@budibase/server 2.1.45 → 2.1.46-alpha.0

package/src/api/routes/plugin.ts

@@ -1,14 +1,22 @@
 import Router from "@koa/router"
 import * as controller from "../controllers/plugin"
 import authorized from "../../middleware/authorized"
-import { BUILDER } from "@budibase/backend-core/permissions"
+import { permissions } from "@budibase/backend-core"
 
-const router = new Router()
+const router: Router = new Router()
 
 router
-  .post("/api/plugin/upload", authorized(BUILDER), controller.upload)
-  .post("/api/plugin", authorized(BUILDER), controller.create)
-  .get("/api/plugin", authorized(BUILDER), controller.fetch)
-  .delete("/api/plugin/:pluginId", authorized(BUILDER), controller.destroy)
+  .post(
+    "/api/plugin/upload",
+    authorized(permissions.BUILDER),
+    controller.upload
+  )
+  .post("/api/plugin", authorized(permissions.BUILDER), controller.create)
+  .get("/api/plugin", authorized(permissions.BUILDER), controller.fetch)
+  .delete(
+    "/api/plugin/:pluginId",
+    authorized(permissions.BUILDER),
+    controller.destroy
+  )
 
 export default router

package/src/api/routes/public/index.ts

@@ -12,11 +12,8 @@ import env from "../../../environment"
 // below imports don't have declaration files
 const Router = require("@koa/router")
 const { RateLimit, Stores } = require("koa2-ratelimit")
-const {
-  PermissionLevels,
-  PermissionTypes,
-} = require("@budibase/backend-core/permissions")
-const { getRedisOptions } = require("@budibase/backend-core/redis").utils
+import { redis, permissions } from "@budibase/backend-core"
+const { PermissionType, PermissionLevel } = permissions
 
 const PREFIX = "/api/public/v1"
 // allow a lot more requests when in test
@@ -31,7 +28,7 @@ function getApiLimitPerSecond(): number {
 
 let rateLimitStore: any = null
 if (!env.isTest()) {
-  const REDIS_OPTS = getRedisOptions()
+  const REDIS_OPTS = redis.utils.getRedisOptions()
   let options
   if (REDIS_OPTS.redisProtocolUrl) {
     // fully qualified redis URL
@@ -105,7 +102,7 @@ function applyRoutes(
     : paramResource(resource)
   const publicApiMiddleware = publicApi({
     requiresAppId:
-      permType !== PermissionTypes.APP && permType !== PermissionTypes.USER,
+      permType !== PermissionType.APP && permType !== PermissionType.USER,
   })
   addMiddleware(endpoints.read, publicApiMiddleware)
   addMiddleware(endpoints.write, publicApiMiddleware)
@@ -113,8 +110,8 @@ function applyRoutes(
   addMiddleware(endpoints.read, paramMiddleware)
   addMiddleware(endpoints.write, paramMiddleware)
   // add the authorization middleware, using the correct perm type
-  addMiddleware(endpoints.read, authorized(permType, PermissionLevels.READ))
-  addMiddleware(endpoints.write, authorized(permType, PermissionLevels.WRITE))
+  addMiddleware(endpoints.read, authorized(permType, PermissionLevel.READ))
+  addMiddleware(endpoints.write, authorized(permType, PermissionLevel.WRITE))
   // add the output mapper middleware
   addMiddleware(endpoints.read, mapperMiddleware, { output: true })
   addMiddleware(endpoints.write, mapperMiddleware, { output: true })
@@ -122,12 +119,12 @@ function applyRoutes(
   addToRouter(endpoints.write)
 }
 
