@budibase/server 2.1.32-alpha.8 → 2.1.32

package/dist/integrations/index.js

@@ -12,7 +12,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getIntegration = exports.getDefinitions = void 0;
 const postgres_1 = __importDefault(require("./postgres"));
 const dynamodb_1 = __importDefault(require("./dynamodb"));
 const mongodb_1 = __importDefault(require("./mongodb"));
@@ -76,8 +75,8 @@ if (process.arch &&
     DEFINITIONS[types_1.SourceName.ORACLE] = oracle_1.default.schema;
     INTEGRATIONS[types_1.SourceName.ORACLE] = oracle_1.default.integration;
 }
-function getDefinitions() {
-    return __awaiter(this, void 0, void 0, function* () {
+module.exports = {
+    getDefinitions: () => __awaiter(void 0, void 0, void 0, function* () {
         const pluginSchemas = {};
         if (environment.SELF_HOSTED) {
             const plugins = yield (0, plugin_1.getPlugins)(types_1.PluginType.DATASOURCE);
@@ -91,12 +90,9 @@ function getDefinitions() {
             }
         }
         return Object.assign(Object.assign({}, cloneDeep(DEFINITIONS)), pluginSchemas);
-    });
-}
-exports.getDefinitions = getDefinitions;
-function getIntegration(integration) {
-    var _a;
-    return __awaiter(this, void 0, void 0, function* () {
+    }),
+    getIntegration: (integration) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
         if (INTEGRATIONS[integration]) {
             return INTEGRATIONS[integration];
         }
@@ -116,10 +112,5 @@ function getIntegration(integration) {
             }
         }
         throw new Error("No datasource implementation found.");
-    });
-}
-exports.getIntegration = getIntegration;
-exports.default = {
-    getDefinitions,
-    getIntegration,
+    }),
 };

