@budibase/worker 1.1.32 → 1.2.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/worker",
   "email": "hi@budibase.com",
-  "version": "1.1.32",
+  "version": "1.2.2",
   "description": "Budibase background service",
   "main": "src/index.ts",
   "repository": {
@@ -35,10 +35,10 @@
   "author": "Budibase",
   "license": "GPL-3.0",
   "dependencies": {
-    "@budibase/backend-core": "^1.1.32",
-    "@budibase/pro": "1.1.31",
-    "@budibase/string-templates": "^1.1.32",
-    "@budibase/types": "^1.1.32",
+    "@budibase/backend-core": "^1.2.2",
+    "@budibase/pro": "1.1.33-alpha.0",
+    "@budibase/string-templates": "^1.2.2",
+    "@budibase/types": "^1.2.2",
     "@koa/router": "8.0.8",
     "@sentry/node": "6.17.7",
     "@techpass/passport-openidconnect": "0.3.2",
@@ -101,5 +101,5 @@
       "./scripts/jestSetup.js"
     ]
   },
-  "gitHead": "900d5de0723c1b7acf218446507d52755fdf7d83"
+  "gitHead": "91527fdba7a07be28f5026f2b89291341c42812a"
 }

package/src/api/controllers/global/users.ts

@@ -13,6 +13,8 @@ import {
   cache,
 } from "@budibase/backend-core"
 import { checkAnyUserExists } from "../../../utilities/users"
+import { groups as groupUtils } from "@budibase/pro"
+const MAX_USERS_UPLOAD_LIMIT = 1000
 
 export const save = async (ctx: any) => {
   try {
@@ -22,6 +24,36 @@ export const save = async (ctx: any) => {
   }
 }
 
+export const bulkCreate = async (ctx: any) => {
+  let { users: newUsersRequested, groups } = ctx.request.body
+
+  if (!env.SELF_HOSTED && newUsersRequested.length > MAX_USERS_UPLOAD_LIMIT) {
+    ctx.throw(
+      400,
+      "Max limit for upload is 1000 users. Please reduce file size and try again."
+    )
+  }
+
+  const db = tenancy.getGlobalDB()
+  let groupsToSave: any[] = []
+
+  if (groups.length) {
+    for (const groupId of groups) {
+      let oldGroup = await db.get(groupId)
+      groupsToSave.push(oldGroup)
+    }
+  }
+
+  try {
+    let response = await users.bulkCreate(newUsersRequested, groups)
+    await groupUtils.bulkSaveGroupUsers(groupsToSave, response)
+
+    ctx.body = response
+  } catch (err: any) {
+    ctx.throw(err.status || 400, err)
+  }
+}
+
 const parseBooleanParam = (param: any) => {
   return !(param && param === "false")
 }
@@ -82,14 +114,39 @@ export const adminUser = async (ctx: any) => {
   })
 }
 
+export const countByApp = async (ctx: any) => {
+  const appId = ctx.params.appId
+  try {
+    const response = await users.countUsersByApp(appId)
+    ctx.body = response
+  } catch (err: any) {
+    ctx.throw(err.status || 400, err)
+  }
+}
+
 export const destroy = async (ctx: any) => {
   const id = ctx.params.id
+
   await users.destroy(id, ctx.user)
+
   ctx.body = {
     message: `User ${id} deleted.`,
   }
 }
 
+export const bulkDelete = async (ctx: any) => {
+  const { userIds } = ctx.request.body
+  try {
+    let usersResponse = await users.bulkDelete(userIds)
+
+    ctx.body = {
+      message: `${usersResponse.length} user(s) deleted`,
+    }
+  } catch (err) {
+    ctx.throw(err)
+  }
+}
+
 export const search = async (ctx: any) => {
   const paginated = await users.paginatedUsers(ctx.request.body)
   // user hashed password shouldn't ever be returned
@@ -149,6 +206,39 @@ export const invite = async (ctx: any) => {
   await events.user.invited()
 }
 
