@budibase/server 2.1.44 → 2.1.46-alpha.0

package/dist/api/controllers/plugin/utils.js

@@ -11,11 +11,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.downloadUnzipTarball = void 0;
 const fileSystem_1 = require("../../../utilities/fileSystem");
+const backend_core_1 = require("@budibase/backend-core");
 function downloadUnzipTarball(url, name, headers = {}) {
     return __awaiter(this, void 0, void 0, function* () {
         try {
             const path = (0, fileSystem_1.createTempFolder)(name);
-            yield (0, fileSystem_1.downloadTarballDirect)(url, path, headers);
+            yield backend_core_1.objectStore.downloadTarballDirect(url, path, headers);
             return path;
         }
         catch (e) {

package/dist/api/controllers/public/applications.js

@@ -33,8 +33,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.destroy = exports.update = exports.read = exports.create = exports.search = void 0;
-const { getAllApps } = require("@budibase/backend-core/db");
-const { doInAppContext } = require("@budibase/backend-core/context");
+const backend_core_1 = require("@budibase/backend-core");
 const utils_1 = require("./utils");
 const controller = __importStar(require("../application"));
 function fixAppID(app, params) {
@@ -47,17 +46,26 @@ function fixAppID(app, params) {
     return app;
 }
 function setResponseApp(ctx) {
+    var _a;
     return __awaiter(this, void 0, void 0, function* () {
-        if (ctx.body && ctx.body.appId && (!ctx.params || !ctx.params.appId)) {
-            ctx.params = { appId: ctx.body.appId };
+        const appId = (_a = ctx.body) === null || _a === void 0 ? void 0 : _a.appId;
+        if (appId && (!ctx.params || !ctx.params.appId)) {
+            ctx.params = { appId };
+        }
+        if (appId) {
+            yield backend_core_1.context.doInContext(appId, () => {
+                return controller.fetchAppPackage(ctx);
+            });
+        }
+        else {
+            return controller.fetchAppPackage(ctx);
         }
-        yield controller.fetchAppPackage(ctx);
     });
 }
 function search(ctx, next) {
     return __awaiter(this, void 0, void 0, function* () {
         const { name } = ctx.request.body;
-        const apps = yield getAllApps({ all: true });
+        const apps = yield backend_core_1.db.getAllApps({ all: true });
         ctx.body = (0, utils_1.search)(apps, name);
         yield next();
     });
@@ -76,7 +84,7 @@ function create(ctx, next) {
 exports.create = create;
 function read(ctx, next) {
     return __awaiter(this, void 0, void 0, function* () {
-        yield doInAppContext(ctx.params.appId, () => __awaiter(this, void 0, void 0, function* () {
+        yield backend_core_1.context.doInAppContext(ctx.params.appId, () => __awaiter(this, void 0, void 0, function* () {
             yield setResponseApp(ctx);
             yield next();
         }));
@@ -86,7 +94,7 @@ exports.read = read;
 function update(ctx, next) {
     return __awaiter(this, void 0, void 0, function* () {
         ctx.request.body = yield (0, utils_1.addRev)(fixAppID(ctx.request.body, ctx.params));
-        yield doInAppContext(ctx.params.appId, () => __awaiter(this, void 0, void 0, function* () {
+        yield backend_core_1.context.doInAppContext(ctx.params.appId, () => __awaiter(this, void 0, void 0, function* () {
             yield controller.update(ctx);
             yield setResponseApp(ctx);
             yield next();
@@ -96,7 +104,7 @@ function update(ctx, next) {
 exports.update = update;
 function destroy(ctx, next) {
     return __awaiter(this, void 0, void 0, function* () {
-        yield doInAppContext(ctx.params.appId, () => __awaiter(this, void 0, void 0, function* () {
+        yield backend_core_1.context.doInAppContext(ctx.params.appId, () => __awaiter(this, void 0, void 0, function* () {
             // get the app before deleting it
             yield setResponseApp(ctx);
             const body = ctx.body;

