@budibase/server 2.7.7-alpha.7 → 2.7.7-alpha.9

package/dist/automation.js

@@ -9026,7 +9026,7 @@ function lowerBuiltinRoleID(roleId1, roleId2) {
   }
   return builtinRoleToNumber(roleId1) > builtinRoleToNumber(roleId2) ? roleId2 : roleId1;
 }
-async function getRole(roleId) {
+async function getRole(roleId, opts) {
   if (!roleId) {
     return void 0;
   }
@@ -9042,6 +9042,9 @@ async function getRole(roleId) {
     role = Object.assign(role, dbRole);
     role._id = getExternalRoleID(role._id);
   } catch (err) {
+    if (!isBuiltin(roleId) && (opts == null ? void 0 : opts.defaultPublic)) {
+      return cloneDeep2(BUILTIN_ROLES.PUBLIC);
+    }
     if (Object.keys(role).length === 0) {
       throw err;
     }
@@ -9879,7 +9882,9 @@ var encryption_exports = {};
 __export(encryption_exports, {
   SecretOption: () => SecretOption,
   decrypt: () => decrypt,
+  decryptFile: () => decryptFile,
   encrypt: () => encrypt,
+  encryptFile: () => encryptFile,
   getSecret: () => getSecret
 });
 function getSecret(secretOption) {
@@ -9900,11 +9905,11 @@ function getSecret(secretOption) {
   }
   return secret;
 }
-function stretchString(string, salt) {
-  return import_crypto.default.pbkdf2Sync(string, salt, ITERATIONS, STRETCH_LENGTH, "sha512");
+function stretchString(secret, salt) {
+  return import_crypto.default.pbkdf2Sync(secret, salt, ITERATIONS, STRETCH_LENGTH, "sha512");
 }
 function encrypt(input, secretOption = "api" /* API */) {
-  const salt = import_crypto.default.randomBytes(RANDOM_BYTES);
+  const salt = import_crypto.default.randomBytes(SALT_LENGTH);
   const stretched = stretchString(getSecret(secretOption), salt);
   const cipher = import_crypto.default.createCipheriv(ALGO, stretched, salt);
   const base = cipher.update(input);
@@ -9921,16 +9926,101 @@ function decrypt(input, secretOption = "api" /* API */) {
   const final = decipher.final();
   return Buffer.concat([base, final]).toString();
 }
-var import_crypto, ALGO, SEPARATOR3, ITERATIONS, RANDOM_BYTES, STRETCH_LENGTH, SecretOption;
+async function encryptFile({ dir, filename }, secret) {
+  const outputFileName = `${filename}.enc`;
+  const filePath = (0, import_path2.join)(dir, filename);
+  const inputFile = import_fs2.default.createReadStream(filePath);
+  const outputFile = import_fs2.default.createWriteStream((0, import_path2.join)(dir, outputFileName));
+  const salt = import_crypto.default.randomBytes(SALT_LENGTH);
+  const iv = import_crypto.default.randomBytes(IV_LENGTH);
+  const stretched = stretchString(secret, salt);
+  const cipher = import_crypto.default.createCipheriv(ALGO, stretched, iv);
+  outputFile.write(salt);
+  outputFile.write(iv);
+  inputFile.pipe(import_zlib.default.createGzip()).pipe(cipher).pipe(outputFile);
+  return new Promise((r) => {
+    outputFile.on("finish", () => {
+      r({
+        filename: outputFileName,
+        dir
+      });
+    });
+  });
+}
+async function getSaltAndIV(path2) {
+  const fileStream = import_fs2.default.createReadStream(path2);
+  const salt = await readBytes(fileStream, SALT_LENGTH);
+  const iv = await readBytes(fileStream, IV_LENGTH);
+  fileStream.close();
+  return { salt, iv };
+}
+async function decryptFile(inputPath, outputPath, secret) {
+  const { salt, iv } = await getSaltAndIV(inputPath);
+  const inputFile = import_fs2.default.createReadStream(inputPath, {
+    start: SALT_LENGTH + IV_LENGTH
+  });
+  const outputFile = import_fs2.default.createWriteStream(outputPath);
+  const stretched = stretchString(secret, salt);
+  const decipher = import_crypto.default.createDecipheriv(ALGO, stretched, iv);
+  const unzip = import_zlib.default.createGunzip();
+  inputFile.pipe(decipher).pipe(unzip).pipe(outputFile);
+  return new Promise((res, rej) => {
+    outputFile.on("finish", () => {
+      outputFile.close();
+      res();
+    });
+    inputFile.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+    decipher.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+    unzip.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+    outputFile.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+  });
+}
+function readBytes(stream3, length) {
+  return new Promise((resolve3, reject) => {
+    let bytesRead = 0;
+    const data2 = [];
+    stream3.on("readable", () => {
+      let chunk;