+export const inviteMultiple = async (ctx: any) => {
+  let { emails, userInfo } = ctx.request.body
+  let existing = false
+  let existingEmail
+  for (let email of emails) {
+    if (await usersCore.getGlobalUserByEmail(email)) {
+      existing = true
+      existingEmail = email
+      break
+    }
+  }
+
+  if (existing) {
+    ctx.throw(400, `${existingEmail} already exists`)
+  }
+  if (!userInfo) {
+    userInfo = {}
+  }
+  userInfo.tenantId = tenancy.getTenantId()
+  const opts: any = {
+    subject: "{{ company }} platform invitation",
+    info: userInfo,
+  }
+
+  for (let i = 0; i < emails.length; i++) {
+    await sendEmail(emails[i], EmailTemplatePurpose.INVITATION, opts)
+  }
+
+  ctx.body = {
+    message: "Invitations have been sent.",
+  }
+}
+
 export const inviteAccept = async (ctx: any) => {
   const { inviteCode, password, firstName, lastName } = ctx.request.body
   try {

package/src/api/routes/global/auth.js

@@ -1,6 +1,6 @@
 const Router = require("@koa/router")
 const authController = require("../../controllers/global/auth")
-const joiValidator = require("../../../middleware/joi-validator")
+const { joiValidator } = require("@budibase/backend-core/auth")
 const Joi = require("joi")
 const { updateTenantId } = require("@budibase/backend-core/tenancy")
 

package/src/api/routes/global/configs.js

@@ -1,7 +1,7 @@
 const Router = require("@koa/router")
 const controller = require("../../controllers/global/configs")
-const joiValidator = require("../../../middleware/joi-validator")
-const adminOnly = require("../../../middleware/adminOnly")
+const { joiValidator } = require("@budibase/backend-core/auth")
+const { adminOnly } = require("@budibase/backend-core/auth")
 const Joi = require("joi")
 const { Configs } = require("../../../constants")
 
@@ -65,6 +65,8 @@ function buildConfigSaveValidation() {
     _rev: Joi.string().optional(),
     workspace: Joi.string().optional(),
     type: Joi.string().valid(...Object.values(Configs)).required(),
+    createdAt: Joi.string().optional(),
+    updatedAt: Joi.string().optional(),
     config: Joi.alternatives()
       .conditional("type", {
         switch: [
@@ -75,7 +77,7 @@ function buildConfigSaveValidation() {
           { is: Configs.OIDC, then: oidcValidation() }
         ],
       }),
-    }).required().unknown(true),
+  }).required().unknown(true),
   )
 }
 

package/src/api/routes/global/email.js

@@ -1,8 +1,8 @@
 const Router = require("@koa/router")
 const controller = require("../../controllers/global/email")
 const { EmailTemplatePurpose } = require("../../../constants")
-const joiValidator = require("../../../middleware/joi-validator")
-const adminOnly = require("../../../middleware/adminOnly")
+const { joiValidator } = require("@budibase/backend-core/auth")
+const { adminOnly } = require("@budibase/backend-core/auth")
 const Joi = require("joi")
 
 const router = Router()

package/src/api/routes/global/roles.js

@@ -1,6 +1,6 @@
 const Router = require("@koa/router")
 const controller = require("../../controllers/global/roles")
-const adminOnly = require("../../../middleware/adminOnly")
+const { adminOnly } = require("@budibase/backend-core/auth")
 
 const router = Router()
 

package/src/api/routes/global/sessions.js

@@ -1,6 +1,6 @@
 const Router = require("@koa/router")
 const controller = require("../../controllers/global/sessions")
-const adminOnly = require("../../../middleware/adminOnly")
+const { adminOnly } = require("@budibase/backend-core/auth")
 
 const router = Router()
 

package/src/api/routes/global/templates.js

@@ -1,9 +1,9 @@
 const Router = require("@koa/router")
 const controller = require("../../controllers/global/templates")
-const joiValidator = require("../../../middleware/joi-validator")
+const { joiValidator } = require("@budibase/backend-core/auth")
 const Joi = require("joi")
 const { TemplatePurpose, TemplateTypes } = require("../../../constants")
-const adminOnly = require("../../../middleware/adminOnly")
+const { adminOnly } = require("@budibase/backend-core/auth")
 
 const router = Router()
 

package/src/api/routes/global/users.js

@@ -1,7 +1,7 @@
 const Router = require("@koa/router")
 const controller = require("../../controllers/global/users")
-const joiValidator = require("../../../middleware/joi-validator")
-const adminOnly = require("../../../middleware/adminOnly")
+const { joiValidator } = require("@budibase/backend-core/auth")
+const { adminOnly } = require("@budibase/backend-core/auth")
 const Joi = require("joi")
 const cloudRestricted = require("../../../middleware/cloudRestricted")
 const { users } = require("../validation")
@@ -30,6 +30,14 @@ function buildInviteValidation() {
   }).required())
 }
 