package/dist/api/controllers/public/tables.js

@@ -1,4 +1,27 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -8,13 +31,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.destroy = exports.update = exports.read = exports.create = exports.search = void 0;
 const utils_1 = require("./utils");
-const table_1 = __importDefault(require("../table"));
+const controller = __importStar(require("../table"));
 function fixTable(table, params) {
     if (!params || !table) {
         return table;
@@ -30,7 +50,7 @@ function fixTable(table, params) {
 function search(ctx, next) {
     return __awaiter(this, void 0, void 0, function* () {
         const { name } = ctx.request.body;
-        yield table_1.default.fetch(ctx);
+        yield controller.fetch(ctx);
         ctx.body = (0, utils_1.search)(ctx.body, name);
         yield next();
     });
@@ -38,14 +58,14 @@ function search(ctx, next) {
 exports.search = search;
 function create(ctx, next) {
     return __awaiter(this, void 0, void 0, function* () {
-        yield table_1.default.save(ctx);
+        yield controller.save(ctx);
         yield next();
     });
 }
 exports.create = create;
 function read(ctx, next) {
     return __awaiter(this, void 0, void 0, function* () {
-        yield table_1.default.find(ctx);
+        yield controller.find(ctx);
         yield next();
     });
 }
@@ -53,14 +73,14 @@ exports.read = read;
 function update(ctx, next) {
     return __awaiter(this, void 0, void 0, function* () {
         ctx.request.body = yield (0, utils_1.addRev)(fixTable(ctx.request.body, ctx.params), ctx.params.tableId);
-        yield table_1.default.save(ctx);
+        yield controller.save(ctx);
         yield next();
     });
 }
 exports.update = update;
 function destroy(ctx, next) {
     return __awaiter(this, void 0, void 0, function* () {
-        yield table_1.default.destroy(ctx);
+        yield controller.destroy(ctx);
         ctx.body = ctx.table;
         yield next();
     });

package/dist/api/controllers/public/users.js

@@ -12,7 +12,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.destroy = exports.update = exports.read = exports.create = exports.search = void 0;
 const workerRequests_1 = require("../../../utilities/workerRequests");
 const users_1 = require("../../../utilities/users");
+const backend_core_1 = require("@budibase/backend-core");
 const utils_1 = require("./utils");
+function isLoggedInUser(ctx, user) {
+    var _a;
+    const loggedInId = (_a = ctx.user) === null || _a === void 0 ? void 0 : _a._id;
+    const globalUserId = backend_core_1.db.getGlobalIDFromUserMetadataID(loggedInId);
+    // check both just incase
+    return globalUserId === user._id || loggedInId === user._id;
+}
 function getUser(ctx, userId) {
     var _a;
     if (userId) {
@@ -51,6 +59,12 @@ function update(ctx, next) {
     return __awaiter(this, void 0, void 0, function* () {
         const user = yield (0, workerRequests_1.readGlobalUser)(ctx);
         ctx.request.body = Object.assign(Object.assign({}, ctx.request.body), { _rev: user._rev });
+        // disallow updating your own role - always overwrite with DB roles
+        if (isLoggedInUser(ctx, user)) {
+            ctx.request.body.builder = user.builder;
+            ctx.request.body.admin = user.admin;
+            ctx.request.body.roles = user.roles;
+        }
         const response = yield (0, workerRequests_1.saveGlobalUser)((0, users_1.publicApiUserFix)(ctx));
         ctx.body = yield getUser(ctx, response._id);
         yield next();
@@ -60,6 +74,10 @@ exports.update = update;
 function destroy(ctx, next) {
     return __awaiter(this, void 0, void 0, function* () {
         const user = yield getUser(ctx);
+        // disallow deleting yourself
+        if (isLoggedInUser(ctx, user)) {
+            ctx.throw(405, "Cannot delete user using its own API key.");
+        }
         yield (0, workerRequests_1.deleteGlobalUser)(ctx);
         ctx.body = user;
         yield next();

package/dist/api/controllers/public/utils.js

@@ -10,7 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.search = exports.addRev = void 0;
-const { getAppDB } = require("@budibase/backend-core/context");
+const backend_core_1 = require("@budibase/backend-core");
 const utils_1 = require("../../../integrations/utils");
 const utils_2 = require("../../../db/utils");
 function addRev(body, tableId) {
@@ -22,7 +22,7 @@ function addRev(body, tableId) {
         if (body._id.startsWith(utils_2.APP_PREFIX)) {
             id = utils_2.DocumentType.APP_METADATA;
         }
-        const db = getAppDB();
+        const db = backend_core_1.context.getAppDB();
         const dbDoc = yield db.get(id);
         body._rev = dbDoc._rev;
         // update ID in case it is an app ID

