@budibase/server 2.7.7-alpha.6 → 2.7.7-alpha.8

package/dist/query.js

@@ -11565,16 +11565,22 @@ var encryption_exports = {};
 __export(encryption_exports, {
   SecretOption: () => SecretOption,
   decrypt: () => decrypt,
+  decryptFile: () => decryptFile,
   encrypt: () => encrypt,
+  encryptFile: () => encryptFile,
   getSecret: () => getSecret
 });
 var import_crypto = __toESM(require("crypto"));
+var import_fs2 = __toESM(require("fs"));
+var import_zlib = __toESM(require("zlib"));
 init_environment2();
+var import_path2 = require("path");
 var ALGO = "aes-256-ctr";
 var SEPARATOR3 = "-";
 var ITERATIONS = 1e4;
-var RANDOM_BYTES = 16;
 var STRETCH_LENGTH = 32;
+var SALT_LENGTH = 16;
+var IV_LENGTH = 16;
 var SecretOption = /* @__PURE__ */ ((SecretOption2) => {
   SecretOption2["API"] = "api";
   SecretOption2["ENCRYPTION"] = "encryption";
@@ -11598,11 +11604,11 @@ function getSecret(secretOption) {
   }
   return secret;
 }
-function stretchString(string, salt) {
-  return import_crypto.default.pbkdf2Sync(string, salt, ITERATIONS, STRETCH_LENGTH, "sha512");
+function stretchString(secret, salt) {
+  return import_crypto.default.pbkdf2Sync(secret, salt, ITERATIONS, STRETCH_LENGTH, "sha512");
 }
 function encrypt(input, secretOption = "api" /* API */) {
-  const salt = import_crypto.default.randomBytes(RANDOM_BYTES);
+  const salt = import_crypto.default.randomBytes(SALT_LENGTH);
   const stretched = stretchString(getSecret(secretOption), salt);
   const cipher = import_crypto.default.createCipheriv(ALGO, stretched, salt);
   const base = cipher.update(input);
@@ -11619,6 +11625,87 @@ function decrypt(input, secretOption = "api" /* API */) {
   const final = decipher.final();
   return Buffer.concat([base, final]).toString();
 }
+async function encryptFile({ dir, filename }, secret) {
+  const outputFileName = `${filename}.enc`;
+  const filePath = (0, import_path2.join)(dir, filename);
+  const inputFile = import_fs2.default.createReadStream(filePath);
+  const outputFile = import_fs2.default.createWriteStream((0, import_path2.join)(dir, outputFileName));
+  const salt = import_crypto.default.randomBytes(SALT_LENGTH);
+  const iv = import_crypto.default.randomBytes(IV_LENGTH);
+  const stretched = stretchString(secret, salt);
+  const cipher = import_crypto.default.createCipheriv(ALGO, stretched, iv);
+  outputFile.write(salt);
+  outputFile.write(iv);
+  inputFile.pipe(import_zlib.default.createGzip()).pipe(cipher).pipe(outputFile);
+  return new Promise((r) => {
+    outputFile.on("finish", () => {
+      r({
+        filename: outputFileName,
+        dir
+      });
+    });
+  });
+}
+async function getSaltAndIV(path2) {
+  const fileStream = import_fs2.default.createReadStream(path2);
+  const salt = await readBytes(fileStream, SALT_LENGTH);
+  const iv = await readBytes(fileStream, IV_LENGTH);
+  fileStream.close();
+  return { salt, iv };
+}
+async function decryptFile(inputPath, outputPath, secret) {
+  const { salt, iv } = await getSaltAndIV(inputPath);
+  const inputFile = import_fs2.default.createReadStream(inputPath, {
+    start: SALT_LENGTH + IV_LENGTH
+  });
+  const outputFile = import_fs2.default.createWriteStream(outputPath);
+  const stretched = stretchString(secret, salt);
+  const decipher = import_crypto.default.createDecipheriv(ALGO, stretched, iv);
+  const unzip = import_zlib.default.createGunzip();
+  inputFile.pipe(decipher).pipe(unzip).pipe(outputFile);
+  return new Promise((res, rej) => {
+    outputFile.on("finish", () => {
+      outputFile.close();
+      res();
+    });