package/dist/integrations/s3.js

@@ -11,7 +11,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 const types_1 = require("@budibase/types");
 const AWS = require("aws-sdk");
-const csv = require("csvtojson");
 const SCHEMA = {
     docs: "https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/S3.html",
     description: "Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance.",
@@ -42,106 +41,16 @@ const SCHEMA = {
         },
     },
     query: {
-        create: {
-            type: types_1.QueryType.FIELDS,
-            fields: {
-                bucket: {
-                    display: "New Bucket",
-                    type: types_1.DatasourceFieldType.STRING,
-                    required: true,
-                },
-                location: {
-                    required: true,
-                    default: "us-east-1",
-                    type: types_1.DatasourceFieldType.STRING,
-                },
-                grantFullControl: {
-                    display: "Grant full control",
-                    type: types_1.DatasourceFieldType.STRING,
-                },
-                grantRead: {
-                    display: "Grant read",
-                    type: types_1.DatasourceFieldType.STRING,
-                },
-                grantReadAcp: {
-                    display: "Grant read ACP",
-                    type: types_1.DatasourceFieldType.STRING,
-                },
-                grantWrite: {
-                    display: "Grant write",
-                    type: types_1.DatasourceFieldType.STRING,
-                },
-                grantWriteAcp: {
-                    display: "Grant write ACP",
-                    type: types_1.DatasourceFieldType.STRING,
-                },
-            },
-        },
         read: {
             type: types_1.QueryType.FIELDS,
             fields: {
                 bucket: {
-                    type: types_1.DatasourceFieldType.STRING,
-                    required: true,
-                },
-                delimiter: {
-                    type: types_1.DatasourceFieldType.STRING,
-                },
-                marker: {
-                    type: types_1.DatasourceFieldType.STRING,
-                },
-                maxKeys: {
-                    type: types_1.DatasourceFieldType.NUMBER,
-                    display: "Max Keys",
-                },
-                prefix: {
-                    type: types_1.DatasourceFieldType.STRING,
-                },
-            },
-        },
-        readCsv: {
-            displayName: "Read CSV",
-            type: types_1.QueryType.FIELDS,
-            fields: {
-                bucket: {
-                    type: types_1.DatasourceFieldType.STRING,
-                    required: true,
-                },
-                key: {
-                    type: types_1.DatasourceFieldType.STRING,
-                    required: true,
-                },
-            },
-        },
-        delete: {
-            type: types_1.QueryType.FIELDS,
-            fields: {
-                bucket: {
-                    type: types_1.DatasourceFieldType.STRING,
-                    required: true,
-                },
-                delete: {
-                    type: types_1.DatasourceFieldType.JSON,
+                    type: "string",
                     required: true,
                 },
             },
         },
     },
-    extra: {
-        acl: {
-            required: false,
-            displayName: "ACL",
-            type: types_1.DatasourceFieldType.LIST,
-            data: {
-                create: [
-                    "private",
-                    "public-read",
-                    "public-read-write",
-                    "authenticated-read",
-                ],
-            },
-        },
-    },
 };
 class S3Integration {
     constructor(config) {
@@ -154,81 +63,16 @@ class S3Integration {
         }
         this.client = new AWS.S3(this.config);
     }
-    create(query) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            let params = {
-                Bucket: query.bucket,
-                ACL: (_a = query.extra) === null || _a === void 0 ? void 0 : _a.acl,
-                GrantFullControl: query.grantFullControl,
-                GrantRead: query.grantRead,
-                GrantReadACP: query.grantReadAcp,
-                GrantWrite: query.grantWrite,
-                GrantWriteACP: query.grantWriteAcp,
-            };
-            if (query.location) {
-                params["CreateBucketConfiguration"] = {
-                    LocationConstraint: query.location,
-                };
-            }
-            return yield this.client.createBucket(params).promise();
-        });
-    }
     read(query) {
         return __awaiter(this, void 0, void 0, function* () {
             const response = yield this.client
                 .listObjects({
                 Bucket: query.bucket,
-                Delimiter: query.delimiter,
-                Marker: query.marker,
-                MaxKeys: query.maxKeys,
-                Prefix: query.prefix,
             })
                 .promise();
             return response.Contents;
         });
     }
-    readCsv(query) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const stream = this.client
-                .getObject({
-                Bucket: query.bucket,
-                Key: query.key,
-            })
-                .createReadStream();
-            let csvError = false;
-            return new Promise((resolve, reject) => {
-                stream.on("error", (err) => {
-                    reject(err);
-                });
-                const response = csv()
-                    .fromStream(stream)
-                    .on("error", () => {
-                    csvError = true;
-                });
-                stream.on("finish", () => {
-                    resolve(response);
-                });
-            }).catch(err => {
-                if (csvError) {
-                    throw new Error("Could not read CSV");
-                }
-                else {
-                    throw err;
-                }
-            });
-        });
-    }
-    delete(query) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this.client
-                .deleteObjects({
-                Bucket: query.bucket,
-                Delete: JSON.parse(query.delete),
-            })
-                .promise();
-        });
-    }
 }
 exports.default = {
     schema: SCHEMA,

package/dist/middleware/appInfo.js

@@ -1,22 +1,17 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.middleware = exports.AppType = void 0;
-const utils_1 = require("../db/utils");
-var AppType;
-(function (AppType) {
-    AppType["DEV"] = "dev";
-    AppType["PROD"] = "prod";
-})(AppType = exports.AppType || (exports.AppType = {}));
-function middleware({ appType } = {}) {
-    return (ctx, next) => {
+const { isDevAppID, isProdAppID } = require("../db/utils");
+exports.AppType = {
+    DEV: "dev",
+    PROD: "prod",
+};
+exports.middleware =
+    ({ appType } = {}) => (ctx, next) => {
         const appId = ctx.appId;
-        if (appType === AppType.DEV && appId && !(0, utils_1.isDevAppID)(appId)) {
+        if (appType === exports.AppType.DEV && appId && !isDevAppID(appId)) {
             ctx.throw(400, "Only apps in development support this endpoint");
         }
-        if (appType === AppType.PROD && appId && !(0, utils_1.isProdAppID)(appId)) {
+        if (appType === exports.AppType.PROD && appId && !isProdAppID(appId)) {
             ctx.throw(400, "Only apps in production support this endpoint");
         }
         return next();
     };
-}
-exports.middleware = middleware;

