@budibase/server 2.1.43-alpha.6 → 2.1.44

package/src/utilities/security.js

@@ -0,0 +1,71 @@
+const {
+  PermissionLevels,
+  PermissionTypes,
+  getBuiltinPermissionByID,
+  isPermissionLevelHigherThanRead,
+} = require("@budibase/backend-core/permissions")
+const {
+  lowerBuiltinRoleID,
+  getBuiltinRoles,
+} = require("@budibase/backend-core/roles")
+const { DocumentType } = require("../db/utils")
+
+const CURRENTLY_SUPPORTED_LEVELS = [
+  PermissionLevels.WRITE,
+  PermissionLevels.READ,
+  PermissionLevels.EXECUTE,
+]
+
+exports.getPermissionType = resourceId => {
+  const docType = Object.values(DocumentType).filter(docType =>
+    resourceId.startsWith(docType)
+  )[0]
+  switch (docType) {
+    case DocumentType.TABLE:
+    case DocumentType.ROW:
+      return PermissionTypes.TABLE
+    case DocumentType.AUTOMATION:
+      return PermissionTypes.AUTOMATION
+    case DocumentType.WEBHOOK:
+      return PermissionTypes.WEBHOOK
+    case DocumentType.QUERY:
+    case DocumentType.DATASOURCE:
+      return PermissionTypes.QUERY
+    default:
+      // views don't have an ID, will end up here
+      return PermissionTypes.VIEW
+  }
+}
+
+/**
+ *  works out the basic permissions based on builtin roles for a resource, using its ID
+ * @param resourceId
+ * @returns {{}}
+ */
+exports.getBasePermissions = resourceId => {
+  const type = exports.getPermissionType(resourceId)
+  const permissions = {}
+  for (let [roleId, role] of Object.entries(getBuiltinRoles())) {
+    if (!role.permissionId) {
+      continue
+    }
+    const perms = getBuiltinPermissionByID(role.permissionId)
+    const typedPermission = perms.permissions.find(perm => perm.type === type)
+    if (
+      typedPermission &&
+      CURRENTLY_SUPPORTED_LEVELS.indexOf(typedPermission.level) !== -1
+    ) {
+      const level = typedPermission.level
+      permissions[level] = lowerBuiltinRoleID(permissions[level], roleId)
+      if (isPermissionLevelHigherThanRead(level)) {
+        permissions[PermissionLevels.READ] = lowerBuiltinRoleID(
+          permissions[PermissionLevels.READ],
+          roleId
+        )
+      }
+    }
+  }
+  return permissions
+}
+
+exports.CURRENTLY_SUPPORTED_LEVELS = CURRENTLY_SUPPORTED_LEVELS

package/src/utilities/{statusCodes.ts → statusCodes.js}

@@ -1,4 +1,4 @@
-export = {
+module.exports = {
   OK: 200,
   UNAUTHORIZED: 401,
   FORBIDDEN: 403,

package/src/utilities/usageQuota/{rows.ts → rows.js}

@@ -1,19 +1,23 @@
-import { getRowParams, USER_METDATA_PREFIX } from "../../db/utils"
-import { db as dbCore } from "@budibase/backend-core"
-import { Database, Row } from "@budibase/types"
+const { getRowParams, USER_METDATA_PREFIX } = require("../../db/utils")
+const {
+  isDevAppID,
+  getDevelopmentAppID,
+  getProdAppID,
+  doWithDB,
+} = require("@budibase/backend-core/db")
 
 const ROW_EXCLUSIONS = [USER_METDATA_PREFIX]
 
-function getAppPairs(appIds: string[]) {
+const getAppPairs = appIds => {
   // collect the app ids into dev / prod pairs
   // keyed by the dev app id
-  const pairs: { [key: string]: { devId?: string; prodId?: string } } = {}
+  const pairs = {}
   for (let appId of appIds) {
-    const devId = dbCore.getDevelopmentAppID(appId)
+    const devId = getDevelopmentAppID(appId)
     if (!pairs[devId]) {
       pairs[devId] = {}
     }
-    if (dbCore.isDevAppID(appId)) {
+    if (isDevAppID(appId)) {
       pairs[devId].devId = appId
     } else {
       pairs[devId].prodId = appId
@@ -22,9 +26,9 @@ function getAppPairs(appIds: string[]) {
   return pairs
 }
 
