@budibase/server 1.0.98 → 1.0.99

package/dist/api/controllers/permission.js

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 const { getBuiltinPermissions } = require("@budibase/backend-core/permissions");
-const { isBuiltin, getDBRoleID, getExternalRoleID, getBuiltinRoles, } = require("@budibase/backend-core/roles");
+const { isBuiltin, getDBRoleID, getExternalRoleID, getBuiltinRoles, checkForRoleResourceArray, } = require("@budibase/backend-core/roles");
 const { getRoleParams } = require("../../db/utils");
 const { CURRENTLY_SUPPORTED_LEVELS, getBasePermissions, } = require("../../utilities/security");
 const { removeFromArray } = require("../../utilities");
@@ -130,11 +130,10 @@ exports.getResourcePerms = function (ctx) {
         for (let level of SUPPORTED_LEVELS) {
             // update the various roleIds in the resource permissions
             for (let role of roles) {
-                const rolePerms = role.permissions;
+                const rolePerms = checkForRoleResourceArray(role.permissions, resourceId);
                 if (rolePerms &&
                     rolePerms[resourceId] &&
-                    (rolePerms[resourceId] === level ||
-                        rolePerms[resourceId].indexOf(level) !== -1)) {
+                    rolePerms[resourceId].indexOf(level) !== -1) {
                     permissions[level] = getExternalRoleID(role._id);
                 }
             }

package/dist/api/routes/table.js

@@ -32,7 +32,7 @@ router
      *
      * @apiSuccess {object[]} body The response body will be the table that was found.
      */
-    .get("/api/tables/:tableId", paramResource("tableId"), authorized(PermissionTypes.TABLE, PermissionLevels.READ), tableController.find)
+    .get("/api/tables/:tableId", paramResource("tableId"), authorized(PermissionTypes.TABLE, PermissionLevels.READ, { schema: true }), tableController.find)
     /**
      * @api {post} /api/tables Save a table
      * @apiName Save a table

package/dist/middleware/authorized.js

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 const { getUserRoleHierarchy, getRequiredResourceRole, BUILTIN_ROLE_IDS, } = require("@budibase/backend-core/roles");
-const { PermissionTypes, doesHaveBasePermission, } = require("@budibase/backend-core/permissions");
+const { PermissionTypes, PermissionLevels, doesHaveBasePermission, } = require("@budibase/backend-core/permissions");
 const builderMiddleware = require("./builder");
 const { isWebhookEndpoint } = require("./utils");
 const { buildCsrfMiddleware } = require("@budibase/backend-core/auth");
@@ -57,7 +57,7 @@ const checkAuthorizedResource = (ctx, resourceRoles, permType, permLevel) => __a
     }
 });
 module.exports =
-    (permType, permLevel = null) => (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
+    (permType, permLevel = null, opts = { schema: false }) => (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
         // webhooks don't need authentication, each webhook unique
         // also internal requests (between services) don't need authorized
         if (isWebhookEndpoint(ctx) || ctx.internal) {
@@ -70,22 +70,39 @@ module.exports =
         // to find API endpoints which are builder focused
         yield builderMiddleware(ctx, permType);
         // get the resource roles
-        let resourceRoles = [];
+        let resourceRoles = [], otherLevelRoles;
+        const otherLevel = permLevel === PermissionLevels.READ
+            ? PermissionLevels.WRITE
+            : PermissionLevels.READ;
         const appId = getAppId();
         if (appId && hasResource(ctx)) {
             resourceRoles = yield getRequiredResourceRole(permLevel, ctx);
+            if (opts && opts.schema) {
+                otherLevelRoles = yield getRequiredResourceRole(otherLevel, ctx);
+            }
         }
         // if the resource is public, proceed
-        const isPublicResource = resourceRoles.includes(BUILTIN_ROLE_IDS.PUBLIC);
-        if (isPublicResource) {
+        if (resourceRoles.includes(BUILTIN_ROLE_IDS.PUBLIC) ||
+            (otherLevelRoles && otherLevelRoles.includes(BUILTIN_ROLE_IDS.PUBLIC))) {
             return next();
         }
         // check authenticated
         if (!ctx.isAuthenticated) {
             return ctx.throw(403, "Session not authenticated");
         }
-        // check authorized
-        yield checkAuthorized(ctx, resourceRoles, permType, permLevel);
+        try {
+            // check authorized
+            yield checkAuthorized(ctx, resourceRoles, permType, permLevel);
+        }
+        catch (err) {
+            // this is a schema, check if
+            if (opts && opts.schema && permLevel) {
+                yield checkAuthorized(ctx, otherLevelRoles, permType, otherLevel);
+            }
+            else {
+                throw err;
+            }
+        }
         // csrf protection
         return csrf(ctx, next);
     });

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@budibase/server",
     "email": "hi@budibase.com",
-    "version": "1.0.97",
+    "version": "1.0.98",
     "description": "Budibase Web Server",
     "main": "src/index.ts",
     "repository": {
@@ -68,9 +68,9 @@
     "license": "GPL-3.0",
     "dependencies": {
         "@apidevtools/swagger-parser": "^10.0.3",
-        "@budibase/backend-core": "^1.0.97",
-        "@budibase/client": "^1.0.97",
-        "@budibase/string-templates": "^1.0.97",
+        "@budibase/backend-core": "^1.0.98",
+        "@budibase/client": "^1.0.98",
+        "@budibase/string-templates": "^1.0.98",
         "@bull-board/api": "^3.7.0",
         "@bull-board/koa": "^3.7.0",
         "@elastic/elasticsearch": "7.10.0",