+    inputFile.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+    decipher.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+    unzip.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+    outputFile.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+  });
+}
+function readBytes(stream3, length) {
+  return new Promise((resolve3, reject) => {
+    let bytesRead = 0;
+    const data = [];
+    stream3.on("readable", () => {
+      let chunk;
+      while ((chunk = stream3.read(length - bytesRead)) !== null) {
+        data.push(chunk);
+        bytesRead += chunk.length;
+      }
+      resolve3(Buffer.concat(data));
+    });
+    stream3.on("end", () => {
+      reject(new Error("Insufficient data in the stream."));
+    });
+    stream3.on("error", (error) => {
+      reject(error);
+    });
+  });
+}
 
 // ../backend-core/src/middleware/authenticated.ts
 init_identity();
@@ -12376,16 +12463,16 @@ var import_aws_sdk = __toESM(require("aws-sdk"));
 var import_stream = __toESM(require("stream"));
 var import_node_fetch6 = __toESM(require("node-fetch"));
 var import_tar_fs = __toESM(require("tar-fs"));
-var import_zlib = __toESM(require("zlib"));
+var import_zlib2 = __toESM(require("zlib"));
 var import_util = require("util");
-var import_path3 = require("path");
-var import_fs3 = __toESM(require("fs"));
+var import_path4 = require("path");
+var import_fs4 = __toESM(require("fs"));
 init_environment2();
 
 // ../backend-core/src/objectStore/utils.ts
-var import_path2 = require("path");
+var import_path3 = require("path");
 var import_os = require("os");
-var import_fs2 = __toESM(require("fs"));
+var import_fs3 = __toESM(require("fs"));
 init_environment2();
 var ObjectStoreBuckets = {
   BACKUPS: environment_default2.BACKUPS_BUCKET_NAME,
@@ -12394,9 +12481,9 @@ var ObjectStoreBuckets = {
   GLOBAL: environment_default2.GLOBAL_BUCKET_NAME,
   PLUGINS: environment_default2.PLUGIN_BUCKET_NAME
 };
-var bbTmp = (0, import_path2.join)((0, import_os.tmpdir)(), ".budibase");
-if (!import_fs2.default.existsSync(bbTmp)) {
-  import_fs2.default.mkdirSync(bbTmp);
+var bbTmp = (0, import_path3.join)((0, import_os.tmpdir)(), ".budibase");
+if (!import_fs3.default.existsSync(bbTmp)) {
+  import_fs3.default.mkdirSync(bbTmp);
 }
 function budibaseTempDir() {
   return bbTmp;
@@ -12484,7 +12571,7 @@ var upload = async ({
   metadata
 }) => {
   const extension = filename.split(".").pop();
-  const fileBytes = import_fs3.default.readFileSync(path2);
+  const fileBytes = import_fs4.default.readFileSync(path2);
   const objectStore = ObjectStore(bucketName);
   await makeSureBucketExists(objectStore, bucketName);
   let contentType = type;
@@ -12586,13 +12673,13 @@ var retrieveToTmp = async (bucketName, filepath) => {
   bucketName = sanitizeBucket(bucketName);
   filepath = sanitizeKey(filepath);
   const data = await retrieve(bucketName, filepath);
-  const outputPath = (0, import_path3.join)(budibaseTempDir(), (0, import_uuid3.v4)());
-  import_fs3.default.writeFileSync(outputPath, data);
+  const outputPath = (0, import_path4.join)(budibaseTempDir(), (0, import_uuid3.v4)());
+  import_fs4.default.writeFileSync(outputPath, data);
   return outputPath;
 };
 var retrieveDirectory = async (bucketName, path2) => {
-  let writePath = (0, import_path3.join)(budibaseTempDir(), (0, import_uuid3.v4)());
-  import_fs3.default.mkdirSync(writePath);
+  let writePath = (0, import_path4.join)(budibaseTempDir(), (0, import_uuid3.v4)());
+  import_fs4.default.mkdirSync(writePath);
   const objects = await listAllObjects(bucketName, path2);
   let fullObjects = await Promise.all(
     objects.map((obj) => retrieve(bucketName, obj.Key))
@@ -12604,9 +12691,9 @@ var retrieveDirectory = async (bucketName, path2) => {