package/dist/middleware/authorized.js

@@ -8,16 +8,16 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-const backend_core_1 = require("@budibase/backend-core");
-const builder_1 = __importDefault(require("./builder"));
-const utils_1 = require("./utils");
+const roles_1 = require("@budibase/backend-core/roles");
+const { PermissionTypes, PermissionLevels, doesHaveBasePermission, } = require("@budibase/backend-core/permissions");
+const builderMiddleware = require("./builder");
+const { isWebhookEndpoint } = require("./utils");
+const { buildCsrfMiddleware } = require("@budibase/backend-core/auth");
+const { getAppId } = require("@budibase/backend-core/context");
 function hasResource(ctx) {
     return ctx.resourceId != null;
 }
-const csrf = backend_core_1.auth.buildCsrfMiddleware();
+const csrf = buildCsrfMiddleware();
 /**
  * Apply authorization to the requested resource:
  * - If this is a builder resource the user must be a builder.
@@ -27,7 +27,7 @@ const csrf = backend_core_1.auth.buildCsrfMiddleware();
 const checkAuthorized = (ctx, resourceRoles, permType, permLevel) => __awaiter(void 0, void 0, void 0, function* () {
     // check if this is a builder api and the user is not a builder
     const isBuilder = ctx.user && ctx.user.builder && ctx.user.builder.global;
-    const isBuilderApi = permType === backend_core_1.permissions.PermissionType.BUILDER;
+    const isBuilderApi = permType === PermissionTypes.BUILDER;
     if (isBuilderApi && !isBuilder) {
         return ctx.throw(403, "Not Authorized");
     }
@@ -38,8 +38,8 @@ const checkAuthorized = (ctx, resourceRoles, permType, permLevel) => __awaiter(v
 });
 const checkAuthorizedResource = (ctx, resourceRoles, permType, permLevel) => __awaiter(void 0, void 0, void 0, function* () {
     // get the user's roles
-    const roleId = ctx.roleId || backend_core_1.roles.BUILTIN_ROLE_IDS.PUBLIC;
-    const userRoles = (yield backend_core_1.roles.getUserRoleHierarchy(roleId, {
+    const roleId = ctx.roleId || roles_1.BUILTIN_ROLE_IDS.PUBLIC;
+    const userRoles = (yield (0, roles_1.getUserRoleHierarchy)(roleId, {
         idOnly: false,
     }));
     const permError = "User does not have permission";
@@ -52,14 +52,14 @@ const checkAuthorizedResource = (ctx, resourceRoles, permType, permLevel) => __a
         }
         // fallback to the base permissions when no resource roles are found
     }
-    else if (!backend_core_1.permissions.doesHaveBasePermission(permType, permLevel, userRoles)) {
+    else if (!doesHaveBasePermission(permType, permLevel, userRoles)) {
         ctx.throw(403, permError);
     }
 });
 module.exports = (permType, permLevel = null, opts = { schema: false }) => (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
     // webhooks don't need authentication, each webhook unique
     // also internal requests (between services) don't need authorized
-    if ((0, utils_1.isWebhookEndpoint)(ctx) || ctx.internal) {
+    if (isWebhookEndpoint(ctx) || ctx.internal) {
         return next();
     }
     if (!ctx.user) {
@@ -67,24 +67,23 @@ module.exports = (permType, permLevel = null, opts = { schema: false }) => (ctx,
     }
     // check general builder stuff, this middleware is a good way
     // to find API endpoints which are builder focused
-    yield (0, builder_1.default)(ctx, permType);
+    yield builderMiddleware(ctx, permType);
     // get the resource roles
     let resourceRoles = [];
     let otherLevelRoles = [];
-    const otherLevel = permLevel === backend_core_1.permissions.PermissionLevel.READ
-        ? backend_core_1.permissions.PermissionLevel.WRITE
-        : backend_core_1.permissions.PermissionLevel.READ;
-    const appId = backend_core_1.context.getAppId();
+    const otherLevel = permLevel === PermissionLevels.READ
+        ? PermissionLevels.WRITE
+        : PermissionLevels.READ;
+    const appId = getAppId();
     if (appId && hasResource(ctx)) {
-        resourceRoles = yield backend_core_1.roles.getRequiredResourceRole(permLevel, ctx);
+        resourceRoles = yield (0, roles_1.getRequiredResourceRole)(permLevel, ctx);
         if (opts && opts.schema) {
-            otherLevelRoles = yield backend_core_1.roles.getRequiredResourceRole(otherLevel, ctx);
+            otherLevelRoles = yield (0, roles_1.getRequiredResourceRole)(otherLevel, ctx);
         }
     }
     // if the resource is public, proceed
-    if (resourceRoles.includes(backend_core_1.roles.BUILTIN_ROLE_IDS.PUBLIC) ||
-        (otherLevelRoles &&
-            otherLevelRoles.includes(backend_core_1.roles.BUILTIN_ROLE_IDS.PUBLIC))) {
+    if (resourceRoles.includes(roles_1.BUILTIN_ROLE_IDS.PUBLIC) ||
+        (otherLevelRoles && otherLevelRoles.includes(roles_1.BUILTIN_ROLE_IDS.PUBLIC))) {
         return next();
     }
     // check authenticated