+function buildInviteMultipleValidation() {
+  // prettier-ignore
+  return joiValidator.body(Joi.object({
+    emails: Joi.array().required(),
+    userInfo: Joi.object().optional(),
+  }).required())
+}
+
 function buildInviteAcceptValidation() {
   // prettier-ignore
   return joiValidator.body(Joi.object({
@@ -45,9 +53,18 @@ router
     users.buildUserSaveValidation(),
     controller.save
   )
+  .post(
+    "/api/global/users/bulkCreate",
+    adminOnly,
+    users.buildUserBulkSaveValidation(),
+    controller.bulkCreate
+  )
+
   .get("/api/global/users", builderOrAdmin, controller.fetch)
   .post("/api/global/users/search", builderOrAdmin, controller.search)
   .delete("/api/global/users/:id", adminOnly, controller.destroy)
+  .post("/api/global/users/bulkDelete", adminOnly, controller.bulkDelete)
+  .get("/api/global/users/count/:appId", adminOnly, controller.countByApp)
   .get("/api/global/roles/:appId")
   .post(
     "/api/global/users/invite",
@@ -55,6 +72,19 @@ router
     buildInviteValidation(),
     controller.invite
   )
+  .post(
+    "/api/global/users/invite",
+    adminOnly,
+    buildInviteValidation(),
+    controller.invite
+  )
+  .post(
+    "/api/global/users/inviteMultiple",
+    adminOnly,
+    buildInviteMultipleValidation(),
+    controller.inviteMultiple
+  )
+
   // non-global endpoints
   .post(
     "/api/global/users/invite/accept",

package/src/api/routes/global/workspaces.js

@@ -1,7 +1,7 @@
 const Router = require("@koa/router")
 const controller = require("../../controllers/global/workspaces")
-const joiValidator = require("../../../middleware/joi-validator")
-const adminOnly = require("../../../middleware/adminOnly")
+const { joiValidator } = require("@budibase/backend-core/auth")
+const { adminOnly } = require("@budibase/backend-core/auth")
 const Joi = require("joi")
 
 const router = Router()
@@ -17,9 +17,9 @@ function buildWorkspaceSaveValidation() {
     roles: Joi.object({
       default: Joi.string().optional(),
       app: Joi.object()
-      .pattern(/.*/, Joi.string())
-      .required()
-      .unknown(true),
+        .pattern(/.*/, Joi.string())
+        .required()
+        .unknown(true),
     }).unknown(true).optional(),
   }).required().unknown(true))
 }

package/src/api/routes/index.js

@@ -1,3 +1,4 @@
+const { api } = require("@budibase/pro")
 const userRoutes = require("./global/users")
 const configRoutes = require("./global/configs")
 const workspaceRoutes = require("./global/workspaces")
@@ -12,6 +13,7 @@ const statusRoutes = require("./system/status")
 const selfRoutes = require("./global/self")
 const licenseRoutes = require("./global/license")
 
