@budibase/server 1.0.98-alpha.6 → 1.0.98-alpha.9

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/server",
   "email": "hi@budibase.com",
-  "version": "1.0.98-alpha.6",
+  "version": "1.0.98-alpha.9",
   "description": "Budibase Web Server",
   "main": "src/index.ts",
   "repository": {
@@ -68,9 +68,9 @@
   "license": "GPL-3.0",
   "dependencies": {
     "@apidevtools/swagger-parser": "^10.0.3",
-    "@budibase/backend-core": "^1.0.98-alpha.6",
-    "@budibase/client": "^1.0.98-alpha.6",
-    "@budibase/string-templates": "^1.0.98-alpha.6",
+    "@budibase/backend-core": "^1.0.98-alpha.9",
+    "@budibase/client": "^1.0.98-alpha.9",
+    "@budibase/string-templates": "^1.0.98-alpha.9",
     "@bull-board/api": "^3.7.0",
     "@bull-board/koa": "^3.7.0",
     "@elastic/elasticsearch": "7.10.0",
@@ -174,5 +174,5 @@
   "optionalDependencies": {
     "oracledb": "^5.3.0"
   },
-  "gitHead": "ca5bc790f5ddfedb44e87859339ba2db809b489d"
+  "gitHead": "0e309aca3ad35e5e9d42fae3a4c074af3cd77544"
 }

package/specs/openapi.json

@@ -1260,10 +1260,30 @@
         ]
       },
       "executeQuery": {
-        "description": "The query body must contain the required parameters for the query, this depends on query type, setup and bindings.",
+        "description": "The parameters required for executing a query.",
         "type": "object",
-        "additionalProperties": {
-          "description": "Key value properties of any type, depending on the query output schema."
+        "properties": {
+          "parameters": {
+            "type": "object",
+            "description": "This contains the required parameters for the query, this depends on query type, setup and bindings.",
+            "additionalProperties": {
+              "description": "Key value properties of any type, depending on the query output schema."
+            }
+          },
+          "pagination": {
+            "type": "object",
+            "description": "For supported query types (currently on REST) pagination can be performed using these properties.",
+            "properties": {
+              "page": {
+                "type": "string",
+                "description": "The page which has been returned from a previous query."
+              },
+              "limit": {
+                "type": "number",
+                "description": "The number of rows to return per page."
+              }
+            }
+          }
         }
       },
       "executeQueryOutput": {

package/specs/openapi.yaml

@@ -951,11 +951,27 @@ components:
       required:
         - data
     executeQuery:
-      description: The query body must contain the required parameters for the query,
-        this depends on query type, setup and bindings.
+      description: The parameters required for executing a query.
       type: object
-      additionalProperties:
-        description: Key value properties of any type, depending on the query output schema.
+      properties:
+        parameters:
+          type: object
+          description: This contains the required parameters for the query, this depends
+            on query type, setup and bindings.
+          additionalProperties:
+            description: Key value properties of any type, depending on the query output
+              schema.
+        pagination:
+          type: object
+          description: For supported query types (currently on REST) pagination can be
+            performed using these properties.
+          properties:
+            page:
+              type: string
+              description: The page which has been returned from a previous query.
+            limit:
+              type: number
+              description: The number of rows to return per page.
     executeQueryOutput:
       type: object
       properties:

package/specs/resources/query.js

@@ -124,12 +124,34 @@ const querySchema = object(
 )
 
 const executeQuerySchema = {
-  description:
-    "The query body must contain the required parameters for the query, this depends on query type, setup and bindings.",
+  description: "The parameters required for executing a query.",
   type: "object",
-  additionalProperties: {
-    description:
-      "Key value properties of any type, depending on the query output schema.",
+  properties: {
+    parameters: {
+      type: "object",
+      description:
+        "This contains the required parameters for the query, this depends on query type, setup and bindings.",
+      additionalProperties: {
+        description:
+          "Key value properties of any type, depending on the query output schema.",
+      },
+    },
+    pagination: {
+      type: "object",
+      description:
+        "For supported query types (currently on REST) pagination can be performed using these properties.",
+      properties: {
+        page: {
+          type: "string",
+          description:
+            "The page which has been returned from a previous query.",
+        },
+        limit: {
+          type: "number",
+          description: "The number of rows to return per page.",
+        },
+      },
+    },
   },
 }
 

package/src/api/controllers/permission.js

@@ -4,6 +4,7 @@ const {
   getDBRoleID,
   getExternalRoleID,
   getBuiltinRoles,
+  checkForRoleResourceArray,
 } = require("@budibase/backend-core/roles")
 const { getRoleParams } = require("../../db/utils")
 const {
@@ -144,12 +145,11 @@ exports.getResourcePerms = async function (ctx) {
   for (let level of SUPPORTED_LEVELS) {
     // update the various roleIds in the resource permissions
     for (let role of roles) {
-      const rolePerms = role.permissions
+      const rolePerms = checkForRoleResourceArray(role.permissions, resourceId)
       if (
         rolePerms &&
         rolePerms[resourceId] &&
-        (rolePerms[resourceId] === level ||
-          rolePerms[resourceId].indexOf(level) !== -1)
+        rolePerms[resourceId].indexOf(level) !== -1
       ) {
         permissions[level] = getExternalRoleID(role._id)
       }

package/src/api/routes/table.js

@@ -40,7 +40,7 @@ router
   .get(
     "/api/tables/:tableId",
     paramResource("tableId"),
-    authorized(PermissionTypes.TABLE, PermissionLevels.READ),
+    authorized(PermissionTypes.TABLE, PermissionLevels.READ, { schema: true }),
     tableController.find
   )
   /**

