@budibase/server 1.4.17 → 1.4.18

package/dist/utilities/global.js

@@ -47,8 +47,10 @@ exports.updateAppRole = (user, { appId } = {}) => {
 };
 function checkGroupRoles(user, { appId } = {}) {
     return __awaiter(this, void 0, void 0, function* () {
-        let roleId = yield groups.getGroupRoleId(user, appId);
-        user.roleId = roleId;
+        if (user.roleId && user.roleId !== BUILTIN_ROLE_IDS.PUBLIC) {
+            return user;
+        }
+        user.roleId = yield groups.getGroupRoleId(user, appId);
         return user;
     });
 }
@@ -76,8 +78,9 @@ exports.getRawGlobalUser = (userId) => __awaiter(void 0, void 0, void 0, functio
     return db.get(getGlobalIDFromUserMetadataID(userId));
 });
 exports.getGlobalUser = (userId) => __awaiter(void 0, void 0, void 0, function* () {
+    const appId = getAppId();
     let user = yield exports.getRawGlobalUser(userId);
-    return processUser(user);
+    return processUser(user, { appId });
 });
 exports.getGlobalUsers = (users = null) => __awaiter(void 0, void 0, void 0, function* () {
     const appId = getAppId();

package/dist/utilities/users.js

@@ -12,9 +12,10 @@ const { InternalTables } = require("../db/utils");
 const { getGlobalUser } = require("../utilities/global");
 const { getAppDB } = require("@budibase/backend-core/context");
 const { getProdAppID } = require("@budibase/backend-core/db");
+const { BUILTIN_ROLE_IDS } = require("@budibase/backend-core/roles");
 exports.getFullUser = (ctx, userId) => __awaiter(void 0, void 0, void 0, function* () {
     const global = yield getGlobalUser(userId);
-    let metadata;
+    let metadata = {};
     try {
         // this will throw an error if the db doesn't exist, or there is no appId
         const db = getAppDB();
@@ -25,7 +26,8 @@ exports.getFullUser = (ctx, userId) => __awaiter(void 0, void 0, void 0, functio
         delete global._id;
         delete global._rev;
     }
-    return Object.assign(Object.assign(Object.assign({}, global), metadata), { tableId: InternalTables.USER_METADATA, 
+    delete metadata.csrfToken;
+    return Object.assign(Object.assign(Object.assign({}, metadata), global), { roleId: global.roleId || BUILTIN_ROLE_IDS.PUBLIC, tableId: InternalTables.USER_METADATA, 
         // make sure the ID is always a local ID, not a global one
         _id: userId });
 });

package/dist/utilities/workerRequests.js

@@ -63,7 +63,7 @@ function checkResponse(response, errorMsg, { ctx } = {}) {
 }
 exports.request = request;
 // have to pass in the tenant ID as this could be coming from an automation
-exports.sendSmtpEmail = (to, from, subject, contents, automation) => __awaiter(void 0, void 0, void 0, function* () {
+exports.sendSmtpEmail = (to, from, subject, contents, cc, bcc, automation) => __awaiter(void 0, void 0, void 0, function* () {
     // tenant ID will be set in header
     const response = yield fetch(checkSlashesInUrl(env.WORKER_URL + `/api/global/email/send`), request(null, {
         method: "POST",
@@ -72,6 +72,8 @@ exports.sendSmtpEmail = (to, from, subject, contents, automation) => __awaiter(v
             from,
             contents,
             subject,
+            cc,
+            bcc,
             purpose: "custom",
             automation,
         },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/server",
   "email": "hi@budibase.com",
-  "version": "1.4.17",
+  "version": "1.4.18",
   "description": "Budibase Web Server",
   "main": "src/index.ts",
   "repository": {
@@ -77,11 +77,11 @@
   "license": "GPL-3.0",
   "dependencies": {
     "@apidevtools/swagger-parser": "10.0.3",
-    "@budibase/backend-core": "^1.4.17",
-    "@budibase/client": "^1.4.17",
-    "@budibase/pro": "1.4.16",
-    "@budibase/string-templates": "^1.4.17",
-    "@budibase/types": "^1.4.17",
+    "@budibase/backend-core": "^1.4.18",
+    "@budibase/client": "^1.4.18",
+    "@budibase/pro": "1.4.18-alpha.0",
+    "@budibase/string-templates": "^1.4.18",
+    "@budibase/types": "^1.4.18",
     "@bull-board/api": "3.7.0",
     "@bull-board/koa": "3.9.4",
     "@elastic/elasticsearch": "7.10.0",
@@ -199,5 +199,5 @@
   "optionalDependencies": {
     "oracledb": "5.3.0"
   },
-  "gitHead": "3ff0089293ddb047d76c1027f6e5ccf2c63c313d"
+  "gitHead": "395b2a45e083fb38f6ee4d3ed2b4d71534d6f526"
 }

