@budibase/server 2.2.9 → 2.2.10-alpha.0

package/dist/utilities/fileSystem/plugin.js

@@ -0,0 +1,63 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDatasourcePlugin = exports.getPluginMetadata = void 0;
+const { budibaseTempDir } = require("../budibaseDir");
+const fs = require("fs");
+const { join } = require("path");
+const backend_core_1 = require("@budibase/backend-core");
+const DATASOURCE_PATH = join(budibaseTempDir(), "datasource");
+const getPluginMetadata = (path) => __awaiter(void 0, void 0, void 0, function* () {
+    let metadata = {};
+    try {
+        const pkg = fs.readFileSync(join(path, "package.json"), "utf8");
+        const schema = fs.readFileSync(join(path, "schema.json"), "utf8");
+        metadata.schema = JSON.parse(schema);
+        metadata.package = JSON.parse(pkg);
+        if (!metadata.package.name ||
+            !metadata.package.version ||
+            !metadata.package.description) {
+            throw new Error("package.json is missing one of 'name', 'version' or 'description'.");
+        }
+    }
+    catch (err) {
+        throw new Error(`Unable to process schema.json/package.json in plugin. ${err.message}`);
+    }
+    return { metadata, directory: path };
+});
+exports.getPluginMetadata = getPluginMetadata;
+const getDatasourcePlugin = (plugin) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const hash = (_a = plugin.schema) === null || _a === void 0 ? void 0 : _a.hash;
+    if (!fs.existsSync(DATASOURCE_PATH)) {
+        fs.mkdirSync(DATASOURCE_PATH);
+    }
+    const filename = join(DATASOURCE_PATH, plugin.name);
+    const metadataName = `${filename}.bbmetadata`;
+    if (fs.existsSync(filename)) {
+        const currentHash = fs.readFileSync(metadataName, "utf8");
+        // if hash is the same return the file, otherwise remove it and re-download
+        if (currentHash === hash) {
+            return require(filename);
+        }
+        else {
+            console.log(`Updating plugin: ${plugin.name}`);
+            delete require.cache[require.resolve(filename)];
+            fs.unlinkSync(filename);
+        }
+    }
+    const pluginKey = backend_core_1.objectStore.getPluginJSKey(plugin);
+    const pluginJs = yield backend_core_1.objectStore.retrieve(backend_core_1.objectStore.ObjectStoreBuckets.PLUGINS, pluginKey);
+    fs.writeFileSync(filename, pluginJs);
+    fs.writeFileSync(metadataName, hash);
+    return require(filename);
+});
+exports.getDatasourcePlugin = getDatasourcePlugin;

package/dist/utilities/fileSystem/template.js

@@ -0,0 +1,44 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.downloadTemplate = exports.getTemplateStream = void 0;
+const fs = require("fs");
+const { join } = require("path");
+const constants_1 = require("../../constants");
+const backend_core_1 = require("@budibase/backend-core");
+/**
+ * This function manages temporary template files which are stored by Koa.
+ * @param {Object} template The template object retrieved from the Koa context object.
+ * @returns {Object} Returns an fs read stream which can be loaded into the database.
+ */
+const getTemplateStream = (template) => __awaiter(void 0, void 0, void 0, function* () {
+    if (template.file) {
+        return fs.createReadStream(template.file.path);
+    }
+    else {
+        const [type, name] = template.key.split("/");
+        const tmpPath = yield (0, exports.downloadTemplate)(type, name);
+        return fs.createReadStream(join(tmpPath, name, "db", "dump.txt"));
+    }
+});
+exports.getTemplateStream = getTemplateStream;
+/**
+ * Retrieves a template and pipes it to minio as well as making it available temporarily.
+ * @param {string} type The type of template which is to be retrieved.
+ * @param name
+ * @return {Promise<*>}
+ */
+const downloadTemplate = (type, name) => __awaiter(void 0, void 0, void 0, function* () {
+    const DEFAULT_TEMPLATES_BUCKET = "prod-budi-templates.s3-eu-west-1.amazonaws.com";
+    const templateUrl = `https://${DEFAULT_TEMPLATES_BUCKET}/templates/${type}/${name}.tar.gz`;
+    return backend_core_1.objectStore.downloadTarball(templateUrl, constants_1.ObjectStoreBuckets.TEMPLATES, type);
+});
+exports.downloadTemplate = downloadTemplate;

