@budibase/server 1.4.8-alpha.7 → 1.4.8-alpha.9

package/dist/utilities/global.js

@@ -47,8 +47,10 @@ exports.updateAppRole = (user, { appId } = {}) => {
 };
 function checkGroupRoles(user, { appId } = {}) {
     return __awaiter(this, void 0, void 0, function* () {
-        let roleId = yield groups.getGroupRoleId(user, appId);
-        user.roleId = roleId;
+        if (user.roleId && user.roleId !== BUILTIN_ROLE_IDS.PUBLIC) {
+            return user;
+        }
+        user.roleId = yield groups.getGroupRoleId(user, appId);
         return user;
     });
 }
@@ -76,8 +78,9 @@ exports.getRawGlobalUser = (userId) => __awaiter(void 0, void 0, void 0, functio
     return db.get(getGlobalIDFromUserMetadataID(userId));
 });
 exports.getGlobalUser = (userId) => __awaiter(void 0, void 0, void 0, function* () {
+    const appId = getAppId();
     let user = yield exports.getRawGlobalUser(userId);
-    return processUser(user);
+    return processUser(user, { appId });
 });
 exports.getGlobalUsers = (users = null) => __awaiter(void 0, void 0, void 0, function* () {
     const appId = getAppId();

package/dist/utilities/users.js

@@ -12,9 +12,10 @@ const { InternalTables } = require("../db/utils");
 const { getGlobalUser } = require("../utilities/global");
 const { getAppDB } = require("@budibase/backend-core/context");
 const { getProdAppID } = require("@budibase/backend-core/db");
+const { BUILTIN_ROLE_IDS } = require("@budibase/backend-core/roles");
 exports.getFullUser = (ctx, userId) => __awaiter(void 0, void 0, void 0, function* () {
     const global = yield getGlobalUser(userId);
-    let metadata;
+    let metadata = {};
     try {
         // this will throw an error if the db doesn't exist, or there is no appId
         const db = getAppDB();
@@ -25,7 +26,8 @@ exports.getFullUser = (ctx, userId) => __awaiter(void 0, void 0, void 0, functio
         delete global._id;
         delete global._rev;
     }
-    return Object.assign(Object.assign(Object.assign({}, global), metadata), { tableId: InternalTables.USER_METADATA, 
+    delete metadata.csrfToken;
+    return Object.assign(Object.assign(Object.assign({}, metadata), global), { roleId: global.roleId || BUILTIN_ROLE_IDS.PUBLIC, tableId: InternalTables.USER_METADATA, 
         // make sure the ID is always a local ID, not a global one
         _id: userId });
 });

package/dist/utilities/workerRequests.js

@@ -63,7 +63,7 @@ function checkResponse(response, errorMsg, { ctx } = {}) {
 }
 exports.request = request;
 // have to pass in the tenant ID as this could be coming from an automation
-exports.sendSmtpEmail = (to, from, subject, contents, automation) => __awaiter(void 0, void 0, void 0, function* () {
+exports.sendSmtpEmail = (to, from, subject, contents, cc, bcc, automation) => __awaiter(void 0, void 0, void 0, function* () {
     // tenant ID will be set in header
     const response = yield fetch(checkSlashesInUrl(env.WORKER_URL + `/api/global/email/send`), request(null, {
         method: "POST",
@@ -72,6 +72,8 @@ exports.sendSmtpEmail = (to, from, subject, contents, automation) => __awaiter(v
             from,
             contents,
             subject,
+            cc,
+            bcc,
             purpose: "custom",
             automation,
         },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/server",
   "email": "hi@budibase.com",
-  "version": "1.4.8-alpha.7",
+  "version": "1.4.8-alpha.9",
   "description": "Budibase Web Server",
   "main": "src/index.ts",
   "repository": {
@@ -77,11 +77,11 @@
   "license": "GPL-3.0",
   "dependencies": {
     "@apidevtools/swagger-parser": "10.0.3",
-    "@budibase/backend-core": "1.4.8-alpha.7",
-    "@budibase/client": "1.4.8-alpha.7",
-    "@budibase/pro": "1.4.8-alpha.6",
-    "@budibase/string-templates": "1.4.8-alpha.7",
-    "@budibase/types": "1.4.8-alpha.7",
+    "@budibase/backend-core": "1.4.8-alpha.9",
+    "@budibase/client": "1.4.8-alpha.9",
+    "@budibase/pro": "1.4.8-alpha.8",
+    "@budibase/string-templates": "1.4.8-alpha.9",
+    "@budibase/types": "1.4.8-alpha.9",
     "@bull-board/api": "3.7.0",
     "@bull-board/koa": "3.9.4",
     "@elastic/elasticsearch": "7.10.0",
@@ -199,5 +199,5 @@
   "optionalDependencies": {
     "oracledb": "5.3.0"
   },
-  "gitHead": "c75ff1cd4a6576cdefad15a75588edfc6201ee1b"
+  "gitHead": "cef27c68ef3d7606b266629904a1a1b4bf877246"
 }