-applyRoutes(appEndpoints, PermissionTypes.APP, "appId")
-applyRoutes(tableEndpoints, PermissionTypes.TABLE, "tableId")
-applyRoutes(userEndpoints, PermissionTypes.USER, "userId")
-applyRoutes(queryEndpoints, PermissionTypes.QUERY, "queryId")
+applyRoutes(appEndpoints, PermissionType.APP, "appId")
+applyRoutes(tableEndpoints, PermissionType.TABLE, "tableId")
+applyRoutes(userEndpoints, PermissionType.USER, "userId")
+applyRoutes(queryEndpoints, PermissionType.QUERY, "queryId")
 // needs to be applied last for routing purposes, don't override other endpoints
-applyRoutes(rowEndpoints, PermissionTypes.TABLE, "tableId", "rowId")
+applyRoutes(rowEndpoints, PermissionType.TABLE, "tableId", "rowId")
 
 export default publicRouter
 

package/src/api/routes/public/tests/compare.spec.js

@@ -1,41 +1,23 @@
 const jestOpenAPI = require("jest-openapi").default
 const generateSchema = require("../../../../../specs/generate")
 const setup = require("../../tests/utilities")
-const { checkSlashesInUrl } = require("../../../../utilities")
+const { generateMakeRequest } = require("./utils")
 
 const yamlPath = generateSchema()
 jestOpenAPI(yamlPath)
 
-let request = setup.getRequest()
 let config = setup.getConfig()
-let apiKey, table, app
+let apiKey, table, app, makeRequest
 
 beforeAll(async () => {
   app = await config.init()
   table = await config.updateTable()
   apiKey = await config.generateApiKey()
+  makeRequest = generateMakeRequest(apiKey, setup)
 })
 
 afterAll(setup.afterAll)
 
-async function makeRequest(method, endpoint, body, appId = config.getAppId()) {
-  const extraHeaders = {
-    "x-budibase-api-key": apiKey,
-  }
-  if (appId) {
-    extraHeaders["x-budibase-app-id"] = appId
-  }
-  const req = request
-    [method](checkSlashesInUrl(`/api/public/v1/${endpoint}`))
-    .set(config.defaultHeaders(extraHeaders))
-  if (body) {
-    req.send(body)
-  }
-  const res = await req.expect("Content-Type", /json/).expect(200)
-  expect(res.body).toBeDefined()
-  return res
-}
-
 describe("check the applications endpoints", () => {
   it("should allow retrieving applications through search", async () => {
     const res = await makeRequest("post", "/applications/search")

package/src/api/routes/public/tests/users.spec.js

@@ -0,0 +1,38 @@
+const setup = require("../../tests/utilities")
+const { generateMakeRequest } = require("./utils")
+
+const workerRequests = require("../../../../utilities/workerRequests")
+
+let config = setup.getConfig()
+let apiKey, globalUser, makeRequest
+
+beforeAll(async () => {
+  await config.init()
+  globalUser = await config.globalUser()
+  apiKey = await config.generateApiKey(globalUser._id)
+  makeRequest = generateMakeRequest(apiKey, setup)
+  workerRequests.readGlobalUser.mockReturnValue(globalUser)
+})
+
+afterAll(setup.afterAll)
+
+describe("check user endpoints", () => {
+  it("should not allow a user to update their own roles", async () => {
+    const res = await makeRequest("put", `/users/${globalUser._id}`, {
+      ...globalUser,
+      roles: {
+        "app_1": "ADMIN",
+      }
+    })
+    expect(workerRequests.saveGlobalUser.mock.lastCall[0].body.data.roles["app_1"]).toBeUndefined()
+    expect(res.status).toBe(200)
+    expect(res.body.data.roles["app_1"]).toBeUndefined()
+  })
+
+  it("should not allow a user to delete themselves", async () => {
+    const res = await makeRequest("delete", `/users/${globalUser._id}`)
+    expect(res.status).toBe(405)
+    expect(workerRequests.deleteGlobalUser.mock.lastCall).toBeUndefined()
+  })
+})
+

package/src/api/routes/public/tests/utils.ts

@@ -0,0 +1,28 @@
+import { checkSlashesInUrl } from "../../../../utilities"
+
+export function generateMakeRequest(apiKey: string, setup: any) {
+  const request = setup.getRequest()
+  const config = setup.getConfig()
+  return async (
+    method: string,
+    endpoint: string,
+    body?: any,
+    intAppId: string = config.getAppId()
+  ) => {
+    const extraHeaders: any = {
+      "x-budibase-api-key": apiKey,
+    }
+    if (intAppId) {
+      extraHeaders["x-budibase-app-id"] = intAppId
+    }
+    const req = request[method](
+      checkSlashesInUrl(`/api/public/v1/${endpoint}`)
+    ).set(config.defaultHeaders(extraHeaders))
+    if (body) {
+      req.send(body)
+    }
+    const res = await req
+    expect(res.body).toBeDefined()
+    return res
+  }
+}

