
+BRDA:68,1,1,39
 BRF:5
 BRH:2
 end_of_record
@@ -5244,7 +5241,7 @@ DA:13,24
 DA:33,24
 DA:34,24
 DA:37,24
-DA:55,24
+DA:54,24
 LF:12
 LH:12
 BRDA:33,0,0,24
@@ -7773,15 +7770,16 @@ DA:85,0
 DA:86,0
 DA:87,0
 DA:88,0
-DA:91,190
+DA:89,0
 DA:92,190
 DA:93,190
 DA:94,190
 DA:95,190
-DA:104,190
-DA:110,7
-DA:113,190
-LF:55
+DA:96,190
+DA:105,190
+DA:111,7
+DA:114,190
+LF:56
 LH:46
 BRDA:28,0,0,1
 BRDA:28,0,1,192
@@ -7816,16 +7814,16 @@ BRDA:78,13,0,190
 BRDA:78,13,1,0
 BRDA:78,13,2,0
 BRDA:78,13,3,0
-BRDA:92,14,0,190
-BRDA:92,14,1,0
-BRDA:94,15,0,185
-BRDA:94,15,1,5
-BRDA:104,16,0,7
-BRDA:104,16,1,183
-BRDA:105,17,0,190
-BRDA:105,17,1,190
-BRDA:105,17,2,185
-BRDA:105,17,3,7
+BRDA:93,14,0,190
+BRDA:93,14,1,0
+BRDA:95,15,0,185
+BRDA:95,15,1,5
+BRDA:105,16,0,7
+BRDA:105,16,1,183
+BRDA:106,17,0,190
+BRDA:106,17,1,190
+BRDA:106,17,2,185
+BRDA:106,17,3,7
 BRF:43
 BRH:33
 end_of_record

package/dist/api/controllers/auth.js

@@ -16,7 +16,7 @@ const { getAppDB, getAppId } = require("@budibase/backend-core/context");
 exports.fetchSelf = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
     let userId = ctx.user.userId || ctx.user._id;
     /* istanbul ignore next */
-    if (!userId) {
+    if (!userId || !ctx.isAuthenticated) {
         ctx.body = {};
         return;
     }

package/dist/api/controllers/static/index.js

@@ -14,14 +14,13 @@ const { resolve, join } = require("../../../utilities/centralPath");
 const uuid = require("uuid");
 const { ObjectStoreBuckets } = require("../../../constants");
 const { processString } = require("@budibase/string-templates");
-const { getAllApps } = require("@budibase/backend-core/db");
 const { loadHandlebarsFile, NODE_MODULES_PATH, TOP_LEVEL_PATH, } = require("../../../utilities/fileSystem");
 const env = require("../../../environment");
 const { clientLibraryPath } = require("../../../utilities");
 const { upload } = require("../../../utilities/fileSystem");
 const { attachmentsRelativeURL } = require("../../../utilities");
 const { DocumentTypes } = require("../../../db/utils");
-const { getAppDB, updateAppId } = require("@budibase/backend-core/context");
+const { getAppDB, getAppId } = require("@budibase/backend-core/context");
 const AWS = require("aws-sdk");
 const AWS_REGION = env.AWS_REGION ? env.AWS_REGION : "eu-west-1";
 function prepareUpload({ s3Key, bucket, metadata, file }) {
@@ -43,18 +42,6 @@ function prepareUpload({ s3Key, bucket, metadata, file }) {
         };
     });
 }
-function getAppIdFromUrl(ctx) {
-    return __awaiter(this, void 0, void 0, function* () {
-        // the "appId" component of the URL can be the id or the custom url
-        let possibleAppUrl = `/${encodeURI(ctx.params.appId).toLowerCase()}`;
-        // search prod apps for a url that matches, exclude dev where id is always used
-        const apps = yield getAllApps({ dev: false });
-        const app = apps.filter(a => a.url && a.url.toLowerCase() === possibleAppUrl)[0];
-        const appId = app && app.appId ? app.appId : ctx.params.appId;
-        updateAppId(appId);
-        return appId;
-    });
-}
 exports.serveBuilder = function (ctx) {
     return __awaiter(this, void 0, void 0, function* () {
         let builderPath = resolve(TOP_LEVEL_PATH, "builder");
@@ -81,10 +68,10 @@ exports.uploadFile = function (ctx) {
 };
 exports.serveApp = function (ctx) {
     return __awaiter(this, void 0, void 0, function* () {
-        let appId = yield getAppIdFromUrl(ctx);
         const App = require("./templates/BudibaseApp.svelte").default;
         const db = getAppDB({ skip_setup: true });
         const appInfo = yield db.get(DocumentTypes.APP_METADATA);
+        let appId = getAppId();
         const { head, html, css } = App.render({
             title: appInfo.name,
             production: env.isProd(),