+      while ((chunk = stream3.read(length - bytesRead)) !== null) {
+        data2.push(chunk);
+        bytesRead += chunk.length;
+      }
+      resolve3(Buffer.concat(data2));
+    });
+    stream3.on("end", () => {
+      reject(new Error("Insufficient data in the stream."));
+    });
+    stream3.on("error", (error) => {
+      reject(error);
+    });
+  });
+}
+var import_crypto, import_fs2, import_zlib, import_path2, ALGO, SEPARATOR3, ITERATIONS, STRETCH_LENGTH, SALT_LENGTH, IV_LENGTH, SecretOption;
 var init_encryption = __esm({
   "../backend-core/src/security/encryption.ts"() {
     import_crypto = __toESM(require("crypto"));
+    import_fs2 = __toESM(require("fs"));
+    import_zlib = __toESM(require("zlib"));
     init_environment3();
+    import_path2 = require("path");
     ALGO = "aes-256-ctr";
     SEPARATOR3 = "-";
     ITERATIONS = 1e4;
-    RANDOM_BYTES = 16;
     STRETCH_LENGTH = 32;
+    SALT_LENGTH = 16;
+    IV_LENGTH = 16;
     SecretOption = /* @__PURE__ */ ((SecretOption2) => {
       SecretOption2["API"] = "api";
       SecretOption2["ENCRYPTION"] = "encryption";
@@ -10841,12 +10931,12 @@ var init_plugin4 = __esm({
 function budibaseTempDir() {
   return bbTmp;
 }
-var import_path2, import_os, import_fs2, ObjectStoreBuckets, bbTmp;
+var import_path3, import_os, import_fs3, ObjectStoreBuckets, bbTmp;
 var init_utils8 = __esm({
   "../backend-core/src/objectStore/utils.ts"() {
-    import_path2 = require("path");
+    import_path3 = require("path");
     import_os = require("os");
-    import_fs2 = __toESM(require("fs"));
+    import_fs3 = __toESM(require("fs"));
     init_environment3();
     ObjectStoreBuckets = {
       BACKUPS: environment_default2.BACKUPS_BUCKET_NAME,
@@ -10855,9 +10945,9 @@ var init_utils8 = __esm({
       GLOBAL: environment_default2.GLOBAL_BUCKET_NAME,
       PLUGINS: environment_default2.PLUGIN_BUCKET_NAME
     };
-    bbTmp = (0, import_path2.join)((0, import_os.tmpdir)(), ".budibase");
-    if (!import_fs2.default.existsSync(bbTmp)) {
-      import_fs2.default.mkdirSync(bbTmp);
+    bbTmp = (0, import_path3.join)((0, import_os.tmpdir)(), ".budibase");
+    if (!import_fs3.default.existsSync(bbTmp)) {
+      import_fs3.default.mkdirSync(bbTmp);
     }
   }
 });
@@ -10869,17 +10959,17 @@ function sanitizeKey(input) {
 function sanitizeBucket(input) {
   return input.replace(new RegExp(APP_DEV_PREFIX, "g"), APP_PREFIX);
 }
-var import_aws_sdk, import_stream, import_node_fetch6, import_tar_fs, import_zlib, import_util, import_path3, import_fs3, import_uuid3, sanitize, streamPipeline, STATE, CONTENT_TYPE_MAP, STRING_CONTENT_TYPES, ObjectStore, makeSureBucketExists, upload, streamUpload, retrieve, listAllObjects, getPresignedUrl, retrieveToTmp, retrieveDirectory, deleteFile, deleteFiles, deleteFolder, uploadDirectory, downloadTarballDirect, downloadTarball;
+var import_aws_sdk, import_stream, import_node_fetch6, import_tar_fs, import_zlib2, import_util, import_path4, import_fs4, import_uuid3, sanitize, streamPipeline, STATE, CONTENT_TYPE_MAP, STRING_CONTENT_TYPES, ObjectStore, makeSureBucketExists, upload, streamUpload, retrieve, listAllObjects, getPresignedUrl, retrieveToTmp, retrieveDirectory, deleteFile, deleteFiles, deleteFolder, uploadDirectory, downloadTarballDirect, downloadTarball;
 var init_objectStore = __esm({
   "../backend-core/src/objectStore/objectStore.ts"() {
     import_aws_sdk = __toESM(require("aws-sdk"));
     import_stream = __toESM(require("stream"));
     import_node_fetch6 = __toESM(require("node-fetch"));
     import_tar_fs = __toESM(require("tar-fs"));
-    import_zlib = __toESM(require("zlib"));
+    import_zlib2 = __toESM(require("zlib"));
     import_util = require("util");
-    import_path3 = require("path");
-    import_fs3 = __toESM(require("fs"));
+    import_path4 = require("path");
+    import_fs4 = __toESM(require("fs"));
     init_environment3();
     init_utils8();
     import_uuid3 = require("uuid");
@@ -10958,7 +11048,7 @@ var init_objectStore = __esm({
       metadata
     }) => {
       const extension = filename.split(".").pop();
-      const fileBytes = import_fs3.default.readFileSync(path2);
+      const fileBytes = import_fs4.default.readFileSync(path2);
       const objectStore = ObjectStore(bucketName);
       await makeSureBucketExists(objectStore, bucketName);