package/src/api/routes/{query.js → query.ts}

@@ -1,22 +1,19 @@
-const Router = require("@koa/router")
-const queryController = require("../controllers/query")
-const authorized = require("../../middleware/authorized")
-const {
-  PermissionLevels,
-  PermissionTypes,
-  BUILDER,
-} = require("@budibase/backend-core/permissions")
-const {
+import Router from "@koa/router"
+import * as queryController from "../controllers/query"
+import authorized from "../../middleware/authorized"
+import { permissions } from "@budibase/backend-core"
+import {
   bodyResource,
   bodySubResource,
   paramResource,
-} = require("../../middleware/resourceId")
-const {
+} from "../../middleware/resourceId"
+import {
   generateQueryPreviewValidation,
   generateQueryValidation,
-} = require("../controllers/query/validation")
+} from "../controllers/query/validation"
+const { BUILDER, PermissionType, PermissionLevel } = permissions
 
-const router = new Router()
+const router: Router = new Router()
 
 router
   .get("/api/queries", authorized(BUILDER), queryController.fetch)
@@ -38,27 +35,27 @@ router
   .get(
     "/api/queries/:queryId",
     paramResource("queryId"),
-    authorized(PermissionTypes.QUERY, PermissionLevels.READ),
+    authorized(PermissionType.QUERY, PermissionLevel.READ),
     queryController.find
   )
   // DEPRECATED - use new query endpoint for future work
   .post(
     "/api/queries/:queryId",
     paramResource("queryId"),
-    authorized(PermissionTypes.QUERY, PermissionLevels.WRITE),
+    authorized(PermissionType.QUERY, PermissionLevel.WRITE),
     queryController.executeV1
   )
-  .post(
-    "/api/v2/queries/:queryId",
-    paramResource("queryId"),
-    authorized(PermissionTypes.QUERY, PermissionLevels.WRITE),
-    queryController.executeV2
-  )
   .delete(
     "/api/queries/:queryId/:revId",
     paramResource("queryId"),
     authorized(BUILDER),
     queryController.destroy
   )
+  .post(
+    "/api/v2/queries/:queryId",
+    paramResource("queryId"),
+    authorized(PermissionType.QUERY, PermissionLevel.WRITE),
+    queryController.executeV2 as any
+  )
 
-module.exports = router
+export = router

package/src/api/routes/role.ts

@@ -0,0 +1,24 @@
+import Router from "@koa/router"
+import * as controller from "../controllers/role"
+import authorized from "../../middleware/authorized"
+import { permissions } from "@budibase/backend-core"
+import { roleValidator } from "./utils/validators"
+
+const router: Router = new Router()
+
+router
+  .post(
+    "/api/roles",
+    authorized(permissions.BUILDER),
+    roleValidator(),
+    controller.save
+  )
+  .get("/api/roles", authorized(permissions.BUILDER), controller.fetch)
+  .get("/api/roles/:roleId", authorized(permissions.BUILDER), controller.find)
+  .delete(
+    "/api/roles/:roleId/:rev",
+    authorized(permissions.BUILDER),
+    controller.destroy
+  )
+
+export = router

package/src/api/routes/routing.ts

@@ -0,0 +1,14 @@
+import Router from "@koa/router"
+import authorized from "../../middleware/authorized"
+import { permissions } from "@budibase/backend-core"
+import * as controller from "../controllers/routing"
+
+const router: Router = new Router()
+
+router
+  // gets correct structure for user role
+  .get("/api/routing/client", controller.clientFetch)
+  // gets the full structure, not just the correct screen ID for user role
+  .get("/api/routing", authorized(permissions.BUILDER), controller.fetch)
+
+export = router

package/src/api/routes/row.ts

@@ -2,13 +2,11 @@ import Router from "@koa/router"
 import * as rowController from "../controllers/row"
 import authorized from "../../middleware/authorized"
 import { paramResource, paramSubResource } from "../../middleware/resourceId"
-const {
-  PermissionLevels,
-  PermissionTypes,
-} = require("@budibase/backend-core/permissions")
+import { permissions } from "@budibase/backend-core"
 const { internalSearchValidator } = require("./utils/validators")
+const { PermissionType, PermissionLevel } = permissions
 