+let userGroupRoutes = api.groups
 exports.routes = [
   configRoutes,
   userRoutes,
@@ -26,4 +28,5 @@ exports.routes = [
   statusRoutes,
   selfRoutes,
   licenseRoutes,
+  userGroupRoutes,
 ]

package/src/api/routes/system/tenants.js

@@ -1,6 +1,6 @@
 const Router = require("@koa/router")
 const controller = require("../../controllers/system/tenants")
-const adminOnly = require("../../../middleware/adminOnly")
+const { adminOnly } = require("@budibase/backend-core/auth")
 
 const router = Router()
 

package/src/api/routes/tests/users.spec.js

@@ -2,7 +2,6 @@ jest.mock("nodemailer")
 const { config, request, mocks, structures } = require("../../../tests")
 const sendMailMock = mocks.email.mock()
 const { events } = require("@budibase/backend-core")
-
 describe("/api/global/users", () => {
 
   beforeAll(async () => {
@@ -24,9 +23,9 @@ describe("/api/global/users", () => {
       .set(config.defaultHeaders())
       .expect("Content-Type", /json/)
       .expect(200)
-    
-      const emailCall = sendMailMock.mock.calls[0][0]
-      // after this URL there should be a code
+
+    const emailCall = sendMailMock.mock.calls[0][0]
+    // after this URL there should be a code
     const parts = emailCall.html.split("http://localhost:10000/builder/invite?code=")
     const code = parts[1].split("\"")[0].split("&")[0]
     return { code, res }
@@ -60,7 +59,7 @@ describe("/api/global/users", () => {
     expect(events.user.inviteAccepted).toBeCalledWith(user)
   })
 
-  const createUser = async (user) => { 
+  const createUser = async (user) => {
     const existing = await config.getUser(user.email)
     if (existing) {
       await deleteUser(existing._id)
@@ -84,14 +83,37 @@ describe("/api/global/users", () => {
     return res.body
   }
 
+
+  const bulkCreateUsers = async (users) => {
+    const res = await request
+      .post(`/api/global/users/bulkCreate`)
+      .send(users)
+      .set(config.defaultHeaders())
+      .expect("Content-Type", /json/)
+      .expect(200)
+    return res.body
+  }
+
+  const bulkDeleteUsers = async (users) => {
+    const res = await request
+      .post(`/api/global/users/bulkDelete`)
+      .send(users)
+      .set(config.defaultHeaders())
+      .expect("Content-Type", /json/)
+      .expect(200)
+    return res.body
+  }
+
+
+
   const deleteUser = async (email) => {
     const user = await config.getUser(email)
     if (user) {
       await request
-      .delete(`/api/global/users/${user._id}`)
-      .set(config.defaultHeaders())
-      .expect("Content-Type", /json/)
-      .expect(200)
+        .delete(`/api/global/users/${user._id}`)
+        .set(config.defaultHeaders())
+        .expect("Content-Type", /json/)
+        .expect(200)
     }
   }
 
@@ -107,10 +129,25 @@ describe("/api/global/users", () => {
       expect(events.user.permissionAdminAssigned).not.toBeCalled()
     })
 
+    it("should be able to bulkCreate users with different permissions", async () => {
+      jest.clearAllMocks()
+      const builder = structures.users.builderUser({ email: "bulkbasic@test.com" })
+      const admin = structures.users.adminUser({ email: "bulkadmin@test.com" })
+      const user = structures.users.user({ email: "bulkuser@test.com" })
+
+      let toCreate = { users: [builder, admin, user], groups: [] }
+      await bulkCreateUsers(toCreate)
+
+      expect(events.user.created).toBeCalledTimes(3)
+      expect(events.user.permissionAdminAssigned).toBeCalledTimes(1)
+      expect(events.user.permissionBuilderAssigned).toBeCalledTimes(1)
+    })
+
+
     it("should be able to create an admin user", async () => {
       jest.clearAllMocks()
       const user = structures.users.adminUser({ email: "admin@test.com" })
-      await createUser(user)      
+      await createUser(user)
 
       expect(events.user.created).toBeCalledTimes(1)
       expect(events.user.updated).not.toBeCalled()
@@ -333,5 +370,21 @@ describe("/api/global/users", () => {
       expect(events.user.permissionBuilderRemoved).toBeCalledTimes(1)
       expect(events.user.permissionAdminRemoved).not.toBeCalled()
     })
+
+    it("should be able to bulk delete users with different permissions", async () => {
+      jest.clearAllMocks()
+      const builder = structures.users.builderUser({ email: "basic@test.com" })
+      const admin = structures.users.adminUser({ email: "admin@test.com" })
+      const user = structures.users.user({ email: "user@test.com" })
+
+      let toCreate = { users: [builder, admin, user], groups: [] }
+      let createdUsers = await bulkCreateUsers(toCreate)
+      await bulkDeleteUsers({ userIds: [createdUsers[0]._id, createdUsers[1]._id, createdUsers[2]._id] })
+      expect(events.user.deleted).toBeCalledTimes(3)
+      expect(events.user.permissionAdminRemoved).toBeCalledTimes(1)
+      expect(events.user.permissionBuilderRemoved).toBeCalledTimes(1)
+
+    })
+
   })
 })

