@budibase/server 2.1.22-alpha.5 → 2.1.22-alpha.7

package/src/middleware/authorized.ts

@@ -4,8 +4,8 @@ import {
   BUILTIN_ROLE_IDS,
 } from "@budibase/backend-core/roles"
 const {
-  PermissionTypes,
-  PermissionLevels,
+  PermissionType,
+  PermissionLevel,
   doesHaveBasePermission,
 } = require("@budibase/backend-core/permissions")
 const builderMiddleware = require("./builder")
@@ -33,7 +33,7 @@ const checkAuthorized = async (
 ) => {
   // check if this is a builder api and the user is not a builder
   const isBuilder = ctx.user && ctx.user.builder && ctx.user.builder.global
-  const isBuilderApi = permType === PermissionTypes.BUILDER
+  const isBuilderApi = permType === PermissionType.BUILDER
   if (isBuilderApi && !isBuilder) {
     return ctx.throw(403, "Not Authorized")
   }
@@ -91,9 +91,9 @@ export = (permType: any, permLevel: any = null, opts = { schema: false }) =>
     let resourceRoles: any = []
     let otherLevelRoles: any = []
     const otherLevel =
-      permLevel === PermissionLevels.READ
-        ? PermissionLevels.WRITE
-        : PermissionLevels.READ
+      permLevel === PermissionLevel.READ
+        ? PermissionLevel.WRITE
+        : PermissionLevel.READ
     const appId = getAppId()
     if (appId && hasResource(ctx)) {
       resourceRoles = await getRequiredResourceRole(permLevel, ctx)

package/src/middleware/{builder.js → builder.ts}

@@ -1,14 +1,16 @@
-const { APP_DEV_PREFIX } = require("../db/utils")
-const {
+import {
+  APP_DEV_PREFIX,
+  DocumentType,
+  getGlobalIDFromUserMetadataID,
+} from "../db/utils"
+import {
   doesUserHaveLock,
   updateLock,
   checkDebounce,
   setDebounce,
-} = require("../utilities/redis")
-const { doWithDB } = require("@budibase/backend-core/db")
-const { DocumentType, getGlobalIDFromUserMetadataID } = require("../db/utils")
-const { PermissionTypes } = require("@budibase/backend-core/permissions")
-const { app: appCache } = require("@budibase/backend-core/cache")
+} from "../utilities/redis"
+import { db as dbCore, cache, permissions } from "@budibase/backend-core"
+import { BBContext, Database } from "@budibase/types"
 
 const DEBOUNCE_TIME_SEC = 30
 
@@ -21,11 +23,11 @@ const DEBOUNCE_TIME_SEC = 30
  * through the authorized middleware                *
  ****************************************************/
 
-async function checkDevAppLocks(ctx) {
+async function checkDevAppLocks(ctx: BBContext) {
   const appId = ctx.appId
 
   // if any public usage, don't proceed
-  if (!ctx.user._id && !ctx.user.userId) {
+  if (!ctx.user?._id && !ctx.user?.userId) {
     return
   }
 
@@ -41,34 +43,34 @@ async function checkDevAppLocks(ctx) {
   await updateLock(appId, ctx.user)
 }
 
-async function updateAppUpdatedAt(ctx) {
+async function updateAppUpdatedAt(ctx: BBContext) {
   const appId = ctx.appId
   // if debouncing skip this update
   // get methods also aren't updating
   if (ctx.method === "GET" || (await checkDebounce(appId))) {
     return
   }
-  await doWithDB(appId, async db => {
+  await dbCore.doWithDB(appId, async (db: Database) => {
     const metadata = await db.get(DocumentType.APP_METADATA)
     metadata.updatedAt = new Date().toISOString()
 
-    metadata.updatedBy = getGlobalIDFromUserMetadataID(ctx.user.userId)
+    metadata.updatedBy = getGlobalIDFromUserMetadataID(ctx.user?.userId!)
 
     const response = await db.put(metadata)
     metadata._rev = response.rev
-    await appCache.invalidateAppMetadata(appId, metadata)
+    await cache.app.invalidateAppMetadata(appId, metadata)
     // set a new debounce record with a short TTL
     await setDebounce(appId, DEBOUNCE_TIME_SEC)
   })
 }
 