-const router = new Router()
+const router: Router = new Router()
 
 router
   /**
@@ -28,7 +26,7 @@ router
   .get(
     "/api/:tableId/:rowId/enrich",
     paramSubResource("tableId", "rowId"),
-    authorized(PermissionTypes.TABLE, PermissionLevels.READ),
+    authorized(PermissionType.TABLE, PermissionLevel.READ),
     rowController.fetchEnrichedRow
   )
   /**
@@ -48,7 +46,7 @@ router
   .get(
     "/api/:tableId/rows",
     paramResource("tableId"),
-    authorized(PermissionTypes.TABLE, PermissionLevels.READ),
+    authorized(PermissionType.TABLE, PermissionLevel.READ),
     rowController.fetch
   )
   /**
@@ -67,7 +65,7 @@ router
   .get(
     "/api/:tableId/rows/:rowId",
     paramSubResource("tableId", "rowId"),
-    authorized(PermissionTypes.TABLE, PermissionLevels.READ),
+    authorized(PermissionType.TABLE, PermissionLevel.READ),
     rowController.find
   )
   /**
@@ -137,7 +135,7 @@ router
     "/api/:tableId/search",
     internalSearchValidator(),
     paramResource("tableId"),
-    authorized(PermissionTypes.TABLE, PermissionLevels.READ),
+    authorized(PermissionType.TABLE, PermissionLevel.READ),
     rowController.search
   )
   // DEPRECATED - this is an old API, but for backwards compat it needs to be
@@ -145,7 +143,7 @@ router
   .post(
     "/api/search/:tableId/rows",
     paramResource("tableId"),
-    authorized(PermissionTypes.TABLE, PermissionLevels.READ),
+    authorized(PermissionType.TABLE, PermissionLevel.READ),
     rowController.search
   )
   /**
@@ -175,7 +173,7 @@ router
   .post(
     "/api/:tableId/rows",
     paramResource("tableId"),
-    authorized(PermissionTypes.TABLE, PermissionLevels.WRITE),
+    authorized(PermissionType.TABLE, PermissionLevel.WRITE),
     rowController.save
   )
   /**
@@ -189,7 +187,7 @@ router
   .patch(
     "/api/:tableId/rows",
     paramResource("tableId"),
-    authorized(PermissionTypes.TABLE, PermissionLevels.WRITE),
+    authorized(PermissionType.TABLE, PermissionLevel.WRITE),
     rowController.patch
   )
   /**
@@ -215,7 +213,7 @@ router
   .post(
     "/api/:tableId/rows/validate",
     paramResource("tableId"),
-    authorized(PermissionTypes.TABLE, PermissionLevels.WRITE),
+    authorized(PermissionType.TABLE, PermissionLevel.WRITE),
     rowController.validate
   )
   /**
@@ -241,7 +239,7 @@ router
   .delete(
     "/api/:tableId/rows",
     paramResource("tableId"),
-    authorized(PermissionTypes.TABLE, PermissionLevels.WRITE),
+    authorized(PermissionType.TABLE, PermissionLevel.WRITE),
     rowController.destroy
   )
 
@@ -261,7 +259,7 @@ router
   .post(
     "/api/:tableId/rows/exportRows",
     paramResource("tableId"),
-    authorized(PermissionTypes.TABLE, PermissionLevels.WRITE),
+    authorized(PermissionType.TABLE, PermissionLevel.WRITE),
     rowController.exportRows
   )
 

package/src/api/routes/screen.ts

@@ -0,0 +1,23 @@
+import Router from "@koa/router"
+import * as controller from "../controllers/screen"
+import authorized from "../../middleware/authorized"
+import { permissions } from "@budibase/backend-core"
+import { screenValidator } from "./utils/validators"
+
+const router: Router = new Router()
+
+router
+  .get("/api/screens", authorized(permissions.BUILDER), controller.fetch)
+  .post(
+    "/api/screens",
+    authorized(permissions.BUILDER),
+    screenValidator(),
+    controller.save
+  )
+  .delete(
+    "/api/screens/:screenId/:screenRev",
+    authorized(permissions.BUILDER),
+    controller.destroy
+  )
+
+export = router