       let contentType = type;
@@ -11060,13 +11150,13 @@ var init_objectStore = __esm({
       bucketName = sanitizeBucket(bucketName);
       filepath = sanitizeKey(filepath);
       const data2 = await retrieve(bucketName, filepath);
-      const outputPath = (0, import_path3.join)(budibaseTempDir(), (0, import_uuid3.v4)());
-      import_fs3.default.writeFileSync(outputPath, data2);
+      const outputPath = (0, import_path4.join)(budibaseTempDir(), (0, import_uuid3.v4)());
+      import_fs4.default.writeFileSync(outputPath, data2);
       return outputPath;
     };
     retrieveDirectory = async (bucketName, path2) => {
-      let writePath = (0, import_path3.join)(budibaseTempDir(), (0, import_uuid3.v4)());
-      import_fs3.default.mkdirSync(writePath);
+      let writePath = (0, import_path4.join)(budibaseTempDir(), (0, import_uuid3.v4)());
+      import_fs4.default.mkdirSync(writePath);
       const objects = await listAllObjects(bucketName, path2);
       let fullObjects = await Promise.all(
         objects.map((obj) => retrieve(bucketName, obj.Key))
@@ -11078,9 +11168,9 @@ var init_objectStore = __esm({
         const possiblePath = filename.split("/");
         if (possiblePath.length > 1) {
           const dirs = possiblePath.slice(0, possiblePath.length - 1);
-          import_fs3.default.mkdirSync((0, import_path3.join)(writePath, ...dirs), { recursive: true });
+          import_fs4.default.mkdirSync((0, import_path4.join)(writePath, ...dirs), { recursive: true });
         }
-        import_fs3.default.writeFileSync((0, import_path3.join)(writePath, ...possiblePath), data2);
+        import_fs4.default.writeFileSync((0, import_path4.join)(writePath, ...possiblePath), data2);
       }
       return writePath;
     };
@@ -11134,14 +11224,14 @@ var init_objectStore = __esm({
     uploadDirectory = async (bucketName, localPath, bucketPath) => {
       bucketName = sanitizeBucket(bucketName);
       let uploads = [];
-      const files = import_fs3.default.readdirSync(localPath, { withFileTypes: true });
+      const files = import_fs4.default.readdirSync(localPath, { withFileTypes: true });
       for (let file of files) {
-        const path2 = sanitizeKey((0, import_path3.join)(bucketPath, file.name));
-        const local = (0, import_path3.join)(localPath, file.name);
+        const path2 = sanitizeKey((0, import_path4.join)(bucketPath, file.name));
+        const local = (0, import_path4.join)(localPath, file.name);
         if (file.isDirectory()) {
           uploads.push(uploadDirectory(bucketName, local, path2));
         } else {
-          uploads.push(streamUpload(bucketName, path2, import_fs3.default.createReadStream(local)));
+          uploads.push(streamUpload(bucketName, path2, import_fs4.default.createReadStream(local)));
         }
       }
       await Promise.all(uploads);
@@ -11153,7 +11243,7 @@ var init_objectStore = __esm({
       if (!response2.ok) {
         throw new Error(`unexpected response ${response2.statusText}`);
       }
-      await streamPipeline(response2.body, import_zlib.default.createUnzip(), import_tar_fs.default.extract(path2));
+      await streamPipeline(response2.body, import_zlib2.default.createUnzip(), import_tar_fs.default.extract(path2));
     };
     downloadTarball = async (url, bucketName, path2) => {
       bucketName = sanitizeBucket(bucketName);
@@ -11162,8 +11252,8 @@ var init_objectStore = __esm({
       if (!response2.ok) {
         throw new Error(`unexpected response ${response2.statusText}`);
       }
-      const tmpPath = (0, import_path3.join)(budibaseTempDir(), path2);
-      await streamPipeline(response2.body, import_zlib.default.createUnzip(), import_tar_fs.default.extract(tmpPath));
+      const tmpPath = (0, import_path4.join)(budibaseTempDir(), path2);
+      await streamPipeline(response2.body, import_zlib2.default.createUnzip(), import_tar_fs.default.extract(tmpPath));
       if (!environment_default2.isTest() && environment_default2.SELF_HOSTED) {
         await uploadDirectory(bucketName, tmpPath, path2);
       }
@@ -12616,21 +12706,21 @@ __export(version_exports, {
   getLicenseVersion: () => getLicenseVersion,
   getProVersion: () => getProVersion
 });
-var import_fs4, import_path4, getLicenseVersion, getProVersion;
