@budibase/server 1.0.95 → 1.0.96

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/server",
   "email": "hi@budibase.com",
-  "version": "1.0.95",
+  "version": "1.0.96",
   "description": "Budibase Web Server",
   "main": "src/index.ts",
   "repository": {
@@ -21,10 +21,7 @@
     "dev:stack:down": "node scripts/dev/manage.js down",
     "dev:stack:nuke": "node scripts/dev/manage.js nuke",
     "dev:builder": "yarn run dev:stack:up && nodemon",
-    "format": "prettier --config ../../.prettierrc.json 'src/**/*.ts' --write",
     "specs": "node specs/generate.js && openapi-typescript specs/openapi.yaml --output src/definitions/openapi.ts",
-    "lint": "eslint --fix src/",
-    "lint:fix": "yarn run format && yarn run lint",
     "initialise": "node scripts/initialise.js",
     "env:multi:enable": "node scripts/multiTenancy.js enable",
     "env:multi:disable": "node scripts/multiTenancy.js disable",
@@ -71,9 +68,9 @@
   "license": "GPL-3.0",
   "dependencies": {
     "@apidevtools/swagger-parser": "^10.0.3",
-    "@budibase/backend-core": "^1.0.95",
-    "@budibase/client": "^1.0.95",
-    "@budibase/string-templates": "^1.0.95",
+    "@budibase/backend-core": "^1.0.96",
+    "@budibase/client": "^1.0.96",
+    "@budibase/string-templates": "^1.0.96",
     "@bull-board/api": "^3.7.0",
     "@bull-board/koa": "^3.7.0",
     "@elastic/elasticsearch": "7.10.0",
@@ -151,7 +148,6 @@
     "@types/node": "^15.12.4",
     "@types/oracledb": "^5.2.1",
     "@types/redis": "^4.0.11",
-    "@typescript-eslint/parser": "4.28.0",
     "apidoc": "^0.50.2",
     "babel-jest": "^27.0.2",
     "copyfiles": "^2.4.1",
@@ -175,5 +171,5 @@
   "optionalDependencies": {
     "oracledb": "^5.3.0"
   },
-  "gitHead": "c276c8512415296ffab3647edf16a750f2ef613f"
+  "gitHead": "eecd09718a3d1561324234b34faf4b8a4579d6ea"
 }

package/src/api/controllers/auth.js

@@ -7,7 +7,7 @@ const { getAppDB, getAppId } = require("@budibase/backend-core/context")
 exports.fetchSelf = async ctx => {
   let userId = ctx.user.userId || ctx.user._id
   /* istanbul ignore next */
-  if (!userId) {
+  if (!userId || !ctx.isAuthenticated) {
     ctx.body = {}
     return
   }

package/src/api/controllers/static/index.js

@@ -5,7 +5,6 @@ const { resolve, join } = require("../../../utilities/centralPath")
 const uuid = require("uuid")
 const { ObjectStoreBuckets } = require("../../../constants")
 const { processString } = require("@budibase/string-templates")
-const { getAllApps } = require("@budibase/backend-core/db")
 const {
   loadHandlebarsFile,
   NODE_MODULES_PATH,
@@ -16,7 +15,7 @@ const { clientLibraryPath } = require("../../../utilities")
 const { upload } = require("../../../utilities/fileSystem")
 const { attachmentsRelativeURL } = require("../../../utilities")
 const { DocumentTypes } = require("../../../db/utils")
-const { getAppDB, updateAppId } = require("@budibase/backend-core/context")
+const { getAppDB, getAppId } = require("@budibase/backend-core/context")
 const AWS = require("aws-sdk")
 const AWS_REGION = env.AWS_REGION ? env.AWS_REGION : "eu-west-1"
 
@@ -39,21 +38,6 @@ async function prepareUpload({ s3Key, bucket, metadata, file }) {
   }
 }
 