package/dist/api/controllers/query/import/index.js

@@ -16,7 +16,6 @@ const openapi2_1 = require("./sources/openapi2");
 const openapi3_1 = require("./sources/openapi3");
 const curl_1 = require("./sources/curl");
 // @ts-ignore
-const context_1 = require("@budibase/backend-core/context");
 const backend_core_1 = require("@budibase/backend-core");
 class RestImporter {
     constructor(data) {
@@ -51,7 +50,7 @@ class RestImporter {
                 return query;
             });
             // persist queries
-            const db = (0, context_1.getAppDB)();
+            const db = backend_core_1.context.getAppDB();
             const response = yield db.bulkDocs(queries);
             // create index to seperate queries and errors
             const queryIndex = queries.reduce((acc, query) => {

package/dist/api/controllers/query/index.js

@@ -17,11 +17,8 @@ const datasource_1 = require("../datasource");
 const import_1 = require("./import");
 const utils_2 = require("../../../threads/utils");
 const environment_1 = require("../../../environment");
-const context_1 = require("@budibase/backend-core/context");
 const pro_1 = require("@budibase/pro");
 const backend_core_1 = require("@budibase/backend-core");
-const utils_3 = require("@budibase/backend-core/utils");
-const constants_2 = require("@budibase/backend-core/constants");
 const Runner = new threads_1.Thread(threads_1.ThreadType.QUERY, {
     timeoutMs: environment_1.QUERY_THREAD_TIMEOUT || 10000,
 });
@@ -38,7 +35,7 @@ function enrichQueries(input) {
 }
 function fetch(ctx) {
     return __awaiter(this, void 0, void 0, function* () {
-        const db = (0, context_1.getAppDB)();
+        const db = backend_core_1.context.getAppDB();
         const body = yield db.allDocs((0, utils_1.getQueryParams)(null, {
             include_docs: true,
         }));
@@ -82,7 +79,7 @@ const _import = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
 exports.import = _import;
 function save(ctx) {
     return __awaiter(this, void 0, void 0, function* () {
-        const db = (0, context_1.getAppDB)();
+        const db = backend_core_1.context.getAppDB();
         const query = ctx.request.body;
         const datasource = yield db.get(query.datasourceId);
         let eventFn;
@@ -103,7 +100,7 @@ function save(ctx) {
 exports.save = save;
 function find(ctx) {
     return __awaiter(this, void 0, void 0, function* () {
-        const db = (0, context_1.getAppDB)();
+        const db = backend_core_1.context.getAppDB();
         const query = enrichQueries(yield db.get(ctx.params.queryId));
         // remove properties that could be dangerous in real app
         if ((0, utils_1.isProdAppID)(ctx.appId)) {
@@ -116,12 +113,12 @@ function find(ctx) {
 exports.find = find;
 //Required to discern between OIDC OAuth config entries
 function getOAuthConfigCookieId(ctx) {
-    if (ctx.user.providerType === constants_2.Configs.OIDC) {
-        return (0, utils_3.getCookie)(ctx, constants_2.Cookies.OIDC_CONFIG);
+    if (ctx.user.providerType === backend_core_1.constants.Config.OIDC) {
+        return backend_core_1.utils.getCookie(ctx, backend_core_1.constants.Cookie.OIDC_CONFIG);
     }
 }
 function getAuthConfig(ctx) {
-    const authCookie = (0, utils_3.getCookie)(ctx, constants_2.Cookies.Auth);
+    const authCookie = backend_core_1.utils.getCookie(ctx, backend_core_1.constants.Cookie.Auth);
     let authConfigCtx = {};
     authConfigCtx["configId"] = getOAuthConfigCookieId(ctx);
     authConfigCtx["sessionId"] = authCookie ? authCookie.sessionId : null;
@@ -129,7 +126,7 @@ function getAuthConfig(ctx) {
 }
 function preview(ctx) {
     return __awaiter(this, void 0, void 0, function* () {
-        const db = (0, context_1.getAppDB)();
+        const db = backend_core_1.context.getAppDB();
         const datasource = yield db.get(ctx.request.body.datasourceId);
         const query = ctx.request.body;
         // preview may not have a queryId as it hasn't been saved, but if it does
@@ -197,7 +194,7 @@ function preview(ctx) {
 exports.preview = preview;
 function execute(ctx, opts = { rowsOnly: false, isAutomation: false }) {
     return __awaiter(this, void 0, void 0, function* () {
-        const db = (0, context_1.getAppDB)();
+        const db = backend_core_1.context.getAppDB();
         const query = yield db.get(ctx.params.queryId);
         const datasource = yield db.get(query.datasourceId);
         let authConfigCtx = {};
@@ -261,7 +258,7 @@ function executeV2(ctx, { isAutomation } = {}) {
 }
 exports.executeV2 = executeV2;
 const removeDynamicVariables = (queryId) => __awaiter(void 0, void 0, void 0, function* () {
-    const db = (0, context_1.getAppDB)();
+    const db = backend_core_1.context.getAppDB();
     const query = yield db.get(queryId);
     const datasource = yield db.get(query.datasourceId);
     const dynamicVariables = datasource.config.dynamicVariables;
@@ -276,7 +273,7 @@ const removeDynamicVariables = (queryId) => __awaiter(void 0, void 0, void 0, fu
 });
 function destroy(ctx) {
     return __awaiter(this, void 0, void 0, function* () {
-        const db = (0, context_1.getAppDB)();
+        const db = backend_core_1.context.getAppDB();
         const queryId = ctx.params.queryId;
         yield removeDynamicVariables(queryId);
         const query = yield db.get(queryId);