     const possiblePath = filename.split("/");
     if (possiblePath.length > 1) {
       const dirs = possiblePath.slice(0, possiblePath.length - 1);
-      import_fs3.default.mkdirSync((0, import_path3.join)(writePath, ...dirs), { recursive: true });
+      import_fs4.default.mkdirSync((0, import_path4.join)(writePath, ...dirs), { recursive: true });
     }
-    import_fs3.default.writeFileSync((0, import_path3.join)(writePath, ...possiblePath), data);
+    import_fs4.default.writeFileSync((0, import_path4.join)(writePath, ...possiblePath), data);
   }
   return writePath;
 };
@@ -12660,14 +12747,14 @@ var deleteFolder = async (bucketName, folder) => {
 var uploadDirectory = async (bucketName, localPath, bucketPath) => {
   bucketName = sanitizeBucket(bucketName);
   let uploads = [];
-  const files = import_fs3.default.readdirSync(localPath, { withFileTypes: true });
+  const files = import_fs4.default.readdirSync(localPath, { withFileTypes: true });
   for (let file of files) {
-    const path2 = sanitizeKey((0, import_path3.join)(bucketPath, file.name));
-    const local = (0, import_path3.join)(localPath, file.name);
+    const path2 = sanitizeKey((0, import_path4.join)(bucketPath, file.name));
+    const local = (0, import_path4.join)(localPath, file.name);
     if (file.isDirectory()) {
       uploads.push(uploadDirectory(bucketName, local, path2));
     } else {
-      uploads.push(streamUpload(bucketName, path2, import_fs3.default.createReadStream(local)));
+      uploads.push(streamUpload(bucketName, path2, import_fs4.default.createReadStream(local)));
     }
   }
   await Promise.all(uploads);
@@ -12679,7 +12766,7 @@ var downloadTarballDirect = async (url, path2, headers = {}) => {
   if (!response.ok) {
     throw new Error(`unexpected response ${response.statusText}`);
   }
-  await streamPipeline(response.body, import_zlib.default.createUnzip(), import_tar_fs.default.extract(path2));
+  await streamPipeline(response.body, import_zlib2.default.createUnzip(), import_tar_fs.default.extract(path2));
 };
 var downloadTarball = async (url, bucketName, path2) => {
   bucketName = sanitizeBucket(bucketName);
@@ -12688,8 +12775,8 @@ var downloadTarball = async (url, bucketName, path2) => {
   if (!response.ok) {
     throw new Error(`unexpected response ${response.statusText}`);
   }
-  const tmpPath = (0, import_path3.join)(budibaseTempDir(), path2);
-  await streamPipeline(response.body, import_zlib.default.createUnzip(), import_tar_fs.default.extract(tmpPath));
+  const tmpPath = (0, import_path4.join)(budibaseTempDir(), path2);
+  await streamPipeline(response.body, import_zlib2.default.createUnzip(), import_tar_fs.default.extract(tmpPath));
   if (!environment_default2.isTest() && environment_default2.SELF_HOSTED) {
     await uploadDirectory(bucketName, tmpPath, path2);
   }
@@ -18505,24 +18592,24 @@ init_src();
 var budibaseTempDir2 = objectStore_exports2.budibaseTempDir;
 
 // src/utilities/fileSystem/app.ts
-var import_path5 = require("path");
+var import_path6 = require("path");
 
 // src/utilities/fileSystem/filesystem.ts
-var import_fs4 = __toESM(require("fs"));
-var import_path4 = require("path");
+var import_fs5 = __toESM(require("fs"));
+var import_path5 = require("path");
 var import_tar = __toESM(require("tar"));
 var uuid2 = require("uuid/v4");
-var TOP_LEVEL_PATH = environment_default.TOP_LEVEL_PATH || (0, import_path4.resolve)((0, import_path4.join)(__dirname, "..", "..", ".."));
+var TOP_LEVEL_PATH = environment_default.TOP_LEVEL_PATH || (0, import_path5.resolve)((0, import_path5.join)(__dirname, "..", "..", ".."));
 var streamFile = (path2) => {
-  return import_fs4.default.createReadStream(path2);