-async function getAppRows(appId: string) {
+const getAppRows = async appId => {
   // need to specify the app ID, as this is used for different apps in one call
-  return dbCore.doWithDB(appId, async (db: Database) => {
+  return doWithDB(appId, async db => {
     const response = await db.allDocs(
       getRowParams(null, null, {
         include_docs: false,
@@ -48,13 +52,13 @@ async function getAppRows(appId: string) {
  * The returned rows will be unique on a per dev/prod app basis.
  * Rows duplicates may exist across apps due to data import so they are not filtered out.
  */
-export async function getUniqueRows(appIds: string[]) {
-  let uniqueRows: Row[] = [],
-    rowsByApp: { [key: string]: Row[] } = {}
+exports.getUniqueRows = async appIds => {
+  let uniqueRows = [],
+    rowsByApp = {}
   const pairs = getAppPairs(appIds)
 
   for (let pair of Object.values(pairs)) {
-    let appRows: Row[] = []
+    let appRows = []
     for (let appId of [pair.devId, pair.prodId]) {
       if (!appId) {
         continue
@@ -71,7 +75,7 @@ export async function getUniqueRows(appIds: string[]) {
     // this can't be done on all rows because app import results in
     // duplicate row ids across apps
     // the array pre-concat is important to avoid stack overflow
-    const prodId = dbCore.getProdAppID((pair.devId || pair.prodId)!)
+    const prodId = getProdAppID(pair.devId || pair.prodId)
     rowsByApp[prodId] = [...new Set(appRows)]
     uniqueRows = uniqueRows.concat(rowsByApp[prodId])
   }

package/src/utilities/usageQuota/{usageQuoteReset.ts → usageQuoteReset.js}

@@ -7,7 +7,7 @@ function getNewQuotaReset() {
   return Date.now() + 2592000000
 }
 
-function resetQuotasIfRequired(quota: { quotaReset: number; usageQuota: any }) {
+function resetQuotasIfRequired(quota) {
   // Check if the quota needs reset
   if (Date.now() >= quota.quotaReset) {
     quota.quotaReset = getNewQuotaReset()

package/src/utilities/{users.ts → users.js}

@@ -1,11 +1,12 @@
-import { InternalTables } from "../db/utils"
-import { getGlobalUser } from "./global"
-import { context, db as dbCore, roles } from "@budibase/backend-core"
-import { BBContext } from "@budibase/types"
+const { InternalTables } = require("../db/utils")
+const { getGlobalUser } = require("../utilities/global")
+const { getAppDB } = require("@budibase/backend-core/context")
+const { getProdAppID } = require("@budibase/backend-core/db")
+const { BUILTIN_ROLE_IDS } = require("@budibase/backend-core/roles")
 
-export async function getFullUser(ctx: BBContext, userId: string) {
+exports.getFullUser = async (ctx, userId) => {
   const global = await getGlobalUser(userId)
-  let metadata: any = {}
+  let metadata = {}
 
   // always prefer the user metadata _id and _rev
   delete global._id
@@ -13,7 +14,7 @@ export async function getFullUser(ctx: BBContext, userId: string) {
 
   try {
     // this will throw an error if the db doesn't exist, or there is no appId
-    const db = context.getAppDB()
+    const db = getAppDB()
     metadata = await db.get(userId)
   } catch (err) {
     // it is fine if there is no user metadata yet
@@ -22,14 +23,14 @@ export async function getFullUser(ctx: BBContext, userId: string) {
   return {
     ...metadata,
     ...global,
-    roleId: global.roleId || roles.BUILTIN_ROLE_IDS.PUBLIC,
+    roleId: global.roleId || BUILTIN_ROLE_IDS.PUBLIC,
     tableId: InternalTables.USER_METADATA,
     // make sure the ID is always a local ID, not a global one
     _id: userId,
   }
 }
 