package/dist/api/controllers/query/validation.js

@@ -1,45 +1,53 @@
 "use strict";
-const { joiValidator } = require("@budibase/backend-core/auth");
-const Joi = require("joi");
-const OPTIONAL_STRING = Joi.string().optional().allow(null).allow("");
-exports.queryValidation = () => {
-    return Joi.object({
-        _id: Joi.string(),
-        _rev: Joi.string(),
-        name: Joi.string().required(),
-        fields: Joi.object().required(),
-        datasourceId: Joi.string().required(),
-        readable: Joi.boolean(),
-        parameters: Joi.array().items(Joi.object({
-            name: Joi.string(),
-            default: Joi.string().allow(""),
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateQueryPreviewValidation = exports.generateQueryValidation = exports.queryValidation = void 0;
+const backend_core_1 = require("@budibase/backend-core");
+const joi_1 = __importDefault(require("joi"));
+const OPTIONAL_STRING = joi_1.default.string().optional().allow(null).allow("");
+function queryValidation() {
+    return joi_1.default.object({
+        _id: joi_1.default.string(),
+        _rev: joi_1.default.string(),
+        name: joi_1.default.string().required(),
+        fields: joi_1.default.object().required(),
+        datasourceId: joi_1.default.string().required(),
+        readable: joi_1.default.boolean(),
+        parameters: joi_1.default.array().items(joi_1.default.object({
+            name: joi_1.default.string(),
+            default: joi_1.default.string().allow(""),
         })),
-        queryVerb: Joi.string().allow().required(),
-        extra: Joi.object().optional(),
-        schema: Joi.object({}).required().unknown(true),
+        queryVerb: joi_1.default.string().allow().required(),
+        extra: joi_1.default.object().optional(),
+        schema: joi_1.default.object({}).required().unknown(true),
         transformer: OPTIONAL_STRING,
-        flags: Joi.object().optional(),
+        flags: joi_1.default.object().optional(),
     }).unknown(true);
-};
-exports.generateQueryValidation = () => {
+}
+exports.queryValidation = queryValidation;
+function generateQueryValidation() {
     // prettier-ignore
-    return joiValidator.body(exports.queryValidation());
-};
-exports.generateQueryPreviewValidation = () => {
+    return backend_core_1.auth.joiValidator.body(queryValidation());
+}
+exports.generateQueryValidation = generateQueryValidation;
+function generateQueryPreviewValidation() {
     // prettier-ignore
-    return joiValidator.body(Joi.object({
+    return backend_core_1.auth.joiValidator.body(joi_1.default.object({
         _id: OPTIONAL_STRING,
         _rev: OPTIONAL_STRING,
-        readable: Joi.boolean().optional(),
-        fields: Joi.object().required(),
-        queryVerb: Joi.string().required(),
+        readable: joi_1.default.boolean().optional(),
+        fields: joi_1.default.object().required(),
+        queryVerb: joi_1.default.string().required(),
         name: OPTIONAL_STRING,
-        flags: Joi.object().optional(),
-        schema: Joi.object().optional(),
-        extra: Joi.object().optional(),
-        datasourceId: Joi.string().required(),
+        flags: joi_1.default.object().optional(),
+        schema: joi_1.default.object().optional(),
+        extra: joi_1.default.object().optional(),
+        datasourceId: joi_1.default.string().required(),
         transformer: OPTIONAL_STRING,
-        parameters: Joi.object({}).required().unknown(true),
+        parameters: joi_1.default.object({}).required().unknown(true),
         queryId: OPTIONAL_STRING,
     }).unknown(true));
-};
+}
+exports.generateQueryPreviewValidation = generateQueryPreviewValidation;