package/dist/middleware/builder.js

@@ -8,9 +8,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-const utils_1 = require("../db/utils");
-const redis_1 = require("../utilities/redis");
-const backend_core_1 = require("@budibase/backend-core");
+const { APP_DEV_PREFIX } = require("../db/utils");
+const { doesUserHaveLock, updateLock, checkDebounce, setDebounce, } = require("../utilities/redis");
+const { doWithDB } = require("@budibase/backend-core/db");
+const { DocumentType, getGlobalIDFromUserMetadataID } = require("../db/utils");
+const { PermissionTypes } = require("@budibase/backend-core/permissions");
+const { app: appCache } = require("@budibase/backend-core/cache");
 const DEBOUNCE_TIME_SEC = 30;
 /************************************************** *
  * This middleware has been broken out of the       *
@@ -21,22 +24,21 @@ const DEBOUNCE_TIME_SEC = 30;
  * through the authorized middleware                *
  ****************************************************/
 function checkDevAppLocks(ctx) {
-    var _a, _b;
     return __awaiter(this, void 0, void 0, function* () {
         const appId = ctx.appId;
         // if any public usage, don't proceed
-        if (!((_a = ctx.user) === null || _a === void 0 ? void 0 : _a._id) && !((_b = ctx.user) === null || _b === void 0 ? void 0 : _b.userId)) {
+        if (!ctx.user._id && !ctx.user.userId) {
             return;
         }
         // not a development app, don't need to do anything
-        if (!appId || !appId.startsWith(utils_1.APP_DEV_PREFIX)) {
+        if (!appId || !appId.startsWith(APP_DEV_PREFIX)) {
             return;
         }
-        if (!(yield (0, redis_1.doesUserHaveLock)(appId, ctx.user))) {
+        if (!(yield doesUserHaveLock(appId, ctx.user))) {
             ctx.throw(400, "User does not hold app lock.");
         }
         // they do have lock, update it
-        yield (0, redis_1.updateLock)(appId, ctx.user);
+        yield updateLock(appId, ctx.user);
     });
 }
 function updateAppUpdatedAt(ctx) {
@@ -44,45 +46,42 @@ function updateAppUpdatedAt(ctx) {
         const appId = ctx.appId;
         // if debouncing skip this update
         // get methods also aren't updating
-        if (ctx.method === "GET" || (yield (0, redis_1.checkDebounce)(appId))) {
+        if (ctx.method === "GET" || (yield checkDebounce(appId))) {
             return;
         }
-        yield backend_core_1.db.doWithDB(appId, (db) => __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const metadata = yield db.get(utils_1.DocumentType.APP_METADATA);
+        yield doWithDB(appId, (db) => __awaiter(this, void 0, void 0, function* () {
+            const metadata = yield db.get(DocumentType.APP_METADATA);
             metadata.updatedAt = new Date().toISOString();
-            metadata.updatedBy = (0, utils_1.getGlobalIDFromUserMetadataID)((_a = ctx.user) === null || _a === void 0 ? void 0 : _a.userId);
+            metadata.updatedBy = getGlobalIDFromUserMetadataID(ctx.user.userId);
             const response = yield db.put(metadata);
             metadata._rev = response.rev;
-            yield backend_core_1.cache.app.invalidateAppMetadata(appId, metadata);
+            yield appCache.invalidateAppMetadata(appId, metadata);
             // set a new debounce record with a short TTL
-            yield (0, redis_1.setDebounce)(appId, DEBOUNCE_TIME_SEC);
+            yield setDebounce(appId, DEBOUNCE_TIME_SEC);
         }));
     });
 }
-module.exports = function builder(ctx, permType) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const appId = ctx.appId;
-        // this only functions within an app context
-        if (!appId) {
-            return;
-        }
-        const isBuilderApi = permType === backend_core_1.permissions.PermissionType.BUILDER;
-        const referer = ctx.headers["referer"];
-        const overviewPath = "/builder/portal/overview/";
-        const overviewContext = !referer ? false : referer.includes(overviewPath);
-        if (overviewContext) {
-            return;
-        }
-        const hasAppId = !referer ? false : referer.includes(appId);
-        const editingApp = referer ? hasAppId : false;
-        // check this is a builder call and editing
-        if (!isBuilderApi || !editingApp) {
-            return;
-        }
-        // check locks
-        yield checkDevAppLocks(ctx);
-        // set updated at time on app
-        yield updateAppUpdatedAt(ctx);
-    });
-};
+module.exports = (ctx, permType) => __awaiter(void 0, void 0, void 0, function* () {
+    const appId = ctx.appId;
+    // this only functions within an app context
+    if (!appId) {
+        return;
+    }
+    const isBuilderApi = permType === PermissionTypes.BUILDER;
+    const referer = ctx.headers["referer"];
+    const overviewPath = "/builder/portal/overview/";
+    const overviewContext = !referer ? false : referer.includes(overviewPath);
+    if (overviewContext) {
+        return;
+    }
+    const hasAppId = !referer ? false : referer.includes(appId);
+    const editingApp = referer ? hasAppId : false;
+    // check this is a builder call and editing
+    if (!isBuilderApi || !editingApp) {
+        return;
+    }
+    // check locks
+    yield checkDevAppLocks(ctx);
+    // set updated at time on app
+    yield updateAppUpdatedAt(ctx);
+});