-export function publicApiUserFix(ctx: BBContext) {
+exports.publicApiUserFix = ctx => {
   if (!ctx.request.body) {
     return ctx
   }
@@ -39,9 +40,10 @@ export function publicApiUserFix(ctx: BBContext) {
   if (!ctx.request.body.roles) {
     ctx.request.body.roles = {}
   } else {
-    const newRoles: { [key: string]: any } = {}
+    const newRoles = {}
     for (let [appId, role] of Object.entries(ctx.request.body.roles)) {
-      newRoles[dbCore.getProdAppID(appId)] = role
+      // @ts-ignore
+      newRoles[getProdAppID(appId)] = role
     }
     ctx.request.body.roles = newRoles
   }

package/src/utilities/{workerRequests.ts → workerRequests.js}

@@ -1,18 +1,19 @@
-import fetch from "node-fetch"
-import env from "../environment"
-import { checkSlashesInUrl } from "./index"
-import { db as dbCore, constants, tenancy } from "@budibase/backend-core"
-import { updateAppRole } from "./global"
-import { BBContext, Automation } from "@budibase/types"
+const fetch = require("node-fetch")
+const env = require("../environment")
+const { checkSlashesInUrl } = require("./index")
+const { getProdAppID } = require("@budibase/backend-core/db")
+const { updateAppRole } = require("./global")
+const { Headers } = require("@budibase/backend-core/constants")
+const { getTenantId, isTenantIdSet } = require("@budibase/backend-core/tenancy")
 
-export function request(ctx?: BBContext, request?: any) {
+function request(ctx, request) {
   if (!request.headers) {
     request.headers = {}
   }
   if (!ctx) {
-    request.headers[constants.Header.API_KEY] = env.INTERNAL_API_KEY
-    if (tenancy.isTenantIdSet()) {
-      request.headers[constants.Header.TENANT_ID] = tenancy.getTenantId()
+    request.headers[Headers.API_KEY] = env.INTERNAL_API_KEY
+    if (isTenantIdSet()) {
+      request.headers[Headers.TENANT_ID] = getTenantId()
     }
   }
   if (request.body && Object.keys(request.body).length > 0) {
@@ -30,11 +31,7 @@ export function request(ctx?: BBContext, request?: any) {
   return request
 }
 
-async function checkResponse(
-  response: any,
-  errorMsg: string,
-  { ctx }: { ctx?: BBContext } = {}
-) {
+async function checkResponse(response, errorMsg, { ctx } = {}) {
   if (response.status !== 200) {
     let error
     try {
@@ -54,20 +51,22 @@ async function checkResponse(
   return response.json()
 }
 
+exports.request = request
+
 // have to pass in the tenant ID as this could be coming from an automation
-export async function sendSmtpEmail(
-  to: string,
-  from: string,
-  subject: string,
-  contents: string,
-  cc: string,
-  bcc: string,
-  automation: boolean
-) {
+exports.sendSmtpEmail = async (
+  to,
+  from,
+  subject,
+  contents,
+  cc,
+  bcc,
+  automation
+) => {
   // tenant ID will be set in header
   const response = await fetch(
     checkSlashesInUrl(env.WORKER_URL + `/api/global/email/send`),
-    request(undefined, {
+    request(null, {
       method: "POST",
       body: {
         email: to,
@@ -84,7 +83,7 @@ export async function sendSmtpEmail(
   return checkResponse(response, "send email")
 }
 
-export async function getGlobalSelf(ctx: BBContext, appId?: string) {
+exports.getGlobalSelf = async (ctx, appId = null) => {
   const endpoint = `/api/global/self`
   const response = await fetch(
     checkSlashesInUrl(env.WORKER_URL + endpoint),
@@ -98,8 +97,8 @@ export async function getGlobalSelf(ctx: BBContext, appId?: string) {
   return json
 }
 
-export async function removeAppFromUserRoles(ctx: BBContext, appId: string) {
-  const prodAppId = dbCore.getProdAppID(appId)
+exports.removeAppFromUserRoles = async (ctx, appId) => {
+  const prodAppId = getProdAppID(appId)
   const response = await fetch(
     checkSlashesInUrl(env.WORKER_URL + `/api/global/roles/${prodAppId}`),
     request(ctx, {
@@ -109,7 +108,7 @@ export async function removeAppFromUserRoles(ctx: BBContext, appId: string) {
   return checkResponse(response, "remove app role")
 }
 
-export async function allGlobalUsers(ctx: BBContext) {
+exports.allGlobalUsers = async ctx => {
   const response = await fetch(
     checkSlashesInUrl(env.WORKER_URL + "/api/global/users"),
     // we don't want to use API key when getting self
@@ -118,7 +117,7 @@ export async function allGlobalUsers(ctx: BBContext) {
   return checkResponse(response, "get users", { ctx })
 }
 