-module.exports = async (ctx, permType) => {
+export = async function builder(ctx: BBContext, permType: string) {
   const appId = ctx.appId
   // this only functions within an app context
   if (!appId) {
     return
   }
-  const isBuilderApi = permType === PermissionTypes.BUILDER
+  const isBuilderApi = permType === permissions.PermissionType.BUILDER
   const referer = ctx.headers["referer"]
 
   const overviewPath = "/builder/portal/overview/"

package/src/middleware/{currentapp.js → currentapp.ts}

@@ -1,29 +1,26 @@
-const {
-  getAppIdFromCtx,
-  setCookie,
-  getCookie,
-  clearCookie,
-} = require("@budibase/backend-core/utils")
-const { Cookies, Headers } = require("@budibase/backend-core/constants")
-const { getRole } = require("@budibase/backend-core/roles")
-const { BUILTIN_ROLE_IDS } = require("@budibase/backend-core/roles")
-const { generateUserMetadataID, isDevAppID } = require("../db/utils")
-const { dbExists } = require("@budibase/backend-core/db")
-const { isUserInAppTenant } = require("@budibase/backend-core/tenancy")
-const { getCachedSelf } = require("../utilities/global")
-const env = require("../environment")
-const { isWebhookEndpoint } = require("./utils")
-const { doInAppContext } = require("@budibase/backend-core/context")
+import {
+  utils,
+  constants,
+  roles,
+  db as dbCore,
+  tenancy,
+  context,
+} from "@budibase/backend-core"
+import { generateUserMetadataID, isDevAppID } from "../db/utils"
+import { getCachedSelf } from "../utilities/global"
+import env from "../environment"
+import { isWebhookEndpoint } from "./utils"
+import { BBContext } from "@budibase/types"
 
-module.exports = async (ctx, next) => {
+export = async (ctx: BBContext, next: any) => {
   // try to get the appID from the request
-  let requestAppId = await getAppIdFromCtx(ctx)
+  let requestAppId = await utils.getAppIdFromCtx(ctx)
   // get app cookie if it exists
-  let appCookie = null
+  let appCookie: { appId?: string } | undefined
   try {
-    appCookie = getCookie(ctx, Cookies.CurrentApp)
+    appCookie = utils.getCookie(ctx, constants.Cookie.CurrentApp)
   } catch (err) {
-    clearCookie(ctx, Cookies.CurrentApp)
+    utils.clearCookie(ctx, constants.Cookie.CurrentApp)
   }
   if (!appCookie && !requestAppId) {
     return next()
@@ -31,9 +28,9 @@ module.exports = async (ctx, next) => {
   // check the app exists referenced in cookie
   if (appCookie) {
     const appId = appCookie.appId
-    const exists = await dbExists(appId)
+    const exists = await dbCore.dbExists(appId)
     if (!exists) {
-      clearCookie(ctx, Cookies.CurrentApp)
+      utils.clearCookie(ctx, constants.Cookie.CurrentApp)
       return next()
     }
     // if the request app ID wasn't set, update it with the cookie
@@ -47,13 +44,13 @@ module.exports = async (ctx, next) => {
       !isWebhookEndpoint(ctx) &&
       (!ctx.user || !ctx.user.builder || !ctx.user.builder.global)
     ) {
-      clearCookie(ctx, Cookies.CurrentApp)
+      utils.clearCookie(ctx, constants.Cookie.CurrentApp)
       return ctx.redirect("/")
     }
   }
 
-  let appId,
-    roleId = BUILTIN_ROLE_IDS.PUBLIC
+  let appId: string | undefined,
+    roleId = roles.BUILTIN_ROLE_IDS.PUBLIC
   if (!ctx.user) {
     // not logged in, try to set a cookie for public apps
     appId = requestAppId
@@ -68,16 +65,20 @@ module.exports = async (ctx, next) => {
     const isBuilder =
       globalUser && globalUser.builder && globalUser.builder.global
     const isDevApp = appId && isDevAppID(appId)
-    const roleHeader = ctx.request && ctx.request.headers[Headers.PREVIEW_ROLE]
+    const roleHeader =
+      ctx.request &&
+      (ctx.request.headers[constants.Header.PREVIEW_ROLE] as string)
     if (isBuilder && isDevApp && roleHeader) {
       // Ensure the role is valid by ensuring a definition exists
       try {
-        await getRole(roleHeader)
-        roleId = roleHeader
+        if (roleHeader) {
+          await roles.getRole(roleHeader)
+          roleId = roleHeader
 