+var import_fs5, import_path5, getLicenseVersion, getProVersion;
 var init_version2 = __esm({
   "../pro/packages/pro/src/constants/version.ts"() {
     init_src2();
-    import_fs4 = __toESM(require("fs"));
-    import_path4 = __toESM(require("path"));
+    import_fs5 = __toESM(require("fs"));
+    import_path5 = __toESM(require("path"));
     getLicenseVersion = () => {
       if (environment_default2.isDev()) {
         const DEV_VER_FILENAME = "dev-version.txt";
-        const verFile = import_path4.default.join(objectStore_exports2.budibaseTempDir(), DEV_VER_FILENAME);
-        if (import_fs4.default.existsSync(verFile)) {
-          return import_fs4.default.readFileSync(verFile, "utf8");
+        const verFile = import_path5.default.join(objectStore_exports2.budibaseTempDir(), DEV_VER_FILENAME);
+        if (import_fs5.default.existsSync(verFile)) {
+          return import_fs5.default.readFileSync(verFile, "utf8");
         } else {
           const devVer = utils_exports2.newid();
-          import_fs4.default.writeFileSync(verFile, devVer);
+          import_fs5.default.writeFileSync(verFile, devVer);
           return devVer;
         }
       } else {
@@ -13076,31 +13166,31 @@ function getOfflineLicense() {
   }
 }
 function getOfflineLicenseFromDisk() {
-  if (import_fs5.default.existsSync(LICENSE_FILE_PATH)) {
-    const token = import_fs5.default.readFileSync(LICENSE_FILE_PATH, { encoding: "utf-8" });
+  if (import_fs6.default.existsSync(LICENSE_FILE_PATH)) {
+    const token = import_fs6.default.readFileSync(LICENSE_FILE_PATH, { encoding: "utf-8" });
     return import_jsonwebtoken.default.verify(token, PUBLIC_KEY, { algorithms: ["RS256"] });
   }
 }
 function writeOfflineLicenseToDisk(signedLicense) {
-  import_fs5.default.writeFileSync(LICENSE_FILE_PATH, signedLicense, { encoding: "utf-8" });
+  import_fs6.default.writeFileSync(LICENSE_FILE_PATH, signedLicense, { encoding: "utf-8" });
 }
 function deleteOfflineLicense() {
-  import_fs5.default.rmSync(LICENSE_FILE_PATH, { force: true });
+  import_fs6.default.rmSync(LICENSE_FILE_PATH, { force: true });
 }
-var import_fs5, import_path5, import_os2, import_jsonwebtoken, SUB_DIRECTORY, DIRECTORY, OFFLINE_LICENSE_FILE, LICENSE_FILE_PATH, PUBLIC_KEY;
+var import_fs6, import_path6, import_os2, import_jsonwebtoken, SUB_DIRECTORY, DIRECTORY, OFFLINE_LICENSE_FILE, LICENSE_FILE_PATH, PUBLIC_KEY;
 var init_offline = __esm({
   "../pro/packages/pro/src/sdk/licensing/licenses/offline.ts"() {
-    import_fs5 = __toESM(require("fs"));
-    import_path5 = require("path");
+    import_fs6 = __toESM(require("fs"));
+    import_path6 = require("path");
     import_os2 = require("os");
     import_jsonwebtoken = __toESM(require("jsonwebtoken"));
     init_src2();
     SUB_DIRECTORY = environment_default2.isTest() ? ".budibase-test" : ".budibase";
-    DIRECTORY = (0, import_path5.join)((0, import_os2.tmpdir)(), SUB_DIRECTORY);
+    DIRECTORY = (0, import_path6.join)((0, import_os2.tmpdir)(), SUB_DIRECTORY);
     OFFLINE_LICENSE_FILE = "offline_license.txt";
-    LICENSE_FILE_PATH = (0, import_path5.join)(DIRECTORY, OFFLINE_LICENSE_FILE);
-    if (!import_fs5.default.existsSync(DIRECTORY)) {
-      import_fs5.default.mkdirSync(DIRECTORY);
+    LICENSE_FILE_PATH = (0, import_path6.join)(DIRECTORY, OFFLINE_LICENSE_FILE);
+    if (!import_fs6.default.existsSync(DIRECTORY)) {
+      import_fs6.default.mkdirSync(DIRECTORY);
     }
     PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvz3jePLCFBXZ19c8Dpkv\nXtSgOhKFOcvQdo/LV0KJRUzQWDPWuO4ILtBtnqhjtIzZH4CH0qCYBet5L6Qr4CM1\nl2HXiAD1Q2rlHNW9wDaYyKb1F5f+v4RyqCAyzlkwRdksmkLeECTboojNnmRCrE3C\n8suunQP5bEScqEY2kclqzSf8e6xqMzPUg3mL/pNa1iEv7TuLbU9nJfgR36l0WmZY\n94fWnSaT8OSXSqcxsaByf06gfS3HAoTJNc7eqz1Hf9fUORQGPUAnFK8cT3SfdA36\nd/o3ZWE1TTj1zYwlCLN5qRKr3hU8nC3xEYNEbkB9SfTRaOq9Q7P8WmfLkoCPm3pR\nmwIDAQAB\n-----END PUBLIC KEY-----\n";
   }
@@ -14557,13 +14647,13 @@ var init_groups6 = __esm({
 
 // ../pro/packages/pro/src/utilities/fileSystem.ts
 function loadJSFile(directory, name) {
-  return import_fs6.default.readFileSync((0, import_path6.join)(directory, name), "utf8");
+  return import_fs7.default.readFileSync((0, import_path7.join)(directory, name), "utf8");
 }
-var import_fs6, import_path6;
+var import_fs7, import_path7;
 var init_fileSystem = __esm({