package/src/automations/utils.js

@@ -17,10 +17,14 @@ const Runner = new Thread(ThreadType.AUTOMATION)
 exports.processEvent = async job => {
   try {
     // need to actually await these so that an error can be captured properly
+    console.log(
+      `${job.data.automation.appId} automation ${job.data.automation._id} running`
+    )
     return await Runner.run(job)
   } catch (err) {
+    const errJson = JSON.stringify(err)
     console.error(
-      `${job.data.automation.appId} automation ${job.data.automation._id} was unable to run - ${err}`
+      `${job.data.automation.appId} automation ${job.data.automation._id} was unable to run - ${errJson}`
     )
     console.trace(err)
     return { err }

package/src/definitions/datasource.ts

@@ -182,11 +182,7 @@ export interface QueryJson {
 
 export interface SqlQuery {
   sql: string
-  bindings?:
-    | string[]
-    | {
-        [key: string]: any
-      }
+  bindings?: string[]
 }
 
 export interface QueryOptions {

package/src/definitions/openapi.ts

@@ -932,11 +932,21 @@ export interface components {
               }
         }
         /** @description The ID of the table. */
-        _id: string
-      }[]
-    }
-    /** @description The query body must contain the required parameters for the query, this depends on query type, setup and bindings. */
-    executeQuery: { [key: string]: unknown }
+        _id: string;
+      }[];
+    };
+    /** @description The parameters required for executing a query. */
+    executeQuery: {
+      /** @description This contains the required parameters for the query, this depends on query type, setup and bindings. */
+      parameters?: { [key: string]: unknown };
+      /** @description For supported query types (currently on REST) pagination can be performed using these properties. */
+      pagination?: {
+        /** @description The page which has been returned from a previous query. */
+        page?: string;
+        /** @description The number of rows to return per page. */
+        limit?: number;
+      };
+    };
     executeQueryOutput: {
       /** @description The data response from the query. */
       data: { [key: string]: unknown }[]

package/src/integrations/mysql.ts

@@ -80,6 +80,20 @@ module MySQLModule {
     },
   }
 
+  function bindingTypeCoerce(bindings: any[]) {
+    for (let i = 0; i < bindings.length; i++) {
+      const binding = bindings[i]
+      if (typeof binding !== "string") {
+        continue
+      }
+      const matches = binding.match(/^\d*/g)
+      if (matches && matches[0] !== "" && !isNaN(Number(matches[0]))) {
+        bindings[i] = parseFloat(binding)
+      }
+    }
+    return bindings
+  }
+
   class MySQLIntegration extends Sql implements DatasourcePlus {
     private config: MySQLConfig
     private client: any
@@ -122,7 +136,7 @@ module MySQLModule {
         // Node MySQL is callback based, so we must wrap our call in a promise
         const response = await this.client.query(
           query.sql,
-          query.bindings || []
+          bindingTypeCoerce(query.bindings || [])
         )
         return response[0]
       } finally {

package/src/middleware/authorized.js

@@ -5,6 +5,7 @@ const {
 } = require("@budibase/backend-core/roles")
 const {
   PermissionTypes,
+  PermissionLevels,
   doesHaveBasePermission,
 } = require("@budibase/backend-core/permissions")
 const builderMiddleware = require("./builder")
@@ -64,7 +65,7 @@ const checkAuthorizedResource = async (
 }
 
 module.exports =
-  (permType, permLevel = null) =>
+  (permType, permLevel = null, opts = { schema: false }) =>
   async (ctx, next) => {
     // webhooks don't need authentication, each webhook unique
     // also internal requests (between services) don't need authorized
@@ -81,15 +82,25 @@ module.exports =
     await builderMiddleware(ctx, permType)
 
     // get the resource roles
-    let resourceRoles = []
+    let resourceRoles = [],
+      otherLevelRoles
+    const otherLevel =
+      permLevel === PermissionLevels.READ
+        ? PermissionLevels.WRITE
+        : PermissionLevels.READ
     const appId = getAppId()
     if (appId && hasResource(ctx)) {
       resourceRoles = await getRequiredResourceRole(permLevel, ctx)
+      if (opts && opts.schema) {
+        otherLevelRoles = await getRequiredResourceRole(otherLevel, ctx)
+      }
     }
 
     // if the resource is public, proceed
-    const isPublicResource = resourceRoles.includes(BUILTIN_ROLE_IDS.PUBLIC)
-    if (isPublicResource) {
+    if (
+      resourceRoles.includes(BUILTIN_ROLE_IDS.PUBLIC) ||
+      (otherLevelRoles && otherLevelRoles.includes(BUILTIN_ROLE_IDS.PUBLIC))
+    ) {
       return next()
     }
 
@@ -98,8 +109,17 @@ module.exports =
       return ctx.throw(403, "Session not authenticated")
     }
 
-    // check authorized
-    await checkAuthorized(ctx, resourceRoles, permType, permLevel)
+    try {
+      // check authorized
+      await checkAuthorized(ctx, resourceRoles, permType, permLevel)
+    } catch (err) {
+      // this is a schema, check if
+      if (opts && opts.schema && permLevel) {
+        await checkAuthorized(ctx, otherLevelRoles, permType, otherLevel)
+      } else {
+        throw err
+      }
+    }
 
     // csrf protection
     return csrf(ctx, next)