package/dist/middleware/currentapp.js

@@ -8,24 +8,27 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-const backend_core_1 = require("@budibase/backend-core");
-const utils_1 = require("../db/utils");
-const global_1 = require("../utilities/global");
-const environment_1 = __importDefault(require("../environment"));
-const utils_2 = require("./utils");
+const { getAppIdFromCtx, setCookie, getCookie, clearCookie, } = require("@budibase/backend-core/utils");
+const { Cookies, Headers } = require("@budibase/backend-core/constants");
+const { getRole } = require("@budibase/backend-core/roles");
+const { BUILTIN_ROLE_IDS } = require("@budibase/backend-core/roles");
+const { generateUserMetadataID, isDevAppID } = require("../db/utils");
+const { dbExists } = require("@budibase/backend-core/db");
+const { isUserInAppTenant } = require("@budibase/backend-core/tenancy");
+const { getCachedSelf } = require("../utilities/global");
+const env = require("../environment");
+const { isWebhookEndpoint } = require("./utils");
+const { doInAppContext } = require("@budibase/backend-core/context");
 module.exports = (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
     // try to get the appID from the request
-    let requestAppId = yield backend_core_1.utils.getAppIdFromCtx(ctx);
+    let requestAppId = yield getAppIdFromCtx(ctx);
     // get app cookie if it exists
-    let appCookie;
+    let appCookie = null;
     try {
-        appCookie = backend_core_1.utils.getCookie(ctx, backend_core_1.constants.Cookie.CurrentApp);
+        appCookie = getCookie(ctx, Cookies.CurrentApp);
     }
     catch (err) {
-        backend_core_1.utils.clearCookie(ctx, backend_core_1.constants.Cookie.CurrentApp);
+        clearCookie(ctx, Cookies.CurrentApp);
     }
     if (!appCookie && !requestAppId) {
         return next();
@@ -33,49 +36,46 @@ module.exports = (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
     // check the app exists referenced in cookie
     if (appCookie) {
         const appId = appCookie.appId;
-        const exists = yield backend_core_1.db.dbExists(appId);
+        const exists = yield dbExists(appId);
         if (!exists) {
-            backend_core_1.utils.clearCookie(ctx, backend_core_1.constants.Cookie.CurrentApp);
+            clearCookie(ctx, Cookies.CurrentApp);
             return next();
         }
         // if the request app ID wasn't set, update it with the cookie
         requestAppId = requestAppId || appId;
     }
     // deny access to application preview
-    if (!environment_1.default.isTest()) {
-        if ((0, utils_1.isDevAppID)(requestAppId) &&
-            !(0, utils_2.isWebhookEndpoint)(ctx) &&
+    if (!env.isTest()) {
+        if (isDevAppID(requestAppId) &&
+            !isWebhookEndpoint(ctx) &&
             (!ctx.user || !ctx.user.builder || !ctx.user.builder.global)) {
-            backend_core_1.utils.clearCookie(ctx, backend_core_1.constants.Cookie.CurrentApp);
+            clearCookie(ctx, Cookies.CurrentApp);
             return ctx.redirect("/");
         }
     }
-    let appId, roleId = backend_core_1.roles.BUILTIN_ROLE_IDS.PUBLIC;
+    let appId, roleId = BUILTIN_ROLE_IDS.PUBLIC;
     if (!ctx.user) {
         // not logged in, try to set a cookie for public apps
         appId = requestAppId;
     }
     else if (requestAppId != null) {
         // Different App ID means cookie needs reset, or if the same public user has logged in
-        const globalUser = yield (0, global_1.getCachedSelf)(ctx, requestAppId);
+        const globalUser = yield getCachedSelf(ctx, requestAppId);
         appId = requestAppId;
         // retrieving global user gets the right role