package/scripts/dev/manage.js

@@ -59,6 +59,7 @@ async function init() {
       BB_ADMIN_USER_EMAIL: "",
       BB_ADMIN_USER_PASSWORD: "",
       PLUGINS_DIR: "",
+      TENANT_FEATURE_FLAGS: "*:LICENSING,*:USER_GROUPS",
     }
     let envFile = ""
     Object.keys(envFileJson).forEach(key => {

package/specs/openapi.json

@@ -1792,6 +1792,7 @@
   "paths": {
     "/applications": {
       "post": {
+        "operationId": "create",
         "summary": "Create an application",
         "tags": [
           "applications"
@@ -1832,6 +1833,7 @@
     },
     "/applications/{appId}": {
       "put": {
+        "operationId": "update",
         "summary": "Update an application",
         "tags": [
           "applications"
@@ -1870,6 +1872,7 @@
         }
       },
       "delete": {
+        "operationId": "destroy",
         "summary": "Delete an application",
         "tags": [
           "applications"
@@ -1898,6 +1901,7 @@
         }
       },
       "get": {
+        "operationId": "getById",
         "summary": "Retrieve an application",
         "tags": [
           "applications"
@@ -1928,6 +1932,7 @@
     },
     "/applications/search": {
       "post": {
+        "operationId": "search",
         "summary": "Search for applications",
         "description": "Based on application properties (currently only name) search for applications.",
         "tags": [
@@ -1964,6 +1969,7 @@
     },
     "/queries/{queryId}": {
       "post": {
+        "operationId": "execute",
         "summary": "Execute a query",
         "description": "Queries which have been created within a Budibase app can be executed using this,",
         "tags": [
@@ -2011,6 +2017,7 @@
     },
     "/queries/search": {
       "post": {
+        "operationId": "search",
         "summary": "Search for queries",
         "description": "Based on query properties (currently only name) search for queries.",
         "tags": [
@@ -2052,6 +2059,7 @@
     },
     "/tables/{tableId}/rows": {
       "post": {
+        "operationId": "create",
         "summary": "Create a row",
         "description": "Creates a row within the specified table.",
         "tags": [
@@ -2101,6 +2109,7 @@
     },
     "/tables/{tableId}/rows/{rowId}": {
       "put": {
+        "operationId": "update",
         "summary": "Update a row",
         "description": "Updates a row within the specified table.",
         "tags": [
@@ -2151,6 +2160,7 @@
         }
       },
       "delete": {
+        "operationId": "destroy",
         "summary": "Delete a row",
         "description": "Deletes a row within the specified table.",
         "tags": [
@@ -2186,6 +2196,7 @@
         }
       },
       "get": {
+        "operationId": "getById",
         "summary": "Retrieve a row",
         "description": "This gets a single row, it will be enriched with the full related rows, rather than the squashed \"primaryDisplay\" format returned by the search endpoint.",
         "tags": [
@@ -2223,6 +2234,7 @@
     },
     "/tables/{tableId}/rows/search": {
       "post": {
+        "operationId": "search",
         "summary": "Search for rows",
         "tags": [
           "rows"
@@ -2266,6 +2278,7 @@
     },
     "/tables": {
       "post": {
+        "operationId": "create",
         "summary": "Create a table",
         "description": "Create a table, this could be internal or external.",
         "tags": [
@@ -2311,6 +2324,7 @@
     },
     "/tables/{tableId}": {
       "put": {
+        "operationId": "update",
         "summary": "Update a table",
         "description": "Update a table, this could be internal or external.",
         "tags": [
@@ -2357,6 +2371,7 @@
         }
       },
       "delete": {
+        "operationId": "destroy",
         "summary": "Delete a table",
         "description": "Delete a table, this could be internal or external.",
         "tags": [
@@ -2389,6 +2404,7 @@
         }
       },
       "get": {
+        "operationId": "getById",
         "summary": "Retrieve a table",
         "description": "Lookup a table, this could be internal or external.",
         "tags": [
@@ -2423,6 +2439,7 @@
     },
     "/tables/search": {
       "post": {
+        "operationId": "search",
         "summary": "Search for tables",
         "description": "Based on table properties (currently only name) search for tables. This could be an internal or an external table.",
         "tags": [
@@ -2464,6 +2481,7 @@
     },
     "/users": {
       "post": {
+        "operationId": "create",
         "summary": "Create a user",
         "tags": [
           "users"
@@ -2499,6 +2517,7 @@
     },
     "/users/{userId}": {
       "put": {
+        "operationId": "update",
         "summary": "Update a user",
         "tags": [
           "users"
@@ -2537,6 +2556,7 @@
         }
       },
       "delete": {
+        "operationId": "destroy",
         "summary": "Delete a user",
         "tags": [
           "users"
@@ -2565,6 +2585,7 @@
         }
       },
       "get": {
+        "operationId": "getById",
         "summary": "Retrieve a user",
         "tags": [
           "users"
@@ -2595,6 +2616,7 @@
     },
     "/users/search": {
       "post": {
+        "operationId": "search",
         "summary": "Search for users",
         "description": "Based on user properties (currently only name) search for users.",
         "tags": [