package/dist/utilities/index.js

@@ -12,9 +12,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isQsTrue = exports.convertBookmark = exports.formatBytes = exports.stringToReadStream = exports.escapeDangerousCharacters = exports.deleteEntityMetadata = exports.saveEntityMetadata = exports.updateEntityMetadata = exports.attachmentsRelativeURL = exports.clientLibraryPath = exports.objectStoreUrl = exports.checkSlashesInUrl = exports.removeFromArray = exports.NUMBER_REGEX = exports.isDev = exports.wait = void 0;
+exports.isQsTrue = exports.convertBookmark = exports.formatBytes = exports.stringToReadStream = exports.escapeDangerousCharacters = exports.deleteEntityMetadata = exports.saveEntityMetadata = exports.updateEntityMetadata = exports.checkSlashesInUrl = exports.removeFromArray = exports.NUMBER_REGEX = exports.isDev = exports.wait = void 0;
 const environment_1 = __importDefault(require("../environment"));
-const constants_1 = require("../constants");
 const backend_core_1 = require("@budibase/backend-core");
 const utils_1 = require("../db/utils");
 const stream_1 = __importDefault(require("stream"));
@@ -43,48 +42,6 @@ function checkSlashesInUrl(url) {
     return url.replace(/(https?:\/\/)|(\/)+/g, "$1$2");
 }
 exports.checkSlashesInUrl = checkSlashesInUrl;
-/**
- * Gets the address of the object store, depending on whether self hosted or in cloud.
- * @return {string} The base URL of the object store (MinIO or S3).
- */
-function objectStoreUrl() {
-    if (environment_1.default.SELF_HOSTED || environment_1.default.MINIO_URL) {
-        // can use a relative url for this as all goes through the proxy (this is hosted in minio)
-        return constants_1.OBJ_STORE_DIRECTORY;
-    }
-    else {
-        return environment_1.default.CDN_URL;
-    }
-}
-exports.objectStoreUrl = objectStoreUrl;
-/**
- * In production the client library is stored in the object store, however in development
- * we use the symlinked version produced by lerna, located in node modules. We link to this
- * via a specific endpoint (under /api/assets/client).
- * @param {string} appId In production we need the appId to look up the correct bucket, as the
- * version of the client lib may differ between apps.
- * @param {string} version The version to retrieve.
- * @return {string} The URL to be inserted into appPackage response or server rendered
- * app index file.
- */
-function clientLibraryPath(appId, version) {
-    if (environment_1.default.isProd()) {
-        let url = `${objectStoreUrl()}/${backend_core_1.objectStore.sanitizeKey(appId)}/budibase-client.js`;
-        // append app version to bust the cache
-        if (version) {
-            url += `?v=${version}`;
-        }
-        return url;
-    }
-    else {
-        return `/api/assets/client`;
-    }
-}
-exports.clientLibraryPath = clientLibraryPath;
-function attachmentsRelativeURL(attachmentKey) {
-    return checkSlashesInUrl(`${objectStoreUrl()}/${attachmentKey}`);
-}
-exports.attachmentsRelativeURL = attachmentsRelativeURL;
 function updateEntityMetadata(type, entityId, updateFn) {
     return __awaiter(this, void 0, void 0, function* () {
         const db = backend_core_1.context.getAppDB();