package/src/api/controllers/application.ts

@@ -47,14 +47,9 @@ import { checkAppMetadata } from "../../automations/logging"
 import { getUniqueRows } from "../../utilities/usageQuota/rows"
 import { quotas } from "@budibase/pro"
 import { errors, events, migrations } from "@budibase/backend-core"
-import {
-  App,
-  Layout,
-  Screen,
-  MigrationType,
-  AppNavigation,
-} from "@budibase/types"
+import { App, Layout, Screen, MigrationType } from "@budibase/types"
 import { BASE_LAYOUT_PROP_IDS } from "../../constants/layouts"
+import { groups } from "@budibase/pro"
 
 const URL_REGEX_SLASH = /\/|\\/g
 
@@ -501,6 +496,7 @@ const preDestroyApp = async (ctx: any) => {
 
 const postDestroyApp = async (ctx: any) => {
   const rowCount = ctx.rowCount
+  await groups.cleanupApp(ctx.params.appId)
   if (rowCount) {
     await quotas.removeRows(rowCount)
   }

package/src/api/controllers/{auth.js → auth.ts}

@@ -1,19 +1,21 @@
-const { outputProcessing } = require("../../utilities/rowProcessor")
-const { InternalTables } = require("../../db/utils")
-const { getFullUser } = require("../../utilities/users")
-const { BUILTIN_ROLE_IDS } = require("@budibase/backend-core/roles")
-const { getAppDB, getAppId } = require("@budibase/backend-core/context")
+import { outputProcessing } from "../../utilities/rowProcessor"
+import { InternalTables } from "../../db/utils"
+import { getFullUser } from "../../utilities/users"
+import { roles, context } from "@budibase/backend-core"
+import { groups } from "@budibase/pro"
+
+const PUBLIC_ROLE = roles.BUILTIN_ROLE_IDS.PUBLIC
 
 /**
  * Add the attributes that are session based to the current user.
  */
-const addSessionAttributesToUser = ctx => {
+const addSessionAttributesToUser = (ctx: any) => {
   if (ctx.user) {
     ctx.body.license = ctx.user.license
   }
 }
 
-exports.fetchSelf = async ctx => {
+export async function fetchSelf(ctx: any) {
   let userId = ctx.user.userId || ctx.user._id
   /* istanbul ignore next */
   if (!userId || !ctx.isAuthenticated) {
@@ -21,30 +23,30 @@ exports.fetchSelf = async ctx => {
     return
   }
 
+  const appId = context.getAppId()
   const user = await getFullUser(ctx, userId)
   // this shouldn't be returned by the app self
   delete user.roles
   // forward the csrf token from the session
   user.csrfToken = ctx.user.csrfToken
 
-  if (getAppId()) {
-    const db = getAppDB()
+  if (appId) {
+    const db = context.getAppDB()
+    // check for group permissions
+    if (!user.roleId || user.roleId === PUBLIC_ROLE) {
+      const groupRoleId = await groups.getGroupRoleId(user, appId)
+      user.roleId = groupRoleId || user.roleId
+    }
     // remove the full roles structure
     delete user.roles
     try {
       const userTable = await db.get(InternalTables.USER_METADATA)
-      const metadata = await db.get(userId)
-      // make sure there is never a stale csrf token
-      delete metadata.csrfToken
       // specifically needs to make sure is enriched
-      ctx.body = await outputProcessing(userTable, {
-        ...user,
-        ...metadata,
-      })
-    } catch (err) {
+      ctx.body = await outputProcessing(userTable, user)
+    } catch (err: any) {
       let response
       // user didn't exist in app, don't pretend they do
-      if (user.roleId === BUILTIN_ROLE_IDS.PUBLIC) {
+      if (user.roleId === PUBLIC_ROLE) {
         response = {}
       }
       // user has a role of some sort, return them

package/src/api/controllers/integration.js

@@ -8,7 +8,7 @@ exports.fetch = async function (ctx) {
   const defs = await getDefinitions()
 
   // for google sheets integration google verification
-  if (featureFlags.isEnabled(featureFlags.FeatureFlag.GOOGLE_SHEETS)) {
+  if (featureFlags.isEnabled(featureFlags.TenantFeatureFlag.GOOGLE_SHEETS)) {
     defs[SourceName.GOOGLE_SHEETS] = googlesheets.schema
   }
 

package/src/api/routes/analytics.js

@@ -1,7 +1,7 @@
 const Router = require("@koa/router")
 const controller = require("../controllers/analytics")
 