   "../pro/packages/pro/src/utilities/fileSystem.ts"() {
-    import_fs6 = __toESM(require("fs"));
-    import_path6 = require("path");
+    import_fs7 = __toESM(require("fs"));
+    import_path7 = require("path");
   }
 });
 
@@ -17531,8 +17621,8 @@ async function runBackup(trigger, tenantId, appId, opts) {
       }
     });
     await updateMetadata2("complete" /* COMPLETE */, { filename, contents });
-    if (import_fs7.default.existsSync(tarPath)) {
-      import_fs7.default.rmSync(tarPath);
+    if (import_fs8.default.existsSync(tarPath)) {
+      import_fs8.default.rmSync(tarPath);
     }
   } catch (err) {
     logging_exports.logAlert("App backup error", err);
@@ -17590,14 +17680,14 @@ async function exportProcessor(job, opts) {
     });
   });
 }
-var import_fs7;
+var import_fs8;
 var init_processing = __esm({
   "../pro/packages/pro/src/sdk/backups/processing.ts"() {
     init_src2();
     init_backup5();
     init_src();
     init_queue4();
-    import_fs7 = __toESM(require("fs"));
+    import_fs8 = __toESM(require("fs"));
   }
 });
 
@@ -18238,15 +18328,15 @@ async function downloadBackup(ctx) {
   const backupId = ctx.params.backupId;
   const { metadata, path: path2 } = await backups_default.downloadAppBackup(backupId);
   ctx.attachment(`backup-${metadata.timestamp}.tar.gz`);
-  ctx.body = import_fs8.default.createReadStream(path2);
+  ctx.body = import_fs9.default.createReadStream(path2);
 }
-var import_fs8;
+var import_fs9;
 var init_backups3 = __esm({
   "../pro/packages/pro/src/api/controllers/apps/backups.ts"() {
     init_src();
     init_sdk2();
     init_src2();
-    import_fs8 = __toESM(require("fs"));
+    import_fs9 = __toESM(require("fs"));
   }
 });
 
@@ -19538,32 +19628,32 @@ var init_centralPath = __esm({
 });
 
 // src/utilities/fileSystem/filesystem.ts
-var import_fs9, import_path7, import_tar, uuid2, TOP_LEVEL_PATH, apiFileReturn, streamFile, createTempFolder, extractTarball;
+var import_fs10, import_path8, import_tar, uuid2, TOP_LEVEL_PATH, apiFileReturn, streamFile, createTempFolder, extractTarball;
 var init_filesystem = __esm({
   "src/utilities/fileSystem/filesystem.ts"() {
-    import_fs9 = __toESM(require("fs"));
+    import_fs10 = __toESM(require("fs"));
     init_budibaseDir();
-    import_path7 = require("path");
+    import_path8 = require("path");
     init_environment();
     import_tar = __toESM(require("tar"));
     init_environment();
     uuid2 = require("uuid/v4");
-    TOP_LEVEL_PATH = environment_default.TOP_LEVEL_PATH || (0, import_path7.resolve)((0, import_path7.join)(__dirname, "..", "..", ".."));
+    TOP_LEVEL_PATH = environment_default.TOP_LEVEL_PATH || (0, import_path8.resolve)((0, import_path8.join)(__dirname, "..", "..", ".."));
     apiFileReturn = (contents) => {
-      const path2 = (0, import_path7.join)(budibaseTempDir2(), uuid2());
-      import_fs9.default.writeFileSync(path2, contents);
-      return import_fs9.default.createReadStream(path2);
+      const path2 = (0, import_path8.join)(budibaseTempDir2(), uuid2());
+      import_fs10.default.writeFileSync(path2, contents);
+      return import_fs10.default.createReadStream(path2);
     };
     streamFile = (path2) => {
-      return import_fs9.default.createReadStream(path2);
+      return import_fs10.default.createReadStream(path2);
     };
     createTempFolder = (item) => {
-      const path2 = (0, import_path7.join)(budibaseTempDir2(), item);
+      const path2 = (0, import_path8.join)(budibaseTempDir2(), item);
       try {
-        if (import_fs9.default.existsSync(path2)) {
-          import_fs9.default.rmSync(path2, { recursive: true, force: true });
+        if (import_fs10.default.existsSync(path2)) {
+          import_fs10.default.rmSync(path2, { recursive: true, force: true });
         }
-        import_fs9.default.mkdirSync(path2);
+        import_fs10.default.mkdirSync(path2);
       } catch (err) {
         throw new Error(`Path cannot be created: ${err.message}`);
       }
@@ -19590,17 +19680,17 @@ var init_clientLibrary = __esm({
 });
 
 // src/utilities/fileSystem/app.ts
-var import_path8, NODE_MODULES_PATH;
+var import_path9, NODE_MODULES_PATH;
 var init_app7 = __esm({
   "src/utilities/fileSystem/app.ts"() {
     init_budibaseDir();
-    import_path8 = require("path");
+    import_path9 = require("path");
     init_constants6();