package/dist/utilities/rowProcessor/index.js

@@ -38,7 +38,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.cleanupAttachments = exports.outputProcessing = exports.inputProcessing = exports.coerce = exports.processAutoColumn = void 0;
 const linkRows = __importStar(require("../../db/linkedRows"));
 const constants_1 = require("../../constants");
-const index_1 = require("../index");
 const utils_1 = require("./utils");
 const constants_2 = require("../../constants");
 const backend_core_1 = require("@budibase/backend-core");
@@ -172,6 +171,15 @@ function inputProcessing(user, table, row, opts) {
         else {
             clonedRow[key] = coerce(value, field.type);
         }
+        // remove any attachment urls, they are generated on read
+        if (field.type === constants_1.FieldTypes.ATTACHMENT) {
+            const attachments = clonedRow[key];
+            if (attachments === null || attachments === void 0 ? void 0 : attachments.length) {
+                attachments.forEach((attachment) => {
+                    delete attachment.url;
+                });
+            }
+        }
     }
     if (!clonedRow._id || !clonedRow._rev) {
         clonedRow._id = row._id;
@@ -201,7 +209,7 @@ function outputProcessing(table, rows, opts = { squash: true }) {
         let enriched = yield linkRows.attachFullLinkedDocs(table, rows);
         // process formulas
         enriched = (0, utils_1.processFormulas)(table, enriched, { dynamic: true });
-        // update the attachments URL depending on hosting
+        // set the attachments URLs
         for (let [property, column] of Object.entries(table.schema)) {
             if (column.type === constants_1.FieldTypes.ATTACHMENT) {
                 for (let row of enriched) {
@@ -209,7 +217,7 @@ function outputProcessing(table, rows, opts = { squash: true }) {
                         continue;
                     }
                     row[property].forEach((attachment) => {
-                        attachment.url = (0, index_1.attachmentsRelativeURL)(attachment.key);
+                        attachment.url = backend_core_1.objectStore.getAppFileUrl(attachment.key);
                     });
                 }
             }
@@ -269,7 +277,7 @@ function cleanupAttachments(table, { row, rows, oldRow, oldTable, }) {
             }
         }
         if (files.length > 0) {
-            return backend_core_1.objectStore.deleteFiles(constants_2.ObjectStoreBuckets.APPS, files);
+            yield backend_core_1.objectStore.deleteFiles(constants_2.ObjectStoreBuckets.APPS, files);
         }
     });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/server",
   "email": "hi@budibase.com",
-  "version": "2.2.9",
+  "version": "2.2.10-alpha.0",
   "description": "Budibase Web Server",
   "main": "src/index.ts",
   "repository": {
@@ -43,11 +43,11 @@
   "license": "GPL-3.0",
   "dependencies": {
     "@apidevtools/swagger-parser": "10.0.3",
-    "@budibase/backend-core": "^2.2.9",
-    "@budibase/client": "^2.2.9",
-    "@budibase/pro": "2.2.8",
-    "@budibase/string-templates": "^2.2.9",
-    "@budibase/types": "^2.2.9",
+    "@budibase/backend-core": "2.2.10-alpha.0",
+    "@budibase/client": "2.2.10-alpha.0",
+    "@budibase/pro": "2.2.9",
+    "@budibase/string-templates": "2.2.10-alpha.0",
+    "@budibase/types": "2.2.10-alpha.0",
     "@bull-board/api": "3.7.0",
     "@bull-board/koa": "3.9.4",
     "@elastic/elasticsearch": "7.10.0",
@@ -130,13 +130,15 @@
     "@types/ioredis": "4.28.10",
     "@types/jest": "27.5.1",
     "@types/koa": "2.13.4",
-    "@types/koa__router": "8.0.11",
+    "@types/koa__router": "8.0.8",
     "@types/lodash": "4.14.180",
     "@types/node": "14.18.20",
     "@types/node-fetch": "2.6.1",
     "@types/oracledb": "5.2.2",
     "@types/pouchdb": "6.4.0",
     "@types/redis": "4.0.11",
+    "@types/server-destroy": "1.0.1",
+    "@types/tar": "6.1.3",
     "@typescript-eslint/parser": "5.45.0",
     "apidoc": "0.50.4",
     "babel-jest": "27.5.1",
@@ -165,5 +167,5 @@
   "optionalDependencies": {
     "oracledb": "5.3.0"
   },
-  "gitHead": "8ede6de345512ae60e6ae021f3cddb3d4f0a56ad"
+  "gitHead": "c66524253459a149aefa42831d63a7806696f036"
 }

package/specs/openapi.json

@@ -567,6 +567,40 @@
           "data"
         ]
       },
+      "deploymentOutput": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "_id": {
+                "description": "The ID of the app.",
+                "type": "string"
+              },
+              "status": {
+                "description": "Status of the deployment, whether it succeeded or failed",
+                "type": "string",
+                "enum": [
+                  "SUCCESS",
+                  "FAILURE"
+                ]
+              },
+              "appUrl": {
+                "description": "The URL of the published app",
+                "type": "string"
+              }
+            },
+            "required": [
+              "_id",
+              "status",
+              "appUrl"
+            ]
+          }
+        },
+        "required": [
+          "data"
+        ]
+      },
       "row": {
         "description": "The row to be created/updated, based on the table schema.",
         "type": "object",
@@ -1933,6 +1967,56 @@
         }
       }
     },
+    "/applications/{appId}/unpublish": {
+      "post": {
+        "operationId": "unpublish",
+        "summary": "Unpublish an application",
+        "tags": [
+          "applications"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/appIdUrl"
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "The app was published successfully."
+          }
+        }
+      }
+    },
+    "/applications/{appId}/publish": {
+      "post": {
+        "operationId": "publish",
+        "summary": "Unpublish an application",
+        "tags": [
+          "applications"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/appIdUrl"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Returns the deployment object.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/deploymentOutput"
+                },
+                "examples": {
+                  "deployment": {
+                    "$ref": "#/components/examples/deploymentOutput"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/applications/search": {
       "post": {
         "operationId": "search",