package/src/api/routes/validation/users.ts

@@ -1,22 +1,23 @@
 import joiValidator from "../../../middleware/joi-validator"
 import Joi from "joi"
 
+let schema: any = {
+  email: Joi.string().allow(null, ""),
+  password: Joi.string().allow(null, ""),
+  forceResetPassword: Joi.boolean().optional(),
+  firstName: Joi.string().allow(null, ""),
+  lastName: Joi.string().allow(null, ""),
+  builder: Joi.object({
+    global: Joi.boolean().optional(),
+    apps: Joi.array().optional(),
+  })
+    .unknown(true)
+    .optional(),
+  // maps appId -> roleId for the user
+  roles: Joi.object().pattern(/.*/, Joi.string()).required().unknown(true),
+}
+
 export const buildUserSaveValidation = (isSelf = false) => {
-  let schema: any = {
-    email: Joi.string().allow(null, ""),
-    password: Joi.string().allow(null, ""),
-    forceResetPassword: Joi.boolean().optional(),
-    firstName: Joi.string().allow(null, ""),
-    lastName: Joi.string().allow(null, ""),
-    builder: Joi.object({
-      global: Joi.boolean().optional(),
-      apps: Joi.array().optional(),
-    })
-      .unknown(true)
-      .optional(),
-    // maps appId -> roleId for the user
-    roles: Joi.object().pattern(/.*/, Joi.string()).required().unknown(true),
-  }
   if (!isSelf) {
     schema = {
       ...schema,
@@ -26,3 +27,19 @@ export const buildUserSaveValidation = (isSelf = false) => {
   }
   return joiValidator.body(Joi.object(schema).required().unknown(true))
 }
+
+export const buildUserBulkSaveValidation = (isSelf = false) => {
+  if (!isSelf) {
+    schema = {
+      ...schema,
+      _id: Joi.string(),
+      _rev: Joi.string(),
+    }
+  }
+  let bulkSaveSchema = {
+    groups: Joi.array().optional(),
+    users: Joi.array().items(Joi.object(schema).required().unknown(true)),
+  }
+
+  return joiValidator.body(Joi.object(bulkSaveSchema).required().unknown(true))
+}

package/src/sdk/users/users.ts

@@ -15,7 +15,8 @@ import {
   accounts,
   migrations,
 } from "@budibase/backend-core"
-import { MigrationType } from "@budibase/types"
+import { MigrationType, User } from "@budibase/types"
+import { groups as groupUtils } from "@budibase/pro"
 
 const PAGE_LIMIT = 8
 
@@ -29,10 +30,18 @@ export const allUsers = async () => {
   return response.rows.map((row: any) => row.doc)
 }
 
+export const countUsersByApp = async (appId: string) => {
+  let response: any = await usersCore.searchGlobalUsersByApp(appId, {})
+  return {
+    userCount: response.length,
+  }
+}
+
 export const paginatedUsers = async ({
   page,
-  search,
-}: { page?: string; search?: string } = {}) => {
+  email,
+  appId,
+}: { page?: string; email?: string; appId?: string } = {}) => {
   const db = tenancy.getGlobalDB()
   // get one extra document, to have the next page
   const opts: any = {
@@ -44,19 +53,24 @@ export const paginatedUsers = async ({
     opts.startkey = page
   }
   // property specifies what to use for the page/anchor
-  let userList, property
-  // no search, query allDocs
-  if (!search) {
+  let userList,
+    property = "_id",
+    getKey
+  if (appId) {
+    userList = await usersCore.searchGlobalUsersByApp(appId, opts)
+    getKey = (doc: any) => usersCore.getGlobalUserByAppPage(appId, doc)
+  } else if (email) {
+    userList = await usersCore.searchGlobalUsersByEmail(email, opts)
+    property = "email"
+  } else {
+    // no search, query allDocs
     const response = await db.allDocs(dbUtils.getGlobalUserParams(null, opts))
     userList = response.rows.map((row: any) => row.doc)
-    property = "_id"
-  } else {
-    userList = await usersCore.searchGlobalUsersByEmail(search, opts)
-    property = "email"
   }
   return dbUtils.pagination(userList, PAGE_LIMIT, {
     paginate: true,
     property,
+    getKey,
   })
 }
 