     init_clientLibrary();
     init_environment();
     init_src2();
     init_filesystem();
-    NODE_MODULES_PATH = (0, import_path8.join)(TOP_LEVEL_PATH, "node_modules");
+    NODE_MODULES_PATH = (0, import_path9.join)(TOP_LEVEL_PATH, "node_modules");
   }
 });
 
@@ -19608,19 +19698,19 @@ var init_app7 = __esm({
 async function getPluginImpl(path2, plugin) {
   var _a;
   const hash2 = (_a = plugin.schema) == null ? void 0 : _a.hash;
-  if (!import_fs10.default.existsSync(path2)) {
-    import_fs10.default.mkdirSync(path2);
+  if (!import_fs11.default.existsSync(path2)) {
+    import_fs11.default.mkdirSync(path2);
   }
-  const filename = (0, import_path9.join)(path2, plugin.name);
+  const filename = (0, import_path10.join)(path2, plugin.name);
   const metadataName = `${filename}.bbmetadata`;
-  if (import_fs10.default.existsSync(filename)) {
-    const currentHash = import_fs10.default.readFileSync(metadataName, "utf8");
+  if (import_fs11.default.existsSync(filename)) {
+    const currentHash = import_fs11.default.readFileSync(metadataName, "utf8");
     if (currentHash === hash2) {
       return require(filename);
     } else {
       console.log(`Updating plugin: ${plugin.name}`);
       delete require.cache[require.resolve(filename)];
-      import_fs10.default.unlinkSync(filename);
+      import_fs11.default.unlinkSync(filename);
     }
   }
   const pluginKey = objectStore_exports2.getPluginJSKey(plugin);
@@ -19628,24 +19718,24 @@ async function getPluginImpl(path2, plugin) {
     objectStore_exports2.ObjectStoreBuckets.PLUGINS,
     pluginKey
   );
-  import_fs10.default.writeFileSync(filename, pluginJs);
-  import_fs10.default.writeFileSync(metadataName, hash2);
+  import_fs11.default.writeFileSync(filename, pluginJs);
+  import_fs11.default.writeFileSync(metadataName, hash2);
   return require(filename);
 }
-var import_fs10, import_path9, DATASOURCE_PATH, AUTOMATION_PATH, getPluginMetadata, getDatasourcePlugin, getAutomationPlugin;
+var import_fs11, import_path10, DATASOURCE_PATH, AUTOMATION_PATH, getPluginMetadata, getDatasourcePlugin, getAutomationPlugin;
 var init_plugin5 = __esm({
   "src/utilities/fileSystem/plugin.ts"() {
     init_budibaseDir();
-    import_fs10 = __toESM(require("fs"));
-    import_path9 = require("path");
+    import_fs11 = __toESM(require("fs"));
+    import_path10 = require("path");
     init_src2();
-    DATASOURCE_PATH = (0, import_path9.join)(budibaseTempDir2(), "datasource");
-    AUTOMATION_PATH = (0, import_path9.join)(budibaseTempDir2(), "automation");
+    DATASOURCE_PATH = (0, import_path10.join)(budibaseTempDir2(), "datasource");
+    AUTOMATION_PATH = (0, import_path10.join)(budibaseTempDir2(), "automation");
     getPluginMetadata = async (path2) => {
       let metadata = {};
       try {
-        const pkg2 = import_fs10.default.readFileSync((0, import_path9.join)(path2, "package.json"), "utf8");
-        const schema = import_fs10.default.readFileSync((0, import_path9.join)(path2, "schema.json"), "utf8");
+        const pkg2 = import_fs11.default.readFileSync((0, import_path10.join)(path2, "package.json"), "utf8");
+        const schema = import_fs11.default.readFileSync((0, import_path10.join)(path2, "schema.json"), "utf8");
         metadata.schema = JSON.parse(schema);
         metadata.package = JSON.parse(pkg2);
         if (!metadata.package.name || !metadata.package.version || !metadata.package.description) {
@@ -19716,13 +19806,14 @@ __export(exports_exports, {
   streamExportApp: () => streamExportApp
 });
 function tarFilesToTmp(tmpDir, files) {
-  const exportFile = (0, import_path10.join)(budibaseTempDir2(), `${uuid3()}.tar.gz`);
-  tar3.create(
+  const fileName = `${uuid3()}.tar.gz`;
+  const exportFile = (0, import_path11.join)(budibaseTempDir2(), fileName);
+  import_tar2.default.create(
     {
       sync: true,
       gzip: true,
       file: exportFile,
-      recursive: true,
+      noDirRecurse: false,
       cwd: tmpDir
     },
     files
@@ -19739,7 +19830,7 @@ async function exportDB(dbName, opts = {}) {
   return db_exports.doWithDB(dbName, async (db2) => {
     if (opts == null ? void 0 : opts.exportPath) {
       const path2 = opts == null ? void 0 : opts.exportPath;
-      const writeStream = import_fs11.default.createWriteStream(path2);