-        // Delete admin and builder flags so that the specified role is honoured
-        delete ctx.user.builder
-        delete ctx.user.admin
+          // Delete admin and builder flags so that the specified role is honoured
+          delete ctx.user.builder
+          delete ctx.user.admin
+        }
       } catch (error) {
         // Swallow error and do nothing
       }
@@ -89,7 +90,7 @@ module.exports = async (ctx, next) => {
     return next()
   }
 
-  return doInAppContext(appId, async () => {
+  return context.doInAppContext(appId, async () => {
     let skipCookie = false
     // if the user not in the right tenant then make sure they have no permissions
     // need to judge this only based on the request app ID,
@@ -97,14 +98,14 @@ module.exports = async (ctx, next) => {
       env.MULTI_TENANCY &&
       ctx.user &&
       requestAppId &&
-      !isUserInAppTenant(requestAppId, ctx.user)
+      !tenancy.isUserInAppTenant(requestAppId, ctx.user)
     ) {
       // don't error, simply remove the users rights (they are a public user)
       delete ctx.user.builder
       delete ctx.user.admin
       delete ctx.user.roles
       ctx.isAuthenticated = false
-      roleId = BUILTIN_ROLE_IDS.PUBLIC
+      roleId = roles.BUILTIN_ROLE_IDS.PUBLIC
       skipCookie = true
     }
 
@@ -112,15 +113,17 @@ module.exports = async (ctx, next) => {
     if (roleId) {
       ctx.roleId = roleId
       const globalId = ctx.user ? ctx.user._id : undefined
-      const userId = ctx.user ? generateUserMetadataID(ctx.user._id) : null
+      const userId = ctx.user
+        ? generateUserMetadataID(ctx.user._id!)
+        : undefined
       ctx.user = {
-        ...ctx.user,
+        ...ctx.user!,
         // override userID with metadata one
         _id: userId,
         userId,
         globalId,
         roleId,
-        role: await getRole(roleId),
+        role: await roles.getRole(roleId),
       }
     }
     if (
@@ -129,7 +132,7 @@ module.exports = async (ctx, next) => {
         appCookie.appId !== requestAppId) &&
       !skipCookie
     ) {
-      setCookie(ctx, { appId }, Cookies.CurrentApp)
+      utils.setCookie(ctx, { appId }, constants.Cookie.CurrentApp)
     }
 
     return next()

package/src/middleware/{joi-validator.js → joi-validator.ts}

@@ -1,20 +1,21 @@
-const Joi = require("joi")
+import Joi from "joi"
+import { BBContext } from "@budibase/types"
 
-function validate(schema, property) {
+function validate(schema: Joi.Schema, property: string) {
   // Return a Koa middleware function
-  return (ctx, next) => {
+  return (ctx: BBContext, next: any) => {
     if (!schema) {
       return next()
     }
     let params = null
     if (ctx[property] != null) {
       params = ctx[property]
-    } else if (ctx.request[property] != null) {
-      params = ctx.request[property]
+    } else if (ctx.request.get(property) != null) {
+      params = ctx.request.get(property)
     }
 
     // not all schemas have the append property e.g. array schemas
-    if (schema.append) {
+    if ("append" in schema && schema.append) {
       schema = schema.append({
         createdAt: Joi.any().optional(),
         updatedAt: Joi.any().optional(),
@@ -30,10 +31,10 @@ function validate(schema, property) {
   }
 }
 
-module.exports.body = schema => {
+export function body(schema: Joi.Schema) {
   return validate(schema, "body")
 }
 
-module.exports.params = schema => {
+export function params(schema: Joi.Schema) {
   return validate(schema, "params")
 }

package/src/middleware/publicApi.ts

@@ -0,0 +1,21 @@
+import { constants, utils } from "@budibase/backend-core"
+import { BBContext } from "@budibase/types"
+
+export = function ({ requiresAppId }: { requiresAppId?: boolean } = {}) {
+  return async (ctx: BBContext, next: any) => {
+    const appId = await utils.getAppIdFromCtx(ctx)
+    if (requiresAppId && !appId) {
+      ctx.throw(
+        400,
+        `Invalid app ID provided, please check the ${constants.Header.APP_ID} header.`
+      )
+    }
+    if (!ctx.headers[constants.Header.API_KEY]) {
+      ctx.throw(
+        400,
+        `Invalid API key provided, please check the ${constants.Header.API_KEY} header.`
+      )
+    }
+    return next()
+  }
+}

package/src/middleware/{resourceId.js → resourceId.ts}

@@ -1,17 +1,23 @@
-class ResourceIdGetter {
-  constructor(ctxProperty) {
+import { BBContext } from "@budibase/types"
+
+export class ResourceIdGetter {
+  parameter: string
+  main: string | null
+  sub: string | null
+
+  constructor(ctxProperty: string) {
     this.parameter = ctxProperty
     this.main = null
     this.sub = null
     return this
   }
 