+  return import_fs5.default.createReadStream(path2);
 };
 var createTempFolder = (item) => {
-  const path2 = (0, import_path4.join)(budibaseTempDir2(), item);
+  const path2 = (0, import_path5.join)(budibaseTempDir2(), item);
   try {
-    if (import_fs4.default.existsSync(path2)) {
-      import_fs4.default.rmSync(path2, { recursive: true, force: true });
+    if (import_fs5.default.existsSync(path2)) {
+      import_fs5.default.rmSync(path2, { recursive: true, force: true });
     }
-    import_fs4.default.mkdirSync(path2);
+    import_fs5.default.mkdirSync(path2);
   } catch (err) {
     throw new Error(`Path cannot be created: ${err.message}`);
   }
@@ -18536,18 +18623,18 @@ var extractTarball = async (fromFilePath, toPath) => {
 };
 
 // src/utilities/fileSystem/app.ts
-var NODE_MODULES_PATH = (0, import_path5.join)(TOP_LEVEL_PATH, "node_modules");
+var NODE_MODULES_PATH = (0, import_path6.join)(TOP_LEVEL_PATH, "node_modules");
 
 // src/utilities/fileSystem/plugin.ts
-var import_fs5 = __toESM(require("fs"));
-var import_path6 = require("path");
-var DATASOURCE_PATH = (0, import_path6.join)(budibaseTempDir2(), "datasource");
-var AUTOMATION_PATH = (0, import_path6.join)(budibaseTempDir2(), "automation");
+var import_fs6 = __toESM(require("fs"));
+var import_path7 = require("path");
+var DATASOURCE_PATH = (0, import_path7.join)(budibaseTempDir2(), "datasource");
+var AUTOMATION_PATH = (0, import_path7.join)(budibaseTempDir2(), "automation");
 var getPluginMetadata = async (path2) => {
   let metadata = {};
   try {
-    const pkg2 = import_fs5.default.readFileSync((0, import_path6.join)(path2, "package.json"), "utf8");
-    const schema = import_fs5.default.readFileSync((0, import_path6.join)(path2, "schema.json"), "utf8");
+    const pkg2 = import_fs6.default.readFileSync((0, import_path7.join)(path2, "package.json"), "utf8");
+    const schema = import_fs6.default.readFileSync((0, import_path7.join)(path2, "schema.json"), "utf8");
     metadata.schema = JSON.parse(schema);
     metadata.package = JSON.parse(pkg2);
     if (!metadata.package.name || !metadata.package.version || !metadata.package.description) {
@@ -18565,19 +18652,19 @@ var getPluginMetadata = async (path2) => {
 async function getPluginImpl(path2, plugin) {
   var _a;
   const hash2 = (_a = plugin.schema) == null ? void 0 : _a.hash;
-  if (!import_fs5.default.existsSync(path2)) {
-    import_fs5.default.mkdirSync(path2);
+  if (!import_fs6.default.existsSync(path2)) {
+    import_fs6.default.mkdirSync(path2);
   }
-  const filename = (0, import_path6.join)(path2, plugin.name);
+  const filename = (0, import_path7.join)(path2, plugin.name);
   const metadataName = `${filename}.bbmetadata`;
-  if (import_fs5.default.existsSync(filename)) {
-    const currentHash = import_fs5.default.readFileSync(metadataName, "utf8");
+  if (import_fs6.default.existsSync(filename)) {
+    const currentHash = import_fs6.default.readFileSync(metadataName, "utf8");
     if (currentHash === hash2) {
       return require(filename);
     } else {
       console.log(`Updating plugin: ${plugin.name}`);
       delete require.cache[require.resolve(filename)];
-      import_fs5.default.unlinkSync(filename);
+      import_fs6.default.unlinkSync(filename);
     }
   }
   const pluginKey = objectStore_exports2.getPluginJSKey(plugin);
@@ -18585,8 +18672,8 @@ async function getPluginImpl(path2, plugin) {
     objectStore_exports2.ObjectStoreBuckets.PLUGINS,
     pluginKey
   );
-  import_fs5.default.writeFileSync(filename, pluginJs);
-  import_fs5.default.writeFileSync(metadataName, hash2);
+  import_fs6.default.writeFileSync(filename, pluginJs);