package/src/api/routes/script.ts

@@ -0,0 +1,10 @@
+import Router from "@koa/router"
+import * as controller from "../controllers/script"
+import authorized from "../../middleware/authorized"
+import { permissions } from "@budibase/backend-core"
+
+const router: Router = new Router()
+
+router.post("/api/script", authorized(permissions.BUILDER), controller.save)
+
+export = router

package/src/api/routes/static.ts

@@ -2,15 +2,12 @@ import Router from "@koa/router"
 import * as controller from "../controllers/static"
 import { budibaseTempDir } from "../../utilities/budibaseDir"
 import authorized from "../../middleware/authorized"
-import {
-  BUILDER,
-  PermissionTypes,
-  PermissionLevels,
-} from "@budibase/backend-core/permissions"
+import { permissions } from "@budibase/backend-core"
 import * as env from "../../environment"
 import { paramResource } from "../../middleware/resourceId"
+const { BUILDER, PermissionType, PermissionLevel } = permissions
 
-const router = new Router()
+const router: Router = new Router()
 
 /* istanbul ignore next */
 router.param("file", async (file: any, ctx: any, next: any) => {
@@ -47,13 +44,13 @@ router
   .post(
     "/api/attachments/:tableId/upload",
     paramResource("tableId"),
-    authorized(PermissionTypes.TABLE, PermissionLevels.WRITE),
+    authorized(PermissionType.TABLE, PermissionLevel.WRITE),
     controller.uploadFile
   )
   .post(
     "/api/attachments/:tableId/delete",
     paramResource("tableId"),
-    authorized(PermissionTypes.TABLE, PermissionLevels.WRITE),
+    authorized(PermissionType.TABLE, PermissionLevel.WRITE),
     controller.deleteObjects
   )
   .get("/app/preview", authorized(BUILDER), controller.serveBuilderPreview)
@@ -61,8 +58,8 @@ router
   .get("/app/:appUrl/:path*", controller.serveApp)
   .post(
     "/api/attachments/:datasourceId/url",
-    authorized(PermissionTypes.TABLE, PermissionLevels.READ),
+    authorized(PermissionType.TABLE, PermissionLevel.READ),
     controller.getSignedUploadURL
   )
 
-export default router
+export = router

package/src/api/routes/{table.js → table.ts}

@@ -1,15 +1,12 @@
-const Router = require("@koa/router")
-const tableController = require("../controllers/table")
-const authorized = require("../../middleware/authorized")
-const { paramResource, bodyResource } = require("../../middleware/resourceId")
-const {
-  BUILDER,
-  PermissionLevels,
-  PermissionTypes,
-} = require("@budibase/backend-core/permissions")
-const { tableValidator } = require("./utils/validators")
+import Router from "@koa/router"
+import * as tableController from "../controllers/table"
+import authorized from "../../middleware/authorized"
+import { paramResource, bodyResource } from "../../middleware/resourceId"
+import { permissions } from "@budibase/backend-core"
+import { tableValidator } from "./utils/validators"
+const { BUILDER, PermissionLevel, PermissionType } = permissions
 
-const router = new Router()
+const router: Router = new Router()
 
 router
   /**
@@ -40,7 +37,7 @@ router
   .get(
     "/api/tables/:tableId",
     paramResource("tableId"),
-    authorized(PermissionTypes.TABLE, PermissionLevels.READ, { schema: true }),
+    authorized(PermissionType.TABLE, PermissionLevel.READ, { schema: true }),
     tableController.find
   )
   /**
@@ -193,4 +190,4 @@ router
     tableController.bulkImport
   )
 