-async function getAppIdFromUrl(ctx) {
-  // the "appId" component of the URL can be the id or the custom url
-  let possibleAppUrl = `/${encodeURI(ctx.params.appId).toLowerCase()}`
-
-  // search prod apps for a url that matches, exclude dev where id is always used
-  const apps = await getAllApps({ dev: false })
-  const app = apps.filter(
-    a => a.url && a.url.toLowerCase() === possibleAppUrl
-  )[0]
-
-  const appId = app && app.appId ? app.appId : ctx.params.appId
-  updateAppId(appId)
-  return appId
-}
-
 exports.serveBuilder = async function (ctx) {
   let builderPath = resolve(TOP_LEVEL_PATH, "builder")
   await send(ctx, ctx.file, { root: builderPath })
@@ -81,10 +65,10 @@ exports.uploadFile = async function (ctx) {
 }
 
 exports.serveApp = async function (ctx) {
-  let appId = await getAppIdFromUrl(ctx)
   const App = require("./templates/BudibaseApp.svelte").default
   const db = getAppDB({ skip_setup: true })
   const appInfo = await db.get(DocumentTypes.APP_METADATA)
+  let appId = getAppId()
 
   const { head, html, css } = App.render({
     title: appInfo.name,

package/src/api/index.js

@@ -3,7 +3,6 @@ const {
   buildAuthMiddleware,
   auditLog,
   buildTenancyMiddleware,
-  buildAppTenancyMiddleware,
 } = require("@budibase/backend-core/auth")
 const currentApp = require("../middleware/currentapp")
 const compress = require("koa-compress")
@@ -14,6 +13,9 @@ const env = require("../environment")
 
 const router = new Router()
 
+router.get("/health", ctx => (ctx.status = 200))
+router.get("/version", ctx => (ctx.body = pkg.version))
+
 router
   .use(
     compress({
@@ -34,8 +36,6 @@ router
     }
     await next()
   })
-  .use("/health", ctx => (ctx.status = 200))
-  .use("/version", ctx => (ctx.body = pkg.version))
   // re-direct before any middlewares occur
   .redirect("/", "/builder")
   .use(
@@ -52,8 +52,6 @@ router
     })
   )
   .use(currentApp)
-  // this middleware will try to use the app ID to determine the tenancy
-  .use(buildAppTenancyMiddleware())
   .use(auditLog)
 
 // error handling middleware
@@ -74,8 +72,6 @@ router.use(async (ctx, next) => {
   }
 })
 
-router.get("/health", ctx => (ctx.status = 200))
-
 // authenticated routes
 for (let route of mainRoutes) {
   router.use(route.routes())

package/src/api/routes/static.js

@@ -44,8 +44,7 @@ router
     authorized(PermissionTypes.TABLE, PermissionLevels.WRITE),
     controller.uploadFile
   )
-  // TODO: this likely needs to be secured in some way
-  .get("/:appId/:path*", controller.serveApp)
+  .get("/app/:appUrl/:path*", controller.serveApp)
   .post(
     "/api/attachments/:datasourceId/url",
     authorized(PermissionTypes.TABLE, PermissionLevels.READ),

package/src/db/views/staticViews.js

@@ -33,6 +33,7 @@ exports.createLinkView = async () => {
       if (doc.type === "link") {
         let doc1 = doc.doc1
         let doc2 = doc.doc2
+        // eslint-disable-next-line no-undef
         emit([doc1.tableId, doc1.rowId], {
           id: doc2.rowId,
           thisId: doc1.rowId,
@@ -40,6 +41,7 @@ exports.createLinkView = async () => {
         })
         // if linking to same table can't emit twice
         if (doc1.tableId !== doc2.tableId) {
+          // eslint-disable-next-line no-undef
           emit([doc2.tableId, doc2.rowId], {
             id: doc1.rowId,
             thisId: doc2.rowId,

package/src/middleware/currentapp.js

@@ -1,5 +1,5 @@
 const {
-  getAppId,
+  getAppIdFromCtx,
   setCookie,
   getCookie,
   clearCookie,
@@ -17,7 +17,7 @@ const { doInAppContext } = require("@budibase/backend-core/context")
 
 module.exports = async (ctx, next) => {
   // try to get the appID from the request
-  let requestAppId = getAppId(ctx)
+  let requestAppId = await getAppIdFromCtx(ctx)
   // get app cookie if it exists
   let appCookie = null
   try {
@@ -71,21 +71,22 @@ module.exports = async (ctx, next) => {
   }
 
