@budibase/server 2.1.43-alpha.10 → 2.1.43-alpha.11

package/dist/api/controllers/public/users.js

@@ -12,7 +12,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.destroy = exports.update = exports.read = exports.create = exports.search = void 0;
 const workerRequests_1 = require("../../../utilities/workerRequests");
 const users_1 = require("../../../utilities/users");
+const backend_core_1 = require("@budibase/backend-core");
 const utils_1 = require("./utils");
+function isLoggedInUser(ctx, user) {
+    var _a;
+    const loggedInId = (_a = ctx.user) === null || _a === void 0 ? void 0 : _a._id;
+    const globalUserId = backend_core_1.db.getGlobalIDFromUserMetadataID(loggedInId);
+    // check both just incase
+    return globalUserId === user._id || loggedInId === user._id;
+}
 function getUser(ctx, userId) {
     var _a;
     if (userId) {
@@ -51,6 +59,10 @@ function update(ctx, next) {
     return __awaiter(this, void 0, void 0, function* () {
         const user = yield (0, workerRequests_1.readGlobalUser)(ctx);
         ctx.request.body = Object.assign(Object.assign({}, ctx.request.body), { _rev: user._rev });
+        // disallow updating your own role - always overwrite with DB roles
+        if (isLoggedInUser(ctx, user)) {
+            ctx.request.body.roles = user.roles;
+        }
         const response = yield (0, workerRequests_1.saveGlobalUser)((0, users_1.publicApiUserFix)(ctx));
         ctx.body = yield getUser(ctx, response._id);
         yield next();
@@ -60,6 +72,10 @@ exports.update = update;
 function destroy(ctx, next) {
     return __awaiter(this, void 0, void 0, function* () {
         const user = yield getUser(ctx);
+        // disallow deleting yourself
+        if (isLoggedInUser(ctx, user)) {
+            ctx.throw(405, "Cannot delete user using its own API key.");
+        }
         yield (0, workerRequests_1.deleteGlobalUser)(ctx);
         ctx.body = user;
         yield next();

package/dist/api/routes/public/tests/utils.js

@@ -0,0 +1,33 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateMakeRequest = void 0;
+const utilities_1 = require("../../../../utilities");
+function generateMakeRequest(apiKey, setup) {
+    const request = setup.getRequest();
+    const config = setup.getConfig();
+    return (method, endpoint, body, intAppId = config.getAppId()) => __awaiter(this, void 0, void 0, function* () {
+        const extraHeaders = {
+            "x-budibase-api-key": apiKey,
+        };
+        if (intAppId) {
+            extraHeaders["x-budibase-app-id"] = intAppId;
+        }
+        const req = request[method]((0, utilities_1.checkSlashesInUrl)(`/api/public/v1/${endpoint}`)).set(config.defaultHeaders(extraHeaders));
+        if (body) {
+            req.send(body);
+        }
+        const res = yield req;
+        expect(res.body).toBeDefined();
+        return res;
+    });
+}
+exports.generateMakeRequest = generateMakeRequest;

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@budibase/server",
     "email": "hi@budibase.com",
-    "version": "2.1.43-alpha.9",
+    "version": "2.1.43-alpha.10",
     "description": "Budibase Web Server",
     "main": "src/index.ts",
     "repository": {
@@ -43,11 +43,11 @@
     "license": "GPL-3.0",
     "dependencies": {
         "@apidevtools/swagger-parser": "10.0.3",
-        "@budibase/backend-core": "2.1.43-alpha.9",
-        "@budibase/client": "2.1.43-alpha.9",
-        "@budibase/pro": "2.1.43-alpha.9",
-        "@budibase/string-templates": "2.1.43-alpha.9",
-        "@budibase/types": "2.1.43-alpha.9",
+        "@budibase/backend-core": "2.1.43-alpha.10",
+        "@budibase/client": "2.1.43-alpha.10",
+        "@budibase/pro": "2.1.43-alpha.10",
+        "@budibase/string-templates": "2.1.43-alpha.10",
+        "@budibase/types": "2.1.43-alpha.10",
         "@bull-board/api": "3.7.0",
         "@bull-board/koa": "3.9.4",
         "@elastic/elasticsearch": "7.10.0",