-const router = Router()
+const router = new Router()
 
 router.get("/api/bbtel", controller.isEnabled)
 router.post("/api/bbtel/ping", controller.ping)

package/src/api/routes/apikeys.js

@@ -3,7 +3,7 @@ const controller = require("../controllers/apikeys")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/keys", authorized(BUILDER), controller.fetch)

package/src/api/routes/auth.ts

@@ -0,0 +1,8 @@
+import Router from "@koa/router"
+import * as controller from "../controllers/auth"
+
+const router = new Router()
+
+router.get("/api/self", controller.fetchSelf)
+
+export default router

package/src/api/routes/automation.js

@@ -13,7 +13,7 @@ const {
 } = require("../../middleware/appInfo")
 const { automationValidator } = require("./utils/validators")
 
-const router = Router()
+const router = new Router()
 
 router
   .get(

package/src/api/routes/backup.js

@@ -3,7 +3,7 @@ const controller = require("../controllers/backup")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router.get("/api/backups/export", authorized(BUILDER), controller.exportAppDump)
 

package/src/api/routes/cloud.js

@@ -3,7 +3,7 @@ const controller = require("../controllers/cloud")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/cloud/export", authorized(BUILDER), controller.exportApps)

package/src/api/routes/component.js

@@ -3,7 +3,7 @@ const controller = require("../controllers/component")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router.get(
   "/api/:appId/components/definitions",

package/src/api/routes/datasource.js

@@ -11,7 +11,7 @@ const {
   datasourceQueryValidator,
 } = require("./utils/validators")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/datasources", authorized(BUILDER), datasourceController.fetch)

package/src/api/routes/deploy.js

@@ -3,7 +3,7 @@ const controller = require("../controllers/deploy")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/deployments", authorized(BUILDER), controller.fetchDeployments)

package/src/api/routes/dev.js

@@ -4,7 +4,7 @@ const env = require("../../environment")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 function redirectPath(path) {
   router

package/src/api/routes/integration.js

@@ -3,7 +3,7 @@ const controller = require("../controllers/integration")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/integrations", authorized(BUILDER), controller.fetch)

package/src/api/routes/layout.js

@@ -3,7 +3,7 @@ const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 const controller = require("../controllers/layout")
 
-const router = Router()
+const router = new Router()
 
 router
   .post("/api/layouts", authorized(BUILDER), controller.save)

package/src/api/routes/metadata.js

@@ -7,7 +7,7 @@ const {
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router
   .post(

package/src/api/routes/migrations.js

@@ -1,6 +1,6 @@
 const Router = require("@koa/router")
 const migrationsController = require("../controllers/migrations")
-const router = Router()
+const router = new Router()
 const { internalApi } = require("@budibase/backend-core/auth")
 
 router

package/src/api/routes/permission.js

@@ -4,7 +4,7 @@ const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 const { permissionValidator } = require("./utils/validators")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/permission/builtin", authorized(BUILDER), controller.fetchBuiltin)

package/src/api/routes/query.js

@@ -16,7 +16,7 @@ const {
   generateQueryValidation,
 } = require("../controllers/query/validation")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/queries", authorized(BUILDER), queryController.fetch)

package/src/api/routes/role.js

@@ -4,7 +4,7 @@ const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 const { roleValidator } = require("./utils/validators")
 
-const router = Router()
+const router = new Router()
 
 router
   .post("/api/roles", authorized(BUILDER), roleValidator(), controller.save)

package/src/api/routes/routing.js

@@ -3,7 +3,7 @@ const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 const controller = require("../controllers/routing")
 
-const router = Router()
+const router = new Router()
 
 router
   // gets correct structure for user role

package/src/api/routes/screen.js

@@ -4,7 +4,7 @@ const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 const { screenValidator } = require("./utils/validators")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/screens", authorized(BUILDER), controller.fetch)

package/src/api/routes/script.js

@@ -3,7 +3,7 @@ const controller = require("../controllers/script")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router.post("/api/script", authorized(BUILDER), controller.save)
 

package/src/api/routes/table.js

@@ -9,7 +9,7 @@ const {
 } = require("@budibase/backend-core/permissions")
 const { tableValidator } = require("./utils/validators")
 