+  import_fs6.default.writeFileSync(metadataName, hash2);
   return require(filename);
 }
 var getDatasourcePlugin = async (plugin) => {
@@ -18621,19 +18708,20 @@ var GLOBAL_DB_EXPORT_FILE = "global.txt";
 var STATIC_APP_FILES = ["manifest.json", "budibase-client.js"];
 
 // src/sdk/app/backups/exports.ts
-var import_fs6 = __toESM(require("fs"));
-var import_path7 = require("path");
+var import_fs7 = __toESM(require("fs"));
+var import_path8 = require("path");
+var import_tar2 = __toESM(require("tar"));
 var uuid3 = require("uuid/v4");
-var tar3 = require("tar");
 var MemoryStream = require("memorystream");
 function tarFilesToTmp(tmpDir, files) {
-  const exportFile = (0, import_path7.join)(budibaseTempDir2(), `${uuid3()}.tar.gz`);
-  tar3.create(
+  const fileName = `${uuid3()}.tar.gz`;
+  const exportFile = (0, import_path8.join)(budibaseTempDir2(), fileName);
+  import_tar2.default.create(
     {
       sync: true,
       gzip: true,
       file: exportFile,
-      recursive: true,
+      noDirRecurse: false,
       cwd: tmpDir
     },
     files
@@ -18650,7 +18738,7 @@ async function exportDB(dbName, opts = {}) {
   return db_exports.doWithDB(dbName, async (db) => {
     if (opts == null ? void 0 : opts.exportPath) {
       const path2 = opts == null ? void 0 : opts.exportPath;
-      const writeStream = import_fs6.default.createWriteStream(path2);
+      const writeStream = import_fs7.default.createWriteStream(path2);
       await db.dump(writeStream, exportOpts);
       return path2;
     } else {
@@ -18683,9 +18771,9 @@ async function exportApp(appId, config) {
       for (let path2 of STATIC_APP_FILES) {
         const contents = await objectStore_exports2.retrieve(
           ObjectStoreBuckets2.APPS,
-          (0, import_path7.join)(appPath, path2)
+          (0, import_path8.join)(appPath, path2)
         );
-        import_fs6.default.writeFileSync((0, import_path7.join)(tmpPath, path2), contents);
+        import_fs7.default.writeFileSync((0, import_path8.join)(tmpPath, path2), contents);
       }
     } else {
       tmpPath = await objectStore_exports2.retrieveDirectory(
@@ -18694,33 +18782,48 @@ async function exportApp(appId, config) {
       );
     }
   }
-  const downloadedPath = (0, import_path7.join)(tmpPath, appPath);
-  if (import_fs6.default.existsSync(downloadedPath)) {
-    const allFiles = import_fs6.default.readdirSync(downloadedPath);
+  const downloadedPath = (0, import_path8.join)(tmpPath, appPath);
+  if (import_fs7.default.existsSync(downloadedPath)) {
+    const allFiles = import_fs7.default.readdirSync(downloadedPath);
     for (let file of allFiles) {
-      const path2 = (0, import_path7.join)(downloadedPath, file);
-      import_fs6.default.renameSync(path2, (0, import_path7.join)(downloadedPath, "..", file));
+      const path2 = (0, import_path8.join)(downloadedPath, file);
+      import_fs7.default.renameSync(path2, (0, import_path8.join)(downloadedPath, "..", file));
     }
-    import_fs6.default.rmdirSync(downloadedPath);
+    import_fs7.default.rmdirSync(downloadedPath);
   }
-  const dbPath = (0, import_path7.join)(tmpPath, DB_EXPORT_FILE);
+  const dbPath = (0, import_path8.join)(tmpPath, DB_EXPORT_FILE);
   await exportDB(appId, {
     filter: defineFilter(config == null ? void 0 : config.excludeRows, config == null ? void 0 : config.excludeLogs),
     exportPath: dbPath
   });
+  if (config == null ? void 0 : config.encryptPassword) {
+    for (let file of import_fs7.default.readdirSync(tmpPath)) {
+      const path2 = (0, import_path8.join)(tmpPath, file);
+      await encryption_exports.encryptFile(
+        { dir: tmpPath, filename: file },
+        config.encryptPassword
+      );