   return doInAppContext(appId, async () => {
-    let noCookieSet = false
+    let skipCookie = false
     // if the user not in the right tenant then make sure they have no permissions
     // need to judge this only based on the request app ID,
     if (
       env.MULTI_TENANCY &&
       ctx.user &&
       requestAppId &&
-      !isUserInAppTenant(requestAppId)
+      !isUserInAppTenant(requestAppId, ctx.user)
     ) {
       // don't error, simply remove the users rights (they are a public user)
       delete ctx.user.builder
       delete ctx.user.admin
       delete ctx.user.roles
+      ctx.isAuthenticated = false
       roleId = BUILTIN_ROLE_IDS.PUBLIC
-      noCookieSet = true
+      skipCookie = true
     }
 
     ctx.appId = appId
@@ -105,7 +106,7 @@ module.exports = async (ctx, next) => {
       (requestAppId !== appId ||
         appCookie == null ||
         appCookie.appId !== requestAppId) &&
-      !noCookieSet
+      !skipCookie
     ) {
       setCookie(ctx, { appId }, Cookies.CurrentApp)
     }

package/src/middleware/publicApi.js

@@ -1,9 +1,9 @@
 const { Headers } = require("@budibase/backend-core/constants")
-const { getAppId } = require("@budibase/backend-core/utils")
+const { getAppIdFromCtx } = require("@budibase/backend-core/utils")
 
 module.exports = function ({ requiresAppId } = {}) {
   return async (ctx, next) => {
-    const appId = getAppId(ctx)
+    const appId = await getAppIdFromCtx(ctx)
     if (requiresAppId && !appId) {
       ctx.throw(
         400,

package/src/middleware/tests/authorized.spec.js

@@ -35,9 +35,7 @@ class TestConfiguration {
   }
 
   executeMiddleware() {
-    return doInAppContext(APP_ID, () => {
-      return this.middleware(this.ctx, this.next)
-    })
+    return this.middleware(this.ctx, this.next)
   }
 
   setUser(user) {

package/src/middleware/tests/currentapp.spec.js

@@ -38,7 +38,7 @@ function mockAuthWithNoCookie() {
     },
   }))
   jest.mock("@budibase/backend-core/utils", () => ({
-    getAppId: jest.fn(),
+    getAppIdFromCtx: jest.fn(),
     setCookie: jest.fn(),
     getCookie: jest.fn(),
   }))
@@ -51,7 +51,7 @@ function mockAuthWithCookie() {
   jest.resetModules()
   mockWorker()
   jest.mock("@budibase/backend-core/utils", () => ({
-    getAppId: () => {
+    getAppIdFromCtx: () => {
       return "app_test"
     },
     setCookie: jest.fn(),
@@ -143,7 +143,7 @@ describe("Current app middleware", () => {
     it("should perform correct when no cookie exists", async () => {
       mockReset()
       jest.mock("@budibase/backend-core/utils", () => ({
-        getAppId: () => {
+        getAppIdFromCtx: () => {
           return "app_test"
         },
         setCookie: jest.fn(),
@@ -158,7 +158,7 @@ describe("Current app middleware", () => {
     it("lastly check what occurs when cookie doesn't need updated", async () => {
       mockReset()
       jest.mock("@budibase/backend-core/utils", () => ({
-        getAppId: () => {
+        getAppIdFromCtx: () => {
           return "app_test"
         },
         setCookie: jest.fn(),

package/src/tests/utilities/TestConfiguration.js

@@ -80,7 +80,7 @@ class TestConfiguration {
       return request.body
     }
     // check if already in a context
-    if (context.getAppId() == null) {
+    if (context.getAppId() == null && this.appId !== null) {
       return context.doInAppContext(this.appId, async () => {
         return run()
       })

package/.eslintrc

@@ -1,13 +0,0 @@
-{
-  "globals": {
-    "emit": true,
-    "key": true
-  },
-  "parser": "@typescript-eslint/parser",
-  "env": {
-    "node": true
-  },
-  "extends": ["eslint:recommended"],
-  "rules": {
-  }
-}