-  mainResource(field) {
+  mainResource(field: string) {
     this.main = field
     return this
   }
 
-  subResource(field) {
+  subResource(field: string) {
     this.sub = field
     return this
   }
@@ -20,7 +26,8 @@ class ResourceIdGetter {
     const parameter = this.parameter,
       main = this.main,
       sub = this.sub
-    return (ctx, next) => {
+    return (ctx: BBContext, next: any) => {
+      // @ts-ignore
       const request = ctx.request[parameter] || ctx[parameter]
       if (request == null) {
         return next()
@@ -36,24 +43,22 @@ class ResourceIdGetter {
   }
 }
 
-module.exports.ResourceIdGetter = ResourceIdGetter
-
-module.exports.paramResource = main => {
+export function paramResource(main: string) {
   return new ResourceIdGetter("params").mainResource(main).build()
 }
 
-module.exports.paramSubResource = (main, sub) => {
+export function paramSubResource(main: string, sub: string) {
   return new ResourceIdGetter("params")
     .mainResource(main)
     .subResource(sub)
     .build()
 }
 
-module.exports.bodyResource = main => {
+export function bodyResource(main: string) {
   return new ResourceIdGetter("body").mainResource(main).build()
 }
 
-module.exports.bodySubResource = (main, sub) => {
+export function bodySubResource(main: string, sub: string) {
   return new ResourceIdGetter("body")
     .mainResource(main)
     .subResource(sub)

package/src/middleware/{selfhost.js → selfhost.ts}

@@ -1,7 +1,9 @@
-const env = require("../environment")
+import env from "../environment"
+import { BBContext } from "@budibase/types"
+
 // if added as a middleware will stop requests unless builder is in self host mode
 // or cloud is in self host
-module.exports = async (ctx, next) => {
+export = async (ctx: BBContext, next: any) => {
   if (env.SELF_HOSTED) {
     await next()
     return

package/src/middleware/tests/authorized.spec.js

@@ -9,7 +9,7 @@ jest.mock("../../environment", () => ({
 )
 const authorizedMiddleware = require("../authorized")
 const env = require("../../environment")
-const { PermissionTypes, PermissionLevels } = require("@budibase/backend-core/permissions")
+const { PermissionType, PermissionLevel } = require("@budibase/backend-core/permissions")
 const { doInAppContext } = require("@budibase/backend-core/context")
 
 const APP_ID = ""
@@ -113,7 +113,7 @@ describe("Authorization middleware", () => {
     
     it("throws if the user does not have builder permissions", async () => {
       config.setEnvironment(false)
-      config.setMiddlewareRequiredPermission(PermissionTypes.BUILDER)
+      config.setMiddlewareRequiredPermission(PermissionType.BUILDER)
       config.setUser({
         role: {
           _id: ""
@@ -125,13 +125,13 @@ describe("Authorization middleware", () => {
     })
 
     it("passes on to next() middleware if the user has resource permission", async () => {
-      config.setResourceId(PermissionTypes.QUERY)
+      config.setResourceId(PermissionType.QUERY)
       config.setUser({
         role: {
           _id: ""
         }
       })
-      config.setMiddlewareRequiredPermission(PermissionTypes.QUERY)
+      config.setMiddlewareRequiredPermission(PermissionType.QUERY)
 
       await config.executeMiddleware()
       expect(config.next).toHaveBeenCalled()
@@ -155,7 +155,7 @@ describe("Authorization middleware", () => {
           _id: ""
         },
       })
-      config.setMiddlewareRequiredPermission(PermissionTypes.ADMIN, PermissionLevels.BASIC)
+      config.setMiddlewareRequiredPermission(PermissionType.ADMIN, PermissionLevel.BASIC)
       
       await config.executeMiddleware()
       expect(config.throw).toHaveBeenCalledWith(403, "User does not have permission")