package/dist/api/controllers/role.js

@@ -8,17 +8,17 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-const { Role, getRole, isBuiltin, getAllRoles, } = require("@budibase/backend-core/roles");
-const { generateRoleID, getUserMetadataParams, InternalTables, } = require("../../db/utils");
-const { getAppDB } = require("@budibase/backend-core/context");
-const { events } = require("@budibase/backend-core");
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.destroy = exports.save = exports.find = exports.fetch = void 0;
+const backend_core_1 = require("@budibase/backend-core");
+const utils_1 = require("../../db/utils");
 const UpdateRolesOptions = {
     CREATED: "created",
     REMOVED: "removed",
 };
 function updateRolesOnUserTable(db, roleId, updateOption) {
     return __awaiter(this, void 0, void 0, function* () {
-        const table = yield db.get(InternalTables.USER_METADATA);
+        const table = yield db.get(utils_1.InternalTables.USER_METADATA);
         const schema = table.schema;
         const remove = updateOption === UpdateRolesOptions.REMOVED;
         let updated = false;
@@ -41,57 +41,58 @@ function updateRolesOnUserTable(db, roleId, updateOption) {
         }
     });
 }
-exports.fetch = function (ctx) {
+function fetch(ctx) {
     return __awaiter(this, void 0, void 0, function* () {
-        ctx.body = yield getAllRoles();
+        ctx.body = yield backend_core_1.roles.getAllRoles();
     });
-};
-exports.find = function (ctx) {
+}
+exports.fetch = fetch;
+function find(ctx) {
     return __awaiter(this, void 0, void 0, function* () {
-        ctx.body = yield getRole(ctx.params.roleId);
+        ctx.body = yield backend_core_1.roles.getRole(ctx.params.roleId);
     });
-};
-exports.save = function (ctx) {
+}
+exports.find = find;
+function save(ctx) {
     return __awaiter(this, void 0, void 0, function* () {
-        const db = getAppDB();
+        const db = backend_core_1.context.getAppDB();
         let { _id, name, inherits, permissionId } = ctx.request.body;
         let isCreate = false;
         if (!_id) {
-            _id = generateRoleID();
+            _id = (0, utils_1.generateRoleID)();
             isCreate = true;
         }
-        else if (isBuiltin(_id)) {
+        else if (backend_core_1.roles.isBuiltin(_id)) {
             ctx.throw(400, "Cannot update builtin roles.");
         }
-        const role = new Role(_id, name)
-            .addPermission(permissionId)
-            .addInheritance(inherits);
+        const role = new backend_core_1.roles.Role(_id, name, permissionId).addInheritance(inherits);
         if (ctx.request.body._rev) {
             role._rev = ctx.request.body._rev;
         }
         const result = yield db.put(role);
         if (isCreate) {
-            yield events.role.created(role);
+            yield backend_core_1.events.role.created(role);
         }
         else {
-            yield events.role.updated(role);
+            yield backend_core_1.events.role.updated(role);
         }
         yield updateRolesOnUserTable(db, _id, UpdateRolesOptions.CREATED);
         role._rev = result.rev;
         ctx.body = role;
         ctx.message = `Role '${role.name}' created successfully.`;
     });
-};
-exports.destroy = function (ctx) {
+}
+exports.save = save;
+function destroy(ctx) {
     return __awaiter(this, void 0, void 0, function* () {
-        const db = getAppDB();
+        const db = backend_core_1.context.getAppDB();
         const roleId = ctx.params.roleId;
         const role = yield db.get(roleId);
-        if (isBuiltin(roleId)) {
+        if (backend_core_1.roles.isBuiltin(roleId)) {
             ctx.throw(400, "Cannot delete builtin role.");
         }
         // first check no users actively attached to role
-        const users = (yield db.allDocs(getUserMetadataParams(null, {
+        const users = (yield db.allDocs((0, utils_1.getUserMetadataParams)(undefined, {
             include_docs: true,
         }))).rows.map(row => row.doc);
         const usersWithRole = users.filter(user => user.roleId === roleId);
@@ -99,9 +100,10 @@ exports.destroy = function (ctx) {
             ctx.throw(400, "Cannot delete role when it is in use.");
         }
         yield db.remove(roleId, ctx.params.rev);
-        yield events.role.deleted(role);
+        yield backend_core_1.events.role.deleted(role);
         yield updateRolesOnUserTable(db, ctx.params.roleId, UpdateRolesOptions.REMOVED);
         ctx.message = `Role ${ctx.params.roleId} deleted successfully`;
         ctx.status = 200;
     });
-};
+}
+exports.destroy = destroy;