-module.exports = router
+export = router

package/src/api/routes/templates.ts

@@ -0,0 +1,16 @@
+import Router from "@koa/router"
+import * as controller from "../controllers/templates"
+import authorized from "../../middleware/authorized"
+import { permissions } from "@budibase/backend-core"
+
+const router: Router = new Router()
+
+router
+  .get("/api/templates", authorized(permissions.BUILDER), controller.fetch)
+  .get(
+    "/api/templates/:type/:name",
+    authorized(permissions.BUILDER),
+    controller.downloadTemplate
+  )
+
+export = router

package/src/api/routes/tests/analytics.spec.js

@@ -43,7 +43,7 @@ describe("/static", () => {
 
     it("should ping from app", async () => {
       const headers = config.defaultHeaders()
-      headers[constants.Headers.APP_ID] = config.prodAppId
+      headers[constants.Header.APP_ID] = config.prodAppId
 
       await request
         .post("/api/bbtel/ping")

package/src/api/routes/tests/application.spec.js

@@ -17,7 +17,6 @@ const {
   checkBuilderEndpoint,
 } = require("./utilities/TestFunctions")
 const setup = require("./utilities")
-const { basicScreen, basicLayout } = setup.structures
 const { AppStatus } = require("../../../db/utils")
 const { events } = require("@budibase/backend-core")
 

package/src/api/routes/tests/backup.spec.js

@@ -1,4 +1,12 @@
-jest.mock("../../../utilities/fileSystem/utilities")
+jest.mock("@budibase/backend-core", () => {
+  const core = jest.requireActual("@budibase/backend-core")
+  return {
+    ...core,
+    objectStore: {
+      budibaseTempDir: core.objectStore.budibaseTempDir,
+    },
+  }
+})
 
 const { checkBuilderEndpoint } = require("./utilities/TestFunctions")
 const setup = require("./utilities")

package/src/api/routes/tests/deployment.spec.ts

@@ -1,4 +1,4 @@
-import setup from "./utilities"
+import * as setup from "./utilities"
 import { events } from "@budibase/backend-core"
 
 describe("/deployments", () => {

package/src/api/routes/tests/permissions.spec.js

@@ -1,6 +1,7 @@
-const { BUILTIN_ROLE_IDS } = require("@budibase/backend-core/roles")
+const { roles } = require("@budibase/backend-core")
 const setup = require("./utilities")
 const { basicRow } = setup.structures
+const { BUILTIN_ROLE_IDS } = roles
 
 const HIGHER_ROLE_ID = BUILTIN_ROLE_IDS.BASIC
 const STD_ROLE_ID = BUILTIN_ROLE_IDS.PUBLIC

package/src/api/routes/tests/query.spec.js

@@ -4,16 +4,21 @@ jest.mock("node-fetch")
 
 // Mock isProdAppID to we can later mock the implementation and pretend we are
 // using prod app IDs
-const authDb = require("@budibase/backend-core/db")
-const { isProdAppID } = authDb
-const mockIsProdAppID = jest.fn(isProdAppID)
-authDb.isProdAppID = mockIsProdAppID
-
+jest.mock("@budibase/backend-core", () => {
+  const core = jest.requireActual("@budibase/backend-core")
+  return {
+    ...core,
+    db: {
+      ...core.db,
+      isProdAppID: jest.fn(),
+    }
+  }
+})
 const setup = require("./utilities")
 const { checkBuilderEndpoint } = require("./utilities/TestFunctions")
 const { checkCacheForDynamicVariable } = require("../../../threads/utils")
 const { basicQuery, basicDatasource } = setup.structures
-const { events } = require("@budibase/backend-core")
+const { events, db: dbCore } = require("@budibase/backend-core")
 
 describe("/queries", () => {
   let request = setup.getRequest()
@@ -152,8 +157,8 @@ describe("/queries", () => {
 
     it("should remove sensitive info for prod apps", async () => {
       // Mock isProdAppID to pretend we are using a prod app
-      mockIsProdAppID.mockClear()
-      mockIsProdAppID.mockImplementation(() => true)
+      dbCore.isProdAppID.mockClear()
+      dbCore.isProdAppID.mockImplementation(() => true)
 
       const query = await config.createQuery()
       const res = await request
@@ -167,8 +172,8 @@ describe("/queries", () => {
       expect(res.body.schema).toBeDefined()
 
       // Reset isProdAppID mock
-      expect(mockIsProdAppID).toHaveBeenCalledTimes(1)
-      mockIsProdAppID.mockImplementation(isProdAppID)
+      expect(dbCore.isProdAppID).toHaveBeenCalledTimes(1)
+      dbCore.isProdAppID.mockImplementation(() => false)
     })
   })