@budibase/worker 1.2.57 → 1.2.58-alpha.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/worker",
   "email": "hi@budibase.com",
-  "version": "1.2.57",
+  "version": "1.2.58-alpha.2",
   "description": "Budibase background service",
   "main": "src/index.ts",
   "repository": {
@@ -35,10 +35,10 @@
   "author": "Budibase",
   "license": "GPL-3.0",
   "dependencies": {
-    "@budibase/backend-core": "^1.2.57",
-    "@budibase/pro": "1.2.56",
-    "@budibase/string-templates": "^1.2.57",
-    "@budibase/types": "^1.2.57",
+    "@budibase/backend-core": "1.2.58-alpha.2",
+    "@budibase/pro": "1.2.58-alpha.1",
+    "@budibase/string-templates": "1.2.58-alpha.2",
+    "@budibase/types": "1.2.58-alpha.2",
     "@koa/router": "8.0.8",
     "@sentry/node": "6.17.7",
     "@techpass/passport-openidconnect": "0.3.2",
@@ -74,6 +74,7 @@
     "@types/koa-router": "7.4.4",
     "@types/koa__router": "8.0.11",
     "@types/node": "14.18.20",
+    "@types/uuid": "8.3.4",
     "@typescript-eslint/parser": "5.12.0",
     "copyfiles": "2.4.1",
     "eslint": "6.8.0",
@@ -102,5 +103,5 @@
       "./scripts/jestSetup.js"
     ]
   },
-  "gitHead": "605b91baf8bed0f1ffbb2d3304d4525c866bdd77"
+  "gitHead": "675fdd4b88456e4a663f8e2efb148556e0a35aab"
 }

package/scripts/jestSetup.js

@@ -14,3 +14,9 @@ const tk = require("timekeeper")
 tk.freeze(mocks.date.MOCK_DATE)
 
 global.console.log = jest.fn() // console.log are ignored in tests
+
+if (!process.env.CI) {
+  // set a longer timeout in dev for debugging
+  // 100 seconds
+  jest.setTimeout(100000)
+}

package/src/api/controllers/global/auth.ts

@@ -227,9 +227,22 @@ export const oidcPreAuth = async (ctx: any, next: any) => {
 
   setCookie(ctx, configId, Cookies.OIDC_CONFIG)
 
+  const db = getGlobalDB()
+  const config = await core.db.getScopedConfig(db, {
+    type: Configs.OIDC,
+    group: ctx.query.group,
+  })
+
+  const chosenConfig = config.configs.filter((c: any) => c.uuid === configId)[0]
+
+  let authScopes =
+    chosenConfig.scopes?.length > 0
+      ? chosenConfig.scopes
+      : ["profile", "email", "offline_access"]