package/specs/openapi.yaml

@@ -411,6 +411,30 @@ components:
               - version
       required:
         - data
+    deploymentOutput:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            _id:
+              description: The ID of the app.
+              type: string
+            status:
+              description: Status of the deployment, whether it succeeded or failed
+              type: string
+              enum:
+                - SUCCESS
+                - FAILURE
+            appUrl:
+              description: The URL of the published app
+              type: string
+          required:
+            - _id
+            - status
+            - appUrl
+      required:
+        - data
     row:
       description: The row to be created/updated, based on the table schema.
       type: object
@@ -1453,6 +1477,35 @@ paths:
               examples:
                 application:
                   $ref: "#/components/examples/application"
+  "/applications/{appId}/unpublish":
+    post:
+      operationId: unpublish
+      summary: Unpublish an application
+      tags:
+        - applications
+      parameters:
+        - $ref: "#/components/parameters/appIdUrl"
+      responses:
+        "204":
+          description: The app was published successfully.
+  "/applications/{appId}/publish":
+    post:
+      operationId: publish
+      summary: Unpublish an application
+      tags:
+        - applications
+      parameters:
+        - $ref: "#/components/parameters/appIdUrl"
+      responses:
+        "200":
+          description: Returns the deployment object.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/deploymentOutput"
+              examples:
+                deployment:
+                  $ref: "#/components/examples/deploymentOutput"
   /applications/search:
     post:
       operationId: search

package/specs/resources/application.js

@@ -80,6 +80,22 @@ const applicationOutputSchema = object(
   }
 )
 
+const deploymentOutputSchema = object({
+  _id: {
+    description: "The ID of the app.",
+    type: "string",
+  },
+  status: {
+    description: "Status of the deployment, whether it succeeded or failed",
+    type: "string",
+    enum: ["SUCCESS", "FAILURE"],
+  },
+  appUrl: {
+    description: "The URL of the published app",
+    type: "string",
+  },
+})
+
 module.exports = new Resource()
   .setExamples({
     application: {
@@ -104,4 +120,7 @@ module.exports = new Resource()
         items: applicationOutputSchema,
       },
     }),
+    deploymentOutput: object({
+      data: deploymentOutputSchema,
+    }),
   })

package/src/api/controllers/application.ts

@@ -23,21 +23,18 @@ import {
   errors,
   events,
   migrations,
+  objectStore,
 } from "@budibase/backend-core"
 import { USERS_TABLE_SCHEMA } from "../../constants"
 import { buildDefaultDocs } from "../../db/defaultData/datasource_bb_default"
 import { removeAppFromUserRoles } from "../../utilities/workerRequests"
-import {
-  clientLibraryPath,
-  stringToReadStream,
-  isQsTrue,
-} from "../../utilities"
+import { stringToReadStream, isQsTrue } from "../../utilities"
 import { getLocksById } from "../../utilities/redis"
 import {
   updateClientLibrary,
   backupClientLibrary,
   revertClientLibrary,
-} from "../../utilities/fileSystem/clientLibrary"
+} from "../../utilities/fileSystem"
 import { cleanupAutomations } from "../../automations/utils"
 import { checkAppMetadata } from "../../automations/logging"
 import { getUniqueRows } from "../../utilities/usageQuota/rows"
@@ -49,10 +46,11 @@ import {
   MigrationType,
   BBContext,
   Database,
+  UserCtx,
 } from "@budibase/types"
 import { BASE_LAYOUT_PROP_IDS } from "../../constants/layouts"
-import { enrichPluginURLs } from "../../utilities/plugins"
 import sdk from "../../sdk"
+import { getDB } from "@budibase/backend-core/src/db"
 
 // utility function, need to do away with this
 async function getLayouts() {
@@ -204,27 +202,34 @@ export async function fetchAppDefinition(ctx: BBContext) {
   }
 }
 
-export async function fetchAppPackage(ctx: BBContext) {
+export async function fetchAppPackage(ctx: UserCtx) {
   const db = context.getAppDB()
   let application = await db.get(DocumentType.APP_METADATA)
   const layouts = await getLayouts()
   let screens = await getScreens()
 
   // Enrich plugin URLs
-  application.usedPlugins = enrichPluginURLs(application.usedPlugins)
+  application.usedPlugins = objectStore.enrichPluginURLs(
+    application.usedPlugins
+  )
 
   // Only filter screens if the user is not a builder
-  if (!(ctx.user?.builder && ctx.user.builder.global)) {
+  if (!(ctx.user.builder && ctx.user.builder.global)) {
     const userRoleId = getUserRoleId(ctx)
     const accessController = new roles.AccessController()
     screens = await accessController.checkScreensAccess(screens, userRoleId)
   }
 