package/specs/openapi.yaml

@@ -1370,6 +1370,7 @@ security:
 paths:
   /applications:
     post:
+      operationId: create
       summary: Create an application
       tags:
         - applications
@@ -1393,6 +1394,7 @@ paths:
                   $ref: "#/components/examples/application"
   "/applications/{appId}":
     put:
+      operationId: update
       summary: Update an application
       tags:
         - applications
@@ -1415,6 +1417,7 @@ paths:
                 application:
                   $ref: "#/components/examples/application"
     delete:
+      operationId: destroy
       summary: Delete an application
       tags:
         - applications
@@ -1431,6 +1434,7 @@ paths:
                 application:
                   $ref: "#/components/examples/application"
     get:
+      operationId: getById
       summary: Retrieve an application
       tags:
         - applications
@@ -1448,6 +1452,7 @@ paths:
                   $ref: "#/components/examples/application"
   /applications/search:
     post:
+      operationId: search
       summary: Search for applications
       description: Based on application properties (currently only name) search for
         applications.
@@ -1472,6 +1477,7 @@ paths:
                   $ref: "#/components/examples/applications"
   "/queries/{queryId}":
     post:
+      operationId: execute
       summary: Execute a query
       description: Queries which have been created within a Budibase app can be
         executed using this,
@@ -1500,6 +1506,7 @@ paths:
                   $ref: "#/components/examples/sqlResponse"
   /queries/search:
     post:
+      operationId: search
       summary: Search for queries
       description: Based on query properties (currently only name) search for queries.
       tags:
@@ -1524,6 +1531,7 @@ paths:
                   $ref: "#/components/examples/queries"
   "/tables/{tableId}/rows":
     post:
+      operationId: create
       summary: Create a row
       description: Creates a row within the specified table.
       tags:
@@ -1554,6 +1562,7 @@ paths:
                   $ref: "#/components/examples/row"
   "/tables/{tableId}/rows/{rowId}":
     put:
+      operationId: update
       summary: Update a row
       description: Updates a row within the specified table.
       tags:
@@ -1583,6 +1592,7 @@ paths:
                 row:
                   $ref: "#/components/examples/row"
     delete:
+      operationId: destroy
       summary: Delete a row
       description: Deletes a row within the specified table.
       tags:
@@ -1603,6 +1613,7 @@ paths:
                 row:
                   $ref: "#/components/examples/row"
     get:
+      operationId: getById
       summary: Retrieve a row
       description: This gets a single row, it will be enriched with the full related
         rows, rather than the squashed "primaryDisplay" format returned by the
@@ -1625,6 +1636,7 @@ paths:
                   $ref: "#/components/examples/enrichedRow"
   "/tables/{tableId}/rows/search":
     post:
+      operationId: search
       summary: Search for rows
       tags:
         - rows
@@ -1650,6 +1662,7 @@ paths:
                   $ref: "#/components/examples/rows"
   /tables:
     post:
+      operationId: create
       summary: Create a table
       description: Create a table, this could be internal or external.
       tags:
@@ -1677,6 +1690,7 @@ paths:
                   $ref: "#/components/examples/table"
   "/tables/{tableId}":
     put:
+      operationId: update
       summary: Update a table
       description: Update a table, this could be internal or external.
       tags:
@@ -1703,6 +1717,7 @@ paths:
                 table:
                   $ref: "#/components/examples/table"
     delete:
+      operationId: destroy
       summary: Delete a table
       description: Delete a table, this could be internal or external.
       tags:
@@ -1721,6 +1736,7 @@ paths:
                 table:
                   $ref: "#/components/examples/table"
     get:
+      operationId: getById
       summary: Retrieve a table
       description: Lookup a table, this could be internal or external.
       tags:
@@ -1740,6 +1756,7 @@ paths:
                   $ref: "#/components/examples/table"
   /tables/search:
     post:
+      operationId: search
       summary: Search for tables
       description: Based on table properties (currently only name) search for tables.
         This could be an internal or an external table.
@@ -1765,6 +1782,7 @@ paths:
                   $ref: "#/components/examples/tables"
   /users:
     post:
+      operationId: create
       summary: Create a user
       tags:
         - users
@@ -1786,6 +1804,7 @@ paths:
                   $ref: "#/components/examples/user"
   "/users/{userId}":
     put:
+      operationId: update
       summary: Update a user
       tags:
         - users
@@ -1808,6 +1827,7 @@ paths:
                 user:
                   $ref: "#/components/examples/user"
     delete:
+      operationId: destroy
       summary: Delete a user
       tags:
         - users
@@ -1824,6 +1844,7 @@ paths:
                 user:
                   $ref: "#/components/examples/user"
     get:
+      operationId: getById
       summary: Retrieve a user
       tags:
         - users
@@ -1841,6 +1862,7 @@ paths:
                   $ref: "#/components/examples/user"
   /users/search:
     post:
+      operationId: search
       summary: Search for users
       description: Based on user properties (currently only name) search for users.
       tags:

package/src/api/controllers/application.ts

@@ -47,14 +47,9 @@ import { checkAppMetadata } from "../../automations/logging"
 import { getUniqueRows } from "../../utilities/usageQuota/rows"
 import { quotas } from "@budibase/pro"
 import { errors, events, migrations } from "@budibase/backend-core"
-import {
-  App,
-  Layout,
-  Screen,
-  MigrationType,
-  AppNavigation,
-} from "@budibase/types"
+import { App, Layout, Screen, MigrationType } from "@budibase/types"
 import { BASE_LAYOUT_PROP_IDS } from "../../constants/layouts"
+import { groups } from "@budibase/pro"
 
 const URL_REGEX_SLASH = /\/|\\/g
 
@@ -501,6 +496,7 @@ const preDestroyApp = async (ctx: any) => {
 
 const postDestroyApp = async (ctx: any) => {
   const rowCount = ctx.rowCount
+  await groups.cleanupApp(ctx.params.appId)
   if (rowCount) {
     await quotas.removeRows(rowCount)
   }

package/src/api/controllers/{auth.js → auth.ts}

@@ -1,19 +1,21 @@
-const { outputProcessing } = require("../../utilities/rowProcessor")
-const { InternalTables } = require("../../db/utils")
-const { getFullUser } = require("../../utilities/users")
-const { BUILTIN_ROLE_IDS } = require("@budibase/backend-core/roles")
-const { getAppDB, getAppId } = require("@budibase/backend-core/context")
+import { outputProcessing } from "../../utilities/rowProcessor"
+import { InternalTables } from "../../db/utils"
+import { getFullUser } from "../../utilities/users"
+import { roles, context } from "@budibase/backend-core"
+import { groups } from "@budibase/pro"
+
+const PUBLIC_ROLE = roles.BUILTIN_ROLE_IDS.PUBLIC
 
 /**
  * Add the attributes that are session based to the current user.
  */
-const addSessionAttributesToUser = ctx => {
+const addSessionAttributesToUser = (ctx: any) => {
   if (ctx.user) {
     ctx.body.license = ctx.user.license
   }
 }
 
-exports.fetchSelf = async ctx => {
+export async function fetchSelf(ctx: any) {
   let userId = ctx.user.userId || ctx.user._id
   /* istanbul ignore next */
   if (!userId || !ctx.isAuthenticated) {
@@ -21,30 +23,30 @@ exports.fetchSelf = async ctx => {
     return
   }
 
+  const appId = context.getAppId()
   const user = await getFullUser(ctx, userId)
   // this shouldn't be returned by the app self
   delete user.roles
   // forward the csrf token from the session
   user.csrfToken = ctx.user.csrfToken
 