@@ -87,6 +101,49 @@ interface SaveUserOpts {
   bulkCreate?: boolean
 }
 
+export const buildUser = async (
+  user: any,
+  opts: SaveUserOpts = {
+    hashPassword: true,
+    requirePassword: true,
+    bulkCreate: false,
+  },
+  tenantId: string,
+  dbUser?: any
+) => {
+  let { password, _id } = user
+
+  let hashedPassword
+  if (password) {
+    hashedPassword = opts.hashPassword ? await utils.hash(password) : password
+  } else if (dbUser) {
+    hashedPassword = dbUser.password
+  } else if (opts.requirePassword) {
+    throw "Password must be specified."
+  }
+
+  _id = _id || dbUtils.generateGlobalUserID()
+
+  user = {
+    createdAt: Date.now(),
+    ...dbUser,
+    ...user,
+    _id,
+    password: hashedPassword,
+    tenantId,
+  }
+  // make sure the roles object is always present
+  if (!user.roles) {
+    user.roles = {}
+  }
+  // add the active status to a user if its not provided
+  if (user.status == null) {
+    user.status = constants.UserStatus.ACTIVE
+  }
+
+  return user
+}
+
 export const save = async (
   user: any,
   opts: SaveUserOpts = {
@@ -97,7 +154,7 @@ export const save = async (
 ) => {
   const tenantId = tenancy.getTenantId()
   const db = tenancy.getGlobalDB()
-  let { email, password, _id } = user
+  let { email, _id } = user
   // make sure another user isn't using the same email
   let dbUser: any
   if (opts.bulkCreate) {
@@ -128,36 +185,19 @@ export const save = async (
     dbUser = await db.get(_id)
   }
 
-  // get the password, make sure one is defined
-  let hashedPassword
-  if (password) {
-    hashedPassword = opts.hashPassword ? await utils.hash(password) : password
-  } else if (dbUser) {
-    hashedPassword = dbUser.password
-  } else if (opts.requirePassword) {
-    throw "Password must be specified."
-  }
-
-  _id = _id || dbUtils.generateGlobalUserID()
-  user = {
-    createdAt: Date.now(),
-    ...dbUser,
-    ...user,
-    _id,
-    password: hashedPassword,
+  let builtUser = await buildUser(
+    user,
+    {
+      hashPassword: true,
+      requirePassword: user.requirePassword,
+    },
     tenantId,
-  }
-  // make sure the roles object is always present
-  if (!user.roles) {
-    user.roles = {}
-  }
-  // add the active status to a user if its not provided
-  if (user.status == null) {
-    user.status = constants.UserStatus.ACTIVE
-  }
+    dbUser
+  )
+
   try {
     const putOpts = {
-      password: hashedPassword,
+      password: builtUser.password,
       ...user,
     }
     if (opts.bulkCreate) {
@@ -166,28 +206,21 @@ export const save = async (
     // save the user to db
     let response
     const putUserFn = () => {
-      return db.put(user)
+      return db.put(builtUser)
     }
-    if (eventHelpers.isAddingBuilder(user, dbUser)) {
+
+    if (eventHelpers.isAddingBuilder(builtUser, dbUser)) {
       response = await quotas.addDeveloper(putUserFn)
     } else {
       response = await putUserFn()
     }
-    user._rev = response.rev
-
-    await eventHelpers.handleSaveEvents(user, dbUser)
+    builtUser._rev = response.rev
 