+      const writeStream = import_fs12.default.createWriteStream(path2);
       await db2.dump(writeStream, exportOpts);
       return path2;
     } else {
@@ -19772,9 +19863,9 @@ async function exportApp(appId, config) {
       for (let path2 of STATIC_APP_FILES) {
         const contents = await objectStore_exports2.retrieve(
           ObjectStoreBuckets2.APPS,
-          (0, import_path10.join)(appPath, path2)
+          (0, import_path11.join)(appPath, path2)
         );
-        import_fs11.default.writeFileSync((0, import_path10.join)(tmpPath, path2), contents);
+        import_fs12.default.writeFileSync((0, import_path11.join)(tmpPath, path2), contents);
       }
     } else {
       tmpPath = await objectStore_exports2.retrieveDirectory(
@@ -19783,37 +19874,52 @@ async function exportApp(appId, config) {
       );
     }
   }
-  const downloadedPath = (0, import_path10.join)(tmpPath, appPath);
-  if (import_fs11.default.existsSync(downloadedPath)) {
-    const allFiles = import_fs11.default.readdirSync(downloadedPath);
+  const downloadedPath = (0, import_path11.join)(tmpPath, appPath);
+  if (import_fs12.default.existsSync(downloadedPath)) {
+    const allFiles = import_fs12.default.readdirSync(downloadedPath);
     for (let file of allFiles) {
-      const path2 = (0, import_path10.join)(downloadedPath, file);
-      import_fs11.default.renameSync(path2, (0, import_path10.join)(downloadedPath, "..", file));
+      const path2 = (0, import_path11.join)(downloadedPath, file);
+      import_fs12.default.renameSync(path2, (0, import_path11.join)(downloadedPath, "..", file));
     }
-    import_fs11.default.rmdirSync(downloadedPath);
+    import_fs12.default.rmdirSync(downloadedPath);
   }
-  const dbPath = (0, import_path10.join)(tmpPath, DB_EXPORT_FILE);
+  const dbPath = (0, import_path11.join)(tmpPath, DB_EXPORT_FILE);
   await exportDB(appId, {
     filter: defineFilter(config == null ? void 0 : config.excludeRows, config == null ? void 0 : config.excludeLogs),
     exportPath: dbPath
   });
+  if (config == null ? void 0 : config.encryptPassword) {
+    for (let file of import_fs12.default.readdirSync(tmpPath)) {
+      const path2 = (0, import_path11.join)(tmpPath, file);
+      await encryption_exports.encryptFile(
+        { dir: tmpPath, filename: file },
+        config.encryptPassword
+      );
+      import_fs12.default.rmSync(path2);
+    }
+  }
   if (config == null ? void 0 : config.tar) {
-    const tarPath = tarFilesToTmp(tmpPath, import_fs11.default.readdirSync(tmpPath));
-    import_fs11.default.rmSync(tmpPath, { recursive: true, force: true });
+    const tarPath = tarFilesToTmp(tmpPath, import_fs12.default.readdirSync(tmpPath));
+    import_fs12.default.rmSync(tmpPath, { recursive: true, force: true });
     return tarPath;
   } else {
     return tmpPath;
   }
 }
-async function streamExportApp(appId, excludeRows) {
+async function streamExportApp({
+  appId,
+  excludeRows,
+  encryptPassword
+}) {
   const tmpPath = await exportApp(appId, {
     excludeRows,
     excludeLogs: true,
-    tar: true
+    tar: true,
+    encryptPassword
   });
   return streamFile(tmpPath);
 }
-var import_fs11, import_path10, uuid3, tar3, MemoryStream2;
+var import_fs12, import_path11, import_tar2, uuid3, MemoryStream2;
 var init_exports2 = __esm({
   "src/sdk/app/backups/exports.ts"() {
     init_src2();
@@ -19822,11 +19928,11 @@ var init_exports2 = __esm({
     init_constants6();
     init_utils13();
     init_constants7();
-    import_fs11 = __toESM(require("fs"));
-    import_path10 = require("path");
+    import_fs12 = __toESM(require("fs"));
+    import_path11 = require("path");
     init_environment();
+    import_tar2 = __toESM(require("tar"));
     uuid3 = require("uuid/v4");
-    tar3 = require("tar");
     MemoryStream2 = require("memorystream");
   }
 });
@@ -19903,16 +20009,16 @@ async function getTemplateStream(template) {
     throw new Error("Cannot import a non-text based file.");
   }
   if (template.file) {
-    return import_fs12.default.createReadStream(template.file.path);
+    return import_fs13.default.createReadStream(template.file.path);
   } else if (template.key) {
     const [type, name] = template.key.split("/");
     const tmpPath = await downloadTemplate(type, name);