package/dist/api/index.js

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 const Router = require("@koa/router");
-const { buildAuthMiddleware, auditLog, buildTenancyMiddleware, buildAppTenancyMiddleware, } = require("@budibase/backend-core/auth");
+const { buildAuthMiddleware, auditLog, buildTenancyMiddleware, } = require("@budibase/backend-core/auth");
 const currentApp = require("../middleware/currentapp");
 const compress = require("koa-compress");
 const zlib = require("zlib");
@@ -17,6 +17,8 @@ const { mainRoutes, staticRoutes, publicRoutes } = require("./routes");
 const pkg = require("../../package.json");
 const env = require("../environment");
 const router = new Router();
+router.get("/health", ctx => (ctx.status = 200));
+router.get("/version", ctx => (ctx.body = pkg.version));
 router
     .use(compress({
     threshold: 2048,
@@ -35,8 +37,6 @@ router
     };
     yield next();
 }))
-    .use("/health", ctx => (ctx.status = 200))
-    .use("/version", ctx => (ctx.body = pkg.version))
     // re-direct before any middlewares occur
     .redirect("/", "/builder")
     .use(buildAuthMiddleware(null, {
@@ -49,8 +49,6 @@ router
     noTenancyRequired: true,
 }))
     .use(currentApp)
-    // this middleware will try to use the app ID to determine the tenancy
-    .use(buildAppTenancyMiddleware())
     .use(auditLog);
 // error handling middleware
 router.use((ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
@@ -70,7 +68,6 @@ router.use((ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
         }
     }
 }));
-router.get("/health", ctx => (ctx.status = 200));
 // authenticated routes
 for (let route of mainRoutes) {
     router.use(route.routes());

package/dist/api/routes/static.js

@@ -42,7 +42,6 @@ router
     .get("/builder/:file*", controller.serveBuilder)
     .post("/api/attachments/process", authorized(BUILDER), controller.uploadFile)
     .post("/api/attachments/:tableId/upload", paramResource("tableId"), authorized(PermissionTypes.TABLE, PermissionLevels.WRITE), controller.uploadFile)
-    // TODO: this likely needs to be secured in some way
-    .get("/:appId/:path*", controller.serveApp)
+    .get("/app/:appUrl/:path*", controller.serveApp)
     .post("/api/attachments/:datasourceId/url", authorized(PermissionTypes.TABLE, PermissionLevels.READ), controller.getSignedUploadURL);
 module.exports = router;

package/dist/db/views/staticViews.js

@@ -36,6 +36,7 @@ exports.createLinkView = () => __awaiter(void 0, void 0, void 0, function* () {
             if (doc.type === "link") {
                 let doc1 = doc.doc1;
                 let doc2 = doc.doc2;
+                // eslint-disable-next-line no-undef
                 emit([doc1.tableId, doc1.rowId], {
                     id: doc2.rowId,
                     thisId: doc1.rowId,
@@ -43,6 +44,7 @@ exports.createLinkView = () => __awaiter(void 0, void 0, void 0, function* () {
                 });
                 // if linking to same table can't emit twice
                 if (doc1.tableId !== doc2.tableId) {
+                    // eslint-disable-next-line no-undef
                     emit([doc2.tableId, doc2.rowId], {
                         id: doc1.rowId,
                         thisId: doc2.rowId,