-    if (env.MULTI_TENANCY) {
-      const afterCreateTenant = () =>
-        migrations.backPopulateMigrations({
-          type: MigrationType.GLOBAL,
-          tenantId,
-        })
-      await tenancy.tryAddTenant(tenantId, _id, email, afterCreateTenant)
-    }
+    await eventHelpers.handleSaveEvents(builtUser, dbUser)
+    await addTenant(tenantId, _id, email)
     await cache.user.invalidateUser(response.id)
     // let server know to sync user
-    await apps.syncUserInApps(user._id)
+    await apps.syncUserInApps(builtUser._id)
 
     return {
       _id: response.id,
@@ -203,9 +236,143 @@ export const save = async (
   }
 }
 
+export const addTenant = async (
+  tenantId: string,
+  _id: string,
+  email: string
+) => {
+  if (env.MULTI_TENANCY) {
+    const afterCreateTenant = () =>
+      migrations.backPopulateMigrations({
+        type: MigrationType.GLOBAL,
+        tenantId,
+      })
+    await tenancy.tryAddTenant(tenantId, _id, email, afterCreateTenant)
+  }
+}
+
+export const bulkCreate = async (
+  newUsersRequested: User[],
+  groups: string[]
+) => {
+  const db = tenancy.getGlobalDB()
+  const tenantId = tenancy.getTenantId()
+
+  let usersToSave: any[] = []
+  let newUsers: any[] = []
+
+  const allUsers = await db.allDocs(
+    dbUtils.getGlobalUserParams(null, {
+      include_docs: true,
+    })
+  )
+  let mapped = allUsers.rows.map((row: any) => row.id)
+
+  const currentUserEmails = mapped.map((x: any) => x.email) || []
+  for (const newUser of newUsersRequested) {
+    if (
+      newUsers.find((x: any) => x.email === newUser.email) ||
+      currentUserEmails.includes(newUser.email)
+    ) {
+      continue
+    }
+    newUser.userGroups = groups
+    newUsers.push(newUser)
+  }
+
+  // Figure out how many builders we are adding and create the promises
+  // array that will be called by bulkDocs
+  let builderCount = 0
+  newUsers.forEach((user: any) => {
+    if (eventHelpers.isAddingBuilder(user, null)) {
+      builderCount++
+    }
+    usersToSave.push(
+      buildUser(
+        user,
+        {
+          hashPassword: true,
+          requirePassword: user.requirePassword,
+          bulkCreate: false,
+        },
+        tenantId
+      )
+    )
+  })
+
+  const usersToBulkSave = await Promise.all(usersToSave)
+  await quotas.addDevelopers(() => db.bulkDocs(usersToBulkSave), builderCount)
+
+  // Post processing of bulk added users, i.e events and cache operations
+  for (const user of usersToBulkSave) {
+    await eventHelpers.handleSaveEvents(user, null)
+    await apps.syncUserInApps(user._id)
+  }
+
+  return usersToBulkSave.map(user => {
+    return {
+      _id: user._id,
+      email: user.email,
+    }
+  })
+}
+
+export const bulkDelete = async (userIds: any) => {
+  const db = tenancy.getGlobalDB()
+
+  let groupsToModify: any = {}
+  let builderCount = 0
+  // Get users and delete
+  let usersToDelete = (
+    await db.allDocs({
+      include_docs: true,
+      keys: userIds,
+    })
+  ).rows.map((user: any) => {
+    // if we find a user that has an associated group, add it to
+    // an array so we can easily use allDocs on them later.
+    // This prevents us having to re-loop over all the users
+    if (user.doc.userGroups) {
+      for (let groupId of user.doc.userGroups) {
+        if (!Object.keys(groupsToModify).includes(groupId)) {
+          groupsToModify[groupId] = [user.id]
+        } else {
+          groupsToModify[groupId] = [...groupsToModify[groupId], user.id]
+        }
+      }
+    }
+
+    // Also figure out how many builders are being deleted
+    if (eventHelpers.isAddingBuilder(user.doc, null)) {
+      builderCount++
+    }
+
+    return user.doc
+  })
+
+  const response = await db.bulkDocs(
+    usersToDelete.map((user: any) => ({
+      ...user,
+      _deleted: true,
+    }))
+  )
+
+  await groupUtils.bulkDeleteGroupUsers(groupsToModify)
+
+  //Deletion post processing
+  for (let user of usersToDelete) {
+    await bulkDeleteProcessing(user)
+  }
+
+  await quotas.removeDevelopers(builderCount)
+
+  return response
+}
+
 export const destroy = async (id: string, currentUser: any) => {
   const db = tenancy.getGlobalDB()
   const dbUser = await db.get(id)
+  let groups = dbUser.userGroups
 