-    return import_fs12.default.createReadStream((0, import_path11.join)(tmpPath, name, "db", "dump.txt"));
+    return import_fs13.default.createReadStream((0, import_path12.join)(tmpPath, name, "db", "dump.txt"));
   }
 }
 function untarFile(file) {
-  const tmpPath = (0, import_path11.join)(budibaseTempDir2(), uuid4());
-  import_fs12.default.mkdirSync(tmpPath);
+  const tmpPath = (0, import_path12.join)(budibaseTempDir2(), uuid4());
+  import_fs13.default.mkdirSync(tmpPath);
   tar4.extract({
     sync: true,
     cwd: tmpPath,
@@ -19920,31 +20026,49 @@ function untarFile(file) {
   });
   return tmpPath;
 }
+async function decryptFiles(path2, password) {
+  try {
+    for (let file of import_fs13.default.readdirSync(path2)) {
+      const inputPath = (0, import_path12.join)(path2, file);
+      const outputPath = inputPath.replace(/\.enc$/, "");
+      await encryption_exports.decryptFile(inputPath, outputPath, password);
+      import_fs13.default.rmSync(inputPath);
+    }
+  } catch (err) {
+    if (err.message === "incorrect header check") {
+      throw new Error("File cannot be imported");
+    }
+    throw err;
+  }
+}
 function getGlobalDBFile(tmpPath) {
-  return import_fs12.default.readFileSync((0, import_path11.join)(tmpPath, GLOBAL_DB_EXPORT_FILE), "utf8");
+  return import_fs13.default.readFileSync((0, import_path12.join)(tmpPath, GLOBAL_DB_EXPORT_FILE), "utf8");
 }
 function getListOfAppsInMulti(tmpPath) {
-  return import_fs12.default.readdirSync(tmpPath).filter((dir) => dir !== GLOBAL_DB_EXPORT_FILE);
+  return import_fs13.default.readdirSync(tmpPath).filter((dir) => dir !== GLOBAL_DB_EXPORT_FILE);
 }
 async function importApp(appId, db2, template) {
   var _a, _b;
   let prodAppId = db_exports.getProdAppID(appId);
   let dbStream;
   const isTar = template.file && ((_b = (_a = template == null ? void 0 : template.file) == null ? void 0 : _a.type) == null ? void 0 : _b.endsWith("gzip"));
-  const isDirectory = template.file && import_fs12.default.lstatSync(template.file.path).isDirectory();
+  const isDirectory = template.file && import_fs13.default.lstatSync(template.file.path).isDirectory();
   if (template.file && (isTar || isDirectory)) {
     const tmpPath = isTar ? untarFile(template.file) : template.file.path;
-    const contents = import_fs12.default.readdirSync(tmpPath);
+    if (isTar && template.file.password) {
+      await decryptFiles(tmpPath, template.file.password);
+    }
+    const contents = import_fs13.default.readdirSync(tmpPath);
     if (contents.length) {
       let promises = [];
       let excludedFiles = [GLOBAL_DB_EXPORT_FILE, DB_EXPORT_FILE];
       for (let filename of contents) {
-        const path2 = (0, import_path11.join)(tmpPath, filename);
+        const path2 = (0, import_path12.join)(tmpPath, filename);
         if (excludedFiles.includes(filename)) {
           continue;
         }
-        filename = (0, import_path11.join)(prodAppId, filename);
-        if (import_fs12.default.lstatSync(path2).isDirectory()) {
+        filename = (0, import_path12.join)(prodAppId, filename);
+        if (import_fs13.default.lstatSync(path2).isDirectory()) {
           promises.push(
             objectStore_exports2.uploadDirectory(ObjectStoreBuckets2.APPS, path2, filename)
           );
@@ -19960,7 +20084,7 @@ async function importApp(appId, db2, template) {
       }
       await Promise.all(promises);
     }
-    dbStream = import_fs12.default.createReadStream((0, import_path11.join)(tmpPath, DB_EXPORT_FILE));
+    dbStream = import_fs13.default.createReadStream((0, import_path12.join)(tmpPath, DB_EXPORT_FILE));
   } else {
     dbStream = await getTemplateStream(template);
   }
@@ -19972,7 +20096,7 @@ async function importApp(appId, db2, template) {
   await updateAutomations(prodAppId, db2);
   return ok;
 }
-var import_path11, import_fs12, uuid4, tar4;
+var import_path12, import_fs13, uuid4, tar4;
 var init_imports = __esm({
   "src/sdk/app/backups/imports.ts"() {
     init_src2();
@@ -19981,8 +20105,8 @@ var init_imports = __esm({
     init_constants7();
     init_fileSystem2();
     init_constants6();
-    import_path11 = require("path");
-    import_fs12 = __toESM(require("fs"));
+    import_path12 = require("path");
+    import_fs13 = __toESM(require("fs"));
     init_sdk3();
     init_src();
     uuid4 = require("uuid/v4");