+  const clientLibPath = objectStore.clientLibraryUrl(
+    ctx.params.appId,
+    application.version
+  )
+
   ctx.body = {
     application,
     screens,
     layouts,
-    clientLibPath: clientLibraryPath(ctx.params.appId, application.version),
+    clientLibPath,
   }
 }
 
@@ -370,7 +375,7 @@ async function appPostCreate(ctx: BBContext, app: App) {
         if (err.code && err.code === errors.codes.USAGE_LIMIT_EXCEEDED) {
           // this import resulted in row usage exceeding the quota
           // delete the app
-          // skip pre- and post-steps as no rows have been added to quotas yet
+          // skip pre and post-steps as no rows have been added to quotas yet
           ctx.params.appId = app.appId
           await destroyApp(ctx)
         }
@@ -460,41 +465,47 @@ export async function revertClient(ctx: BBContext) {
   ctx.body = app
 }
 
+const unpublishApp = async (ctx: any) => {
+  let appId = ctx.params.appId
+  appId = dbCore.getProdAppID(appId)
+
+  const db = context.getProdAppDB()
+  const result = await db.destroy()
+
+  await events.app.unpublished({ appId } as App)
+
+  // automations only in production
+  await cleanupAutomations(appId)
+
+  await cache.app.invalidateAppMetadata(appId)
+  return result
+}
+
 async function destroyApp(ctx: BBContext) {
   let appId = ctx.params.appId
-  let isUnpublish = ctx.query && ctx.query.unpublish
+  appId = dbCore.getProdAppID(appId)
+  const devAppId = dbCore.getDevAppID(appId)
 
-  if (isUnpublish) {
-    appId = dbCore.getProdAppID(appId)
-    const devAppId = dbCore.getDevAppID(appId)
-    // sync before removing the published app
+  // check if we need to unpublish first
+  if (await dbCore.dbExists(appId)) {
+    // app is deployed, run through unpublish flow
     await sdk.applications.syncApp(devAppId)
+    await unpublishApp(ctx)
   }
 
-  const db = isUnpublish ? context.getProdAppDB() : context.getAppDB()
+  const db = dbCore.getDB(devAppId)
+  // standard app deletion flow
   const app = await db.get(DocumentType.APP_METADATA)
   const result = await db.destroy()
+  await quotas.removeApp()
+  await events.app.deleted(app)
 
-  if (isUnpublish) {
-    await events.app.unpublished(app)
-  } else {
-    await quotas.removeApp()
-    await events.app.deleted(app)
-  }
-
-  /* istanbul ignore next */
-  if (!env.isTest() && !isUnpublish) {
+  if (!env.isTest()) {
     await deleteApp(appId)
   }
-  // automations only in production
-  if (isUnpublish) {
-    await cleanupAutomations(appId)
-  }
-  // remove app role when the dev app is deleted (no trace of app anymore)
-  else {
-    await removeAppFromUserRoles(ctx, appId)
-  }
-  await cache.app.invalidateAppMetadata(appId)
+
+  await removeAppFromUserRoles(ctx, appId)
+  await cache.app.invalidateAppMetadata(devAppId)
   return result
 }
 
@@ -519,6 +530,21 @@ export async function destroy(ctx: BBContext) {
   ctx.body = result
 }
 
+export const unpublish = async (ctx: BBContext) => {
+  const prodAppId = dbCore.getProdAppID(ctx.params.appId)
+  const dbExists = await dbCore.dbExists(prodAppId)
+
+  // check app has been published
+  if (!dbExists) {
+    return ctx.throw(400, "App has not been published.")
+  }
+
+  await preDestroyApp(ctx)
+  await unpublishApp(ctx)
+  await postDestroyApp(ctx)
+  ctx.status = 204
+}
+
 export async function sync(ctx: BBContext) {
   const appId = ctx.params.appId
   try {

package/src/api/controllers/auth.ts

@@ -3,7 +3,7 @@ import { InternalTables } from "../../db/utils"
 import { getFullUser } from "../../utilities/users"
 import { roles, context } from "@budibase/backend-core"
 import { groups } from "@budibase/pro"
-import { ContextUser, User, Row } from "@budibase/types"
+import { ContextUser, User, Row, UserCtx } from "@budibase/types"
 
 const PUBLIC_ROLE = roles.BUILTIN_ROLE_IDS.PUBLIC
 
@@ -16,7 +16,7 @@ const addSessionAttributesToUser = (ctx: any) => {
   }
 }
 
-export async function fetchSelf(ctx: any) {
+export async function fetchSelf(ctx: UserCtx) {
   let userId = ctx.user.userId || ctx.user._id
   /* istanbul ignore next */
   if (!userId || !ctx.isAuthenticated) {