   if (!env.SELF_HOSTED && !env.DISABLE_ACCOUNT_PORTAL) {
     // root account holder can't be deleted from inside budibase
@@ -221,7 +388,13 @@ export const destroy = async (id: string, currentUser: any) => {
   }
 
   await deprovisioning.removeUserFromInfoDB(dbUser)
+
   await db.remove(dbUser._id, dbUser._rev)
+
+  if (groups) {
+    await groupUtils.deleteGroupUsers(groups, dbUser)
+  }
+
   await eventHelpers.handleDeleteEvents(dbUser)
   await quotas.removeUser(dbUser)
   await cache.user.invalidateUser(dbUser._id)
@@ -229,3 +402,12 @@ export const destroy = async (id: string, currentUser: any) => {
   // let server know to sync user
   await apps.syncUserInApps(dbUser._id)
 }
+
+const bulkDeleteProcessing = async (dbUser: User) => {
+  await deprovisioning.removeUserFromInfoDB(dbUser)
+  await eventHelpers.handleDeleteEvents(dbUser)
+  await cache.user.invalidateUser(dbUser._id)
+  await sessions.invalidateSessions(dbUser._id)
+  // let server know to sync user
+  await apps.syncUserInApps(dbUser._id)
+}

package/src/tests/TestConfiguration.js

@@ -11,7 +11,7 @@ const { createASession } = require("@budibase/backend-core/sessions")
 const { TENANT_ID, CSRF_TOKEN } = require("./structures")
 const structures = require("./structures")
 const { doInTenant } = require("@budibase/backend-core/tenancy")
-
+const { groups } = require("@budibase/pro")
 class TestConfiguration {
   constructor(openServer = true) {
     if (openServer) {
@@ -116,6 +116,22 @@ class TestConfiguration {
     })
   }
 
+  async getGroup(id) {
+    return doInTenant(TENANT_ID, () => {
+      return groups.get(id)
+    })
+  }
+
+  async saveGroup(group) {
+    const res = await this.getRequest()
+      .post(`/api/global/groups`)
+      .send(group)
+      .set(this.defaultHeaders())
+      .expect("Content-Type", /json/)
+      .expect(200)
+    return res.body
+  }
+
   async createUser(email, password) {
     const user = await this.getUser(structures.users.email)
     if (user) {

package/src/tests/structures/groups.ts

@@ -0,0 +1,11 @@
+export const UserGroup = () => {
+  let group = {
+    apps: [],
+    color: "var(--spectrum-global-color-blue-600)",
+    icon: "UserGroup",
+    name: "New group",
+    roles: {},
+    users: [],
+  }
+  return group
+}

package/src/tests/structures/index.js

@@ -1,5 +1,6 @@
 const configs = require("./configs")
 const users = require("./users")
+const groups = require("./groups")
 
 const TENANT_ID = "default"
 const CSRF_TOKEN = "e3727778-7af0-4226-b5eb-f43cbe60a306"
@@ -9,4 +10,5 @@ module.exports = {
   users,
   TENANT_ID,
   CSRF_TOKEN,
+  groups,
 }

package/src/utilities/email.js

@@ -185,14 +185,20 @@ exports.sendEmail = async (
   // if there is a link code needed this will retrieve it
   const code = await getLinkCode(purpose, email, user, info)
   const context = await getSettingsTemplateContext(purpose, code)
-  const message = {
+
+  let message = {
     from: from || config.from,
-    to: email,
     html: await buildEmail(purpose, email, context, {
       user,
       contents,
     }),
   }
+
+  message = {
+    ...message,
+    to: email,
+  }
+
   if (subject || config.subject) {
     message.subject = await processString(subject || config.subject, context)
   }