         roleId = globalUser.roleId || roleId;
         // Allow builders to specify their role via a header
         const isBuilder = globalUser && globalUser.builder && globalUser.builder.global;
-        const isDevApp = appId && (0, utils_1.isDevAppID)(appId);
-        const roleHeader = ctx.request &&
-            ctx.request.headers[backend_core_1.constants.Header.PREVIEW_ROLE];
+        const isDevApp = appId && isDevAppID(appId);
+        const roleHeader = ctx.request && ctx.request.headers[Headers.PREVIEW_ROLE];
         if (isBuilder && isDevApp && roleHeader) {
             // Ensure the role is valid by ensuring a definition exists
             try {
-                if (roleHeader) {
-                    yield backend_core_1.roles.getRole(roleHeader);
-                    roleId = roleHeader;
-                    // Delete admin and builder flags so that the specified role is honoured
-                    delete ctx.user.builder;
-                    delete ctx.user.admin;
-                }
+                yield getRole(roleHeader);
+                roleId = roleHeader;
+                // Delete admin and builder flags so that the specified role is honoured
+                delete ctx.user.builder;
+                delete ctx.user.admin;
             }
             catch (error) {
                 // Swallow error and do nothing
@@ -86,40 +86,38 @@ module.exports = (ctx, next) => __awaiter(void 0, void 0, void 0, function* () {
     if (!appId) {
         return next();
     }
-    return backend_core_1.context.doInAppContext(appId, () => __awaiter(void 0, void 0, void 0, function* () {
+    return doInAppContext(appId, () => __awaiter(void 0, void 0, void 0, function* () {
         let skipCookie = false;
         // if the user not in the right tenant then make sure they have no permissions
         // need to judge this only based on the request app ID,
-        if (environment_1.default.MULTI_TENANCY &&
+        if (env.MULTI_TENANCY &&
             ctx.user &&
             requestAppId &&
-            !backend_core_1.tenancy.isUserInAppTenant(requestAppId, ctx.user)) {
+            !isUserInAppTenant(requestAppId, ctx.user)) {
             // don't error, simply remove the users rights (they are a public user)
             delete ctx.user.builder;
             delete ctx.user.admin;
             delete ctx.user.roles;
             ctx.isAuthenticated = false;
-            roleId = backend_core_1.roles.BUILTIN_ROLE_IDS.PUBLIC;
+            roleId = BUILTIN_ROLE_IDS.PUBLIC;
             skipCookie = true;
         }
         ctx.appId = appId;
         if (roleId) {
             ctx.roleId = roleId;
             const globalId = ctx.user ? ctx.user._id : undefined;
-            const userId = ctx.user
-                ? (0, utils_1.generateUserMetadataID)(ctx.user._id)
-                : undefined;
+            const userId = ctx.user ? generateUserMetadataID(ctx.user._id) : null;
             ctx.user = Object.assign(Object.assign({}, ctx.user), { 
                 // override userID with metadata one
                 _id: userId, userId,
                 globalId,
-                roleId, role: yield backend_core_1.roles.getRole(roleId) });
+                roleId, role: yield getRole(roleId) });
         }
         if ((requestAppId !== appId ||
             appCookie == null ||
             appCookie.appId !== requestAppId) &&
             !skipCookie) {
-            backend_core_1.utils.setCookie(ctx, { appId }, backend_core_1.constants.Cookie.CurrentApp);
+            setCookie(ctx, { appId }, Cookies.CurrentApp);
         }
         return next();
     }));