+      import_fs7.default.rmSync(path2);
+    }
+  }
   if (config == null ? void 0 : config.tar) {
-    const tarPath = tarFilesToTmp(tmpPath, import_fs6.default.readdirSync(tmpPath));
-    import_fs6.default.rmSync(tmpPath, { recursive: true, force: true });
+    const tarPath = tarFilesToTmp(tmpPath, import_fs7.default.readdirSync(tmpPath));
+    import_fs7.default.rmSync(tmpPath, { recursive: true, force: true });
     return tarPath;
   } else {
     return tmpPath;
   }
 }
-async function streamExportApp(appId, excludeRows) {
+async function streamExportApp({
+  appId,
+  excludeRows,
+  encryptPassword
+}) {
   const tmpPath = await exportApp(appId, {
     excludeRows,
     excludeLogs: true,
-    tar: true
+    tar: true,
+    encryptPassword
   });
   return streamFile(tmpPath);
 }
@@ -18734,8 +18837,8 @@ __export(imports_exports, {
   untarFile: () => untarFile,
   updateAttachmentColumns: () => updateAttachmentColumns
 });
-var import_path8 = require("path");
-var import_fs7 = __toESM(require("fs"));
+var import_path9 = require("path");
+var import_fs8 = __toESM(require("fs"));
 init_src();
 var uuid4 = require("uuid/v4");
 var tar4 = require("tar");
@@ -18802,16 +18905,16 @@ async function getTemplateStream(template) {
     throw new Error("Cannot import a non-text based file.");
   }
   if (template.file) {
-    return import_fs7.default.createReadStream(template.file.path);
+    return import_fs8.default.createReadStream(template.file.path);
   } else if (template.key) {
     const [type, name] = template.key.split("/");
     const tmpPath = await downloadTemplate(type, name);
-    return import_fs7.default.createReadStream((0, import_path8.join)(tmpPath, name, "db", "dump.txt"));
+    return import_fs8.default.createReadStream((0, import_path9.join)(tmpPath, name, "db", "dump.txt"));
   }
 }
 function untarFile(file) {
-  const tmpPath = (0, import_path8.join)(budibaseTempDir2(), uuid4());
-  import_fs7.default.mkdirSync(tmpPath);
+  const tmpPath = (0, import_path9.join)(budibaseTempDir2(), uuid4());
+  import_fs8.default.mkdirSync(tmpPath);
   tar4.extract({
     sync: true,
     cwd: tmpPath,
@@ -18819,31 +18922,49 @@ function untarFile(file) {
   });
   return tmpPath;
 }
+async function decryptFiles(path2, password) {
+  try {
+    for (let file of import_fs8.default.readdirSync(path2)) {
+      const inputPath = (0, import_path9.join)(path2, file);
+      const outputPath = inputPath.replace(/\.enc$/, "");
+      await encryption_exports.decryptFile(inputPath, outputPath, password);
+      import_fs8.default.rmSync(inputPath);
+    }
+  } catch (err) {
+    if (err.message === "incorrect header check") {
+      throw new Error("File cannot be imported");
+    }
+    throw err;
+  }
+}
 function getGlobalDBFile(tmpPath) {
-  return import_fs7.default.readFileSync((0, import_path8.join)(tmpPath, GLOBAL_DB_EXPORT_FILE), "utf8");
+  return import_fs8.default.readFileSync((0, import_path9.join)(tmpPath, GLOBAL_DB_EXPORT_FILE), "utf8");
 }
 function getListOfAppsInMulti(tmpPath) {
-  return import_fs7.default.readdirSync(tmpPath).filter((dir) => dir !== GLOBAL_DB_EXPORT_FILE);
+  return import_fs8.default.readdirSync(tmpPath).filter((dir) => dir !== GLOBAL_DB_EXPORT_FILE);
 }
 async function importApp(appId, db, template) {
   var _a, _b;
   let prodAppId = db_exports.getProdAppID(appId);
   let dbStream;
   const isTar = template.file && ((_b = (_a = template == null ? void 0 : template.file) == null ? void 0 : _a.type) == null ? void 0 : _b.endsWith("gzip"));
-  const isDirectory = template.file && import_fs7.default.lstatSync(template.file.path).isDirectory();