-  if (getAppId()) {
-    const db = getAppDB()
+  if (appId) {
+    const db = context.getAppDB()
+    // check for group permissions
+    if (!user.roleId || user.roleId === PUBLIC_ROLE) {
+      const groupRoleId = await groups.getGroupRoleId(user, appId)
+      user.roleId = groupRoleId || user.roleId
+    }
     // remove the full roles structure
     delete user.roles
     try {
       const userTable = await db.get(InternalTables.USER_METADATA)
-      const metadata = await db.get(userId)
-      // make sure there is never a stale csrf token
-      delete metadata.csrfToken
       // specifically needs to make sure is enriched
-      ctx.body = await outputProcessing(userTable, {
-        ...user,
-        ...metadata,
-      })
-    } catch (err) {
+      ctx.body = await outputProcessing(userTable, user)
+    } catch (err: any) {
       let response
       // user didn't exist in app, don't pretend they do
-      if (user.roleId === BUILTIN_ROLE_IDS.PUBLIC) {
+      if (user.roleId === PUBLIC_ROLE) {
         response = {}
       }
       // user has a role of some sort, return them

package/src/api/controllers/integration.js

@@ -8,7 +8,7 @@ exports.fetch = async function (ctx) {
   const defs = await getDefinitions()
 
   // for google sheets integration google verification
-  if (featureFlags.isEnabled(featureFlags.FeatureFlag.GOOGLE_SHEETS)) {
+  if (featureFlags.isEnabled(featureFlags.TenantFeatureFlag.GOOGLE_SHEETS)) {
     defs[SourceName.GOOGLE_SHEETS] = googlesheets.schema
   }
 

package/src/api/controllers/row/internal.js

@@ -333,7 +333,7 @@ exports.bulkDestroy = async ctx => {
 
 exports.search = async ctx => {
   // Fetch the whole table when running in cypress, as search doesn't work
-  if (env.isCypress()) {
+  if (!env.COUCH_DB_URL && env.isCypress()) {
     return { rows: await exports.fetch(ctx) }
   }
 

package/src/api/routes/analytics.js

@@ -1,7 +1,7 @@
 const Router = require("@koa/router")
 const controller = require("../controllers/analytics")
 
-const router = Router()
+const router = new Router()
 
 router.get("/api/bbtel", controller.isEnabled)
 router.post("/api/bbtel/ping", controller.ping)

package/src/api/routes/apikeys.js

@@ -3,7 +3,7 @@ const controller = require("../controllers/apikeys")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/keys", authorized(BUILDER), controller.fetch)

package/src/api/routes/auth.ts

@@ -0,0 +1,8 @@
+import Router from "@koa/router"
+import * as controller from "../controllers/auth"
+
+const router = new Router()
+
+router.get("/api/self", controller.fetchSelf)
+
+export default router

package/src/api/routes/automation.js

@@ -13,7 +13,7 @@ const {
 } = require("../../middleware/appInfo")
 const { automationValidator } = require("./utils/validators")
 
-const router = Router()
+const router = new Router()
 
 router
   .get(

package/src/api/routes/backup.js

@@ -3,7 +3,7 @@ const controller = require("../controllers/backup")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router.get("/api/backups/export", authorized(BUILDER), controller.exportAppDump)
 

package/src/api/routes/cloud.js

@@ -3,7 +3,7 @@ const controller = require("../controllers/cloud")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/cloud/export", authorized(BUILDER), controller.exportApps)

package/src/api/routes/component.js

@@ -3,7 +3,7 @@ const controller = require("../controllers/component")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router.get(
   "/api/:appId/components/definitions",

package/src/api/routes/datasource.js

@@ -11,7 +11,7 @@ const {
   datasourceQueryValidator,
 } = require("./utils/validators")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/datasources", authorized(BUILDER), datasourceController.fetch)

package/src/api/routes/deploy.js

@@ -3,7 +3,7 @@ const controller = require("../controllers/deploy")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/deployments", authorized(BUILDER), controller.fetchDeployments)

package/src/api/routes/dev.js

@@ -4,7 +4,7 @@ const env = require("../../environment")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 function redirectPath(path) {
   router

package/src/api/routes/integration.js

@@ -3,7 +3,7 @@ const controller = require("../controllers/integration")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/integrations", authorized(BUILDER), controller.fetch)