-const router = Router()
+const router = new Router()
 
 router
   /**

package/src/api/routes/templates.js

@@ -3,7 +3,7 @@ const controller = require("../controllers/templates")
 const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/templates", authorized(BUILDER), controller.fetch)

package/src/api/routes/user.js

@@ -6,7 +6,7 @@ const {
   PermissionTypes,
 } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router
   .get(

package/src/api/routes/view.js

@@ -9,7 +9,7 @@ const {
   PermissionLevels,
 } = require("@budibase/backend-core/permissions")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/views/export", authorized(BUILDER), viewController.exportView)

package/src/api/routes/webhook.js

@@ -4,7 +4,7 @@ const authorized = require("../../middleware/authorized")
 const { BUILDER } = require("@budibase/backend-core/permissions")
 const { webhookValidator } = require("./utils/validators")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/webhooks", authorized(BUILDER), controller.fetch)

package/src/automations/steps/sendSmtpEmail.js

@@ -21,6 +21,14 @@ exports.definition = {
           type: "string",
           title: "Send From",
         },
+        cc: {
+          type: "string",
+          title: "CC",
+        },
+        bcc: {
+          type: "string",
+          title: "BCC",
+        },
         subject: {
           type: "string",
           title: "Email Subject",
@@ -49,13 +57,21 @@ exports.definition = {
 }
 
 exports.run = async function ({ inputs }) {
-  let { to, from, subject, contents } = inputs
+  let { to, from, subject, contents, cc, bcc } = inputs
   if (!contents) {
     contents = "<h1>No content</h1>"
   }
   to = to || undefined
   try {
-    let response = await sendSmtpEmail(to, from, subject, contents, true)
+    let response = await sendSmtpEmail(
+      to,
+      from,
+      subject,
+      contents,
+      cc,
+      bcc,
+      true
+    )
     return {
       success: true,
       response,

package/src/middleware/authorized.ts

@@ -52,9 +52,9 @@ const checkAuthorizedResource = async (
 ) => {
   // get the user's roles
   const roleId = ctx.roleId || BUILTIN_ROLE_IDS.PUBLIC
-  const userRoles = await getUserRoleHierarchy(roleId, {
+  const userRoles = (await getUserRoleHierarchy(roleId, {
     idOnly: false,
-  })
+  })) as { _id: string }[]
   const permError = "User does not have permission"
   // check if the user has the required role
   if (resourceRoles.length > 0) {

package/src/utilities/global.js

@@ -43,9 +43,10 @@ exports.updateAppRole = (user, { appId } = {}) => {
 }
 
 async function checkGroupRoles(user, { appId } = {}) {
-  let roleId = await groups.getGroupRoleId(user, appId)
-  user.roleId = roleId
-
+  if (user.roleId && user.roleId !== BUILTIN_ROLE_IDS.PUBLIC) {
+    return user
+  }
+  user.roleId = await groups.getGroupRoleId(user, appId)
   return user
 }
 
@@ -74,8 +75,9 @@ exports.getRawGlobalUser = async userId => {
 }
 
 exports.getGlobalUser = async userId => {
+  const appId = getAppId()
   let user = await exports.getRawGlobalUser(userId)
-  return processUser(user)
+  return processUser(user, { appId })
 }
 
 exports.getGlobalUsers = async (users = null) => {

package/src/utilities/users.js

@@ -2,10 +2,11 @@ const { InternalTables } = require("../db/utils")
 const { getGlobalUser } = require("../utilities/global")
 const { getAppDB } = require("@budibase/backend-core/context")
 const { getProdAppID } = require("@budibase/backend-core/db")
+const { BUILTIN_ROLE_IDS } = require("@budibase/backend-core/roles")
 
 exports.getFullUser = async (ctx, userId) => {
   const global = await getGlobalUser(userId)
-  let metadata
+  let metadata = {}
   try {
     // this will throw an error if the db doesn't exist, or there is no appId
     const db = getAppDB()
@@ -15,9 +16,11 @@ exports.getFullUser = async (ctx, userId) => {
     delete global._id
     delete global._rev
   }
+  delete metadata.csrfToken
   return {
-    ...global,
     ...metadata,
+    ...global,
+    roleId: global.roleId || BUILTIN_ROLE_IDS.PUBLIC,
     tableId: InternalTables.USER_METADATA,
     // make sure the ID is always a local ID, not a global one
     _id: userId,

package/src/utilities/workerRequests.js

@@ -54,7 +54,15 @@ async function checkResponse(response, errorMsg, { ctx } = {}) {
 exports.request = request
 
 // have to pass in the tenant ID as this could be coming from an automation
-exports.sendSmtpEmail = async (to, from, subject, contents, automation) => {
+exports.sendSmtpEmail = async (
+  to,
+  from,
+  subject,
+  contents,
+  cc,
+  bcc,
+  automation
+) => {
   // tenant ID will be set in header
   const response = await fetch(
     checkSlashesInUrl(env.WORKER_URL + `/api/global/email/send`),
@@ -65,6 +73,8 @@ exports.sendSmtpEmail = async (to, from, subject, contents, automation) => {
         from,
         contents,
         subject,
+        cc,
+        bcc,
         purpose: "custom",
         automation,
       },