+  const isDirectory = template.file && import_fs8.default.lstatSync(template.file.path).isDirectory();
   if (template.file && (isTar || isDirectory)) {
     const tmpPath = isTar ? untarFile(template.file) : template.file.path;
-    const contents = import_fs7.default.readdirSync(tmpPath);
+    if (isTar && template.file.password) {
+      await decryptFiles(tmpPath, template.file.password);
+    }
+    const contents = import_fs8.default.readdirSync(tmpPath);
     if (contents.length) {
       let promises = [];
       let excludedFiles = [GLOBAL_DB_EXPORT_FILE, DB_EXPORT_FILE];
       for (let filename of contents) {
-        const path2 = (0, import_path8.join)(tmpPath, filename);
+        const path2 = (0, import_path9.join)(tmpPath, filename);
         if (excludedFiles.includes(filename)) {
           continue;
         }
-        filename = (0, import_path8.join)(prodAppId, filename);
-        if (import_fs7.default.lstatSync(path2).isDirectory()) {
+        filename = (0, import_path9.join)(prodAppId, filename);
+        if (import_fs8.default.lstatSync(path2).isDirectory()) {
           promises.push(
             objectStore_exports2.uploadDirectory(ObjectStoreBuckets2.APPS, path2, filename)
           );
@@ -18859,7 +18980,7 @@ async function importApp(appId, db, template) {
       }
       await Promise.all(promises);
     }
-    dbStream = import_fs7.default.createReadStream((0, import_path8.join)(tmpPath, DB_EXPORT_FILE));
+    dbStream = import_fs8.default.createReadStream((0, import_path9.join)(tmpPath, DB_EXPORT_FILE));
   } else {
     dbStream = await getTemplateStream(template);
   }
@@ -19978,17 +20099,17 @@ __export(version_exports, {
   getLicenseVersion: () => getLicenseVersion,
   getProVersion: () => getProVersion
 });
-var import_fs8 = __toESM(require("fs"));
-var import_path9 = __toESM(require("path"));
+var import_fs9 = __toESM(require("fs"));
+var import_path10 = __toESM(require("path"));
 var getLicenseVersion = () => {
   if (environment_default2.isDev()) {
     const DEV_VER_FILENAME = "dev-version.txt";
-    const verFile = import_path9.default.join(objectStore_exports2.budibaseTempDir(), DEV_VER_FILENAME);
-    if (import_fs8.default.existsSync(verFile)) {
-      return import_fs8.default.readFileSync(verFile, "utf8");
+    const verFile = import_path10.default.join(objectStore_exports2.budibaseTempDir(), DEV_VER_FILENAME);
+    if (import_fs9.default.existsSync(verFile)) {
+      return import_fs9.default.readFileSync(verFile, "utf8");
     } else {
       const devVer = utils_exports2.newid();
-      import_fs8.default.writeFileSync(verFile, devVer);
+      import_fs9.default.writeFileSync(verFile, devVer);
       return devVer;
     }
   } else {
@@ -20347,16 +20468,16 @@ __export(offline_exports, {
   getOfflineLicense: () => getOfflineLicense,
   writeOfflineLicenseToDisk: () => writeOfflineLicenseToDisk
 });
-var import_fs9 = __toESM(require("fs"));
-var import_path10 = require("path");
+var import_fs10 = __toESM(require("fs"));
+var import_path11 = require("path");
 var import_os2 = require("os");
 var import_jsonwebtoken = __toESM(require("jsonwebtoken"));
 var SUB_DIRECTORY = environment_default2.isTest() ? ".budibase-test" : ".budibase";
-var DIRECTORY = (0, import_path10.join)((0, import_os2.tmpdir)(), SUB_DIRECTORY);
+var DIRECTORY = (0, import_path11.join)((0, import_os2.tmpdir)(), SUB_DIRECTORY);
 var OFFLINE_LICENSE_FILE = "offline_license.txt";
-var LICENSE_FILE_PATH = (0, import_path10.join)(DIRECTORY, OFFLINE_LICENSE_FILE);
-if (!import_fs9.default.existsSync(DIRECTORY)) {
-  import_fs9.default.mkdirSync(DIRECTORY);
+var LICENSE_FILE_PATH = (0, import_path11.join)(DIRECTORY, OFFLINE_LICENSE_FILE);