-export async function saveGlobalUser(ctx: BBContext) {
+exports.saveGlobalUser = async ctx => {
   const response = await fetch(
     checkSlashesInUrl(env.WORKER_URL + "/api/global/users"),
     // we don't want to use API key when getting self
@@ -127,7 +126,7 @@ export async function saveGlobalUser(ctx: BBContext) {
   return checkResponse(response, "save user", { ctx })
 }
 
-export async function deleteGlobalUser(ctx: BBContext) {
+exports.deleteGlobalUser = async ctx => {
   const response = await fetch(
     checkSlashesInUrl(
       env.WORKER_URL + `/api/global/users/${ctx.params.userId}`
@@ -135,10 +134,10 @@ export async function deleteGlobalUser(ctx: BBContext) {
     // we don't want to use API key when getting self
     request(ctx, { method: "DELETE" })
   )
-  return checkResponse(response, "delete user", { ctx })
+  return checkResponse(response, "delete user", { ctx, body: ctx.request.body })
 }
 
-export async function readGlobalUser(ctx: BBContext) {
+exports.readGlobalUser = async ctx => {
   const response = await fetch(
     checkSlashesInUrl(
       env.WORKER_URL + `/api/global/users/${ctx.params.userId}`
@@ -149,30 +148,26 @@ export async function readGlobalUser(ctx: BBContext) {
   return checkResponse(response, "get user", { ctx })
 }
 
-export async function createAdminUser(
-  email: string,
-  password: string,
-  tenantId: string
-) {
+exports.createAdminUser = async (email, password, tenantId) => {
   const response = await fetch(
     checkSlashesInUrl(env.WORKER_URL + "/api/global/users/init"),
-    request(undefined, { method: "POST", body: { email, password, tenantId } })
+    request(null, { method: "POST", body: { email, password, tenantId } })
   )
   return checkResponse(response, "create admin user")
 }
 
-export async function getChecklist() {
+exports.getChecklist = async () => {
   const response = await fetch(
     checkSlashesInUrl(env.WORKER_URL + "/api/global/configs/checklist"),
-    request(undefined, { method: "GET" })
+    request(null, { method: "GET" })
   )
   return checkResponse(response, "get checklist")
 }
 
-export async function generateApiKey(userId: string) {
+exports.generateApiKey = async userId => {
   const response = await fetch(
     checkSlashesInUrl(env.WORKER_URL + "/api/global/self/api_key"),
-    request(undefined, { method: "POST", body: { userId } })
+    request(null, { method: "POST", body: { userId } })
   )
   return checkResponse(response, "generate API key")
 }

package/src/watch.ts

@@ -2,7 +2,8 @@ import path from "path"
 import * as env from "./environment"
 import chokidar from "chokidar"
 import fs from "fs"
-import { constants, tenancy } from "@budibase/backend-core"
+import { tenancy } from "@budibase/backend-core"
+import { DEFAULT_TENANT_ID } from "@budibase/backend-core/constants"
 import { processUploadedPlugin } from "./api/controllers/plugin"
 
 export function watch() {
@@ -22,7 +23,7 @@ export function watch() {
       if (!path?.endsWith(".tar.gz") || !fs.existsSync(path)) {
         return
       }
-      await tenancy.doInTenant(constants.DEFAULT_TENANT_ID, async () => {
+      await tenancy.doInTenant(DEFAULT_TENANT_ID, async () => {
         try {
           const split = path.split("/")
           const name = split[split.length - 1]

package/tsconfig.build.json

@@ -3,6 +3,7 @@
     "target": "es6",
     "module": "commonjs",
     "lib": ["es2020"],
+    "allowJs": true,
     "strict": true,
     "noImplicitAny": true,
     "esModuleInterop": true,
@@ -22,4 +23,4 @@
     "**/*.spec.ts",
     "**/*.spec.js"
   ]
-}
+}

package/tsconfig.json

@@ -8,8 +8,7 @@
     "paths": {
       "@budibase/types": ["../types/src"],
       "@budibase/backend-core": ["../backend-core/src"],
-      "@budibase/backend-core/*": ["../backend-core/*"],
-      "@budibase/pro": ["../../../budibase-pro/packages/pro/src"]
+      "@budibase/backend-core/*": ["../backend-core/*"]
     }
   },
   "ts-node": {
@@ -18,7 +17,6 @@
   "references": [
     { "path": "../types" },
     { "path": "../backend-core" },
-    { "path": "../../../budibase-pro/packages/pro" }
   ],
   "include": [
     "src/**/*",