package/dist/middleware/currentapp.js

@@ -8,7 +8,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-const { getAppId, setCookie, getCookie, clearCookie, } = require("@budibase/backend-core/utils");
+const { getAppIdFromCtx, setCookie, getCookie, clearCookie, } = require("@budibase/backend-core/utils");
 const { Cookies } = require("@budibase/backend-core/constants");
 const { getRole } = require("@budibase/backend-core/roles");
 const { BUILTIN_ROLE_IDS } = require("@budibase/backend-core/roles");
@@ -21,7 +21,7 @@ const { isWebhookEndpoint } = require("./utils");
 const { doInAppContext } = require("@budibase/backend-core/context");
 module.exports = (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
     // try to get the appID from the request
-    let requestAppId = getAppId(ctx);
+    let requestAppId = yield getAppIdFromCtx(ctx);
     // get app cookie if it exists
     let appCookie = null;
     try {
@@ -70,19 +70,20 @@ module.exports = (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
         return next();
     }
     return doInAppContext(appId, () => __awaiter(void 0, void 0, void 0, function* () {
-        let noCookieSet = false;
+        let skipCookie = false;
         // if the user not in the right tenant then make sure they have no permissions
         // need to judge this only based on the request app ID,
         if (env.MULTI_TENANCY &&
             ctx.user &&
             requestAppId &&
-            !isUserInAppTenant(requestAppId)) {
+            !isUserInAppTenant(requestAppId, ctx.user)) {
             // don't error, simply remove the users rights (they are a public user)
             delete ctx.user.builder;
             delete ctx.user.admin;
             delete ctx.user.roles;
+            ctx.isAuthenticated = false;
             roleId = BUILTIN_ROLE_IDS.PUBLIC;
-            noCookieSet = true;
+            skipCookie = true;
         }
         ctx.appId = appId;
         if (roleId) {
@@ -96,7 +97,7 @@ module.exports = (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
         if ((requestAppId !== appId ||
             appCookie == null ||
             appCookie.appId !== requestAppId) &&
-            !noCookieSet) {
+            !skipCookie) {
             setCookie(ctx, { appId }, Cookies.CurrentApp);
         }
         return next();

package/dist/middleware/publicApi.js

@@ -9,10 +9,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 const { Headers } = require("@budibase/backend-core/constants");
-const { getAppId } = require("@budibase/backend-core/utils");
+const { getAppIdFromCtx } = require("@budibase/backend-core/utils");
 module.exports = function ({ requiresAppId } = {}) {
     return (ctx, next) => __awaiter(this, void 0, void 0, function* () {
-        const appId = getAppId(ctx);
+        const appId = yield getAppIdFromCtx(ctx);
         if (requiresAppId && !appId) {
             ctx.throw(400, `Invalid app ID provided, please check the ${Headers.APP_ID} header.`);
         }

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@budibase/server",
     "email": "hi@budibase.com",
-    "version": "1.0.94",
+    "version": "1.0.95",
     "description": "Budibase Web Server",
     "main": "src/index.ts",
     "repository": {
@@ -21,10 +21,7 @@
         "dev:stack:down": "node scripts/dev/manage.js down",
         "dev:stack:nuke": "node scripts/dev/manage.js nuke",
         "dev:builder": "yarn run dev:stack:up && nodemon",
-        "format": "prettier --config ../../.prettierrc.json 'src/**/*.ts' --write",
         "specs": "node specs/generate.js && openapi-typescript specs/openapi.yaml --output src/definitions/openapi.ts",
-        "lint": "eslint --fix src/",
-        "lint:fix": "yarn run format && yarn run lint",
         "initialise": "node scripts/initialise.js",
         "env:multi:enable": "node scripts/multiTenancy.js enable",
         "env:multi:disable": "node scripts/multiTenancy.js disable",
@@ -71,9 +68,9 @@
     "license": "GPL-3.0",
     "dependencies": {
         "@apidevtools/swagger-parser": "^10.0.3",
-        "@budibase/backend-core": "^1.0.94",
-        "@budibase/client": "^1.0.94",
-        "@budibase/string-templates": "^1.0.94",
+        "@budibase/backend-core": "^1.0.95",
+        "@budibase/client": "^1.0.95",
+        "@budibase/string-templates": "^1.0.95",
         "@bull-board/api": "^3.7.0",
         "@bull-board/koa": "^3.7.0",
         "@elastic/elasticsearch": "7.10.0",
@@ -151,7 +148,6 @@
         "@types/node": "^15.12.4",
         "@types/oracledb": "^5.2.1",
         "@types/redis": "^4.0.11",
-        "@typescript-eslint/parser": "4.28.0",
         "apidoc": "^0.50.2",
         "babel-jest": "^27.0.2",
         "copyfiles": "^2.4.1",

package/dist/tests/utilities/TestConfiguration.js

@@ -75,7 +75,7 @@ class TestConfiguration {
                 });
             }
             // check if already in a context
-            if (context.getAppId() == null) {
+            if (context.getAppId() == null && this.appId !== null) {
                 return context.doInAppContext(this.appId, () => __awaiter(this, void 0, void 0, function* () {
                     return run();
                 }));