+if (!import_fs10.default.existsSync(DIRECTORY)) {
+  import_fs10.default.mkdirSync(DIRECTORY);
 }
 var PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvz3jePLCFBXZ19c8Dpkv\nXtSgOhKFOcvQdo/LV0KJRUzQWDPWuO4ILtBtnqhjtIzZH4CH0qCYBet5L6Qr4CM1\nl2HXiAD1Q2rlHNW9wDaYyKb1F5f+v4RyqCAyzlkwRdksmkLeECTboojNnmRCrE3C\n8suunQP5bEScqEY2kclqzSf8e6xqMzPUg3mL/pNa1iEv7TuLbU9nJfgR36l0WmZY\n94fWnSaT8OSXSqcxsaByf06gfS3HAoTJNc7eqz1Hf9fUORQGPUAnFK8cT3SfdA36\nd/o3ZWE1TTj1zYwlCLN5qRKr3hU8nC3xEYNEbkB9SfTRaOq9Q7P8WmfLkoCPm3pR\nmwIDAQAB\n-----END PUBLIC KEY-----\n";
 function getOfflineLicense() {
@@ -20367,16 +20488,16 @@ function getOfflineLicense() {
   }
 }
 function getOfflineLicenseFromDisk() {
-  if (import_fs9.default.existsSync(LICENSE_FILE_PATH)) {
-    const token = import_fs9.default.readFileSync(LICENSE_FILE_PATH, { encoding: "utf-8" });
+  if (import_fs10.default.existsSync(LICENSE_FILE_PATH)) {
+    const token = import_fs10.default.readFileSync(LICENSE_FILE_PATH, { encoding: "utf-8" });
     return import_jsonwebtoken.default.verify(token, PUBLIC_KEY, { algorithms: ["RS256"] });
   }
 }
 function writeOfflineLicenseToDisk(signedLicense) {
-  import_fs9.default.writeFileSync(LICENSE_FILE_PATH, signedLicense, { encoding: "utf-8" });
+  import_fs10.default.writeFileSync(LICENSE_FILE_PATH, signedLicense, { encoding: "utf-8" });
 }
 function deleteOfflineLicense() {
-  import_fs9.default.rmSync(LICENSE_FILE_PATH, { force: true });
+  import_fs10.default.rmSync(LICENSE_FILE_PATH, { force: true });
 }
 
 // ../pro/packages/pro/src/sdk/licensing/licenses/licenses.ts
@@ -21581,10 +21702,10 @@ __export(plugins_exports, {
 init_src();
 
 // ../pro/packages/pro/src/utilities/fileSystem.ts
-var import_fs10 = __toESM(require("fs"));
-var import_path11 = require("path");
+var import_fs11 = __toESM(require("fs"));
+var import_path12 = require("path");
 function loadJSFile(directory, name) {
-  return import_fs10.default.readFileSync((0, import_path11.join)(directory, name), "utf8");
+  return import_fs11.default.readFileSync((0, import_path12.join)(directory, name), "utf8");
 }
 
 // ../pro/packages/pro/src/sdk/plugins/index.ts
@@ -22222,7 +22343,7 @@ __export(processing_exports, {
   init: () => init12
 });
 init_src();
-var import_fs11 = __toESM(require("fs"));
+var import_fs12 = __toESM(require("fs"));
 async function init12(opts) {
   await getBackupQueue().process(async (job) => {
     const data = job.data;
@@ -22290,8 +22411,8 @@ async function runBackup(trigger, tenantId, appId, opts) {
       }
     });
     await updateMetadata("complete" /* COMPLETE */, { filename, contents });
-    if (import_fs11.default.existsSync(tarPath)) {
-      import_fs11.default.rmSync(tarPath);
+    if (import_fs12.default.existsSync(tarPath)) {
+      import_fs12.default.rmSync(tarPath);
     }
   } catch (err) {
     logging_exports.logAlert("App backup error", err);
@@ -22744,7 +22865,7 @@ router3.post(
 
 // ../pro/packages/pro/src/api/controllers/apps/backups.ts
 init_src();
-var import_fs12 = __toESM(require("fs"));
+var import_fs13 = __toESM(require("fs"));
 async function checkAppID(ctx, appId) {
   if (!await utils_exports5.appExists(appId)) {
     ctx.throw(400, `Provided app ID: ${appId} - is invalid.`);
@@ -22830,7 +22951,7 @@ async function downloadBackup(ctx) {
   const backupId = ctx.params.backupId;
   const { metadata, path: path2 } = await backups_default2.downloadAppBackup(backupId);
   ctx.attachment(`backup-${metadata.timestamp}.tar.gz`);
-  ctx.body = import_fs12.default.createReadStream(path2);
+  ctx.body = import_fs13.default.createReadStream(path2);
 }
 
 // ../pro/packages/pro/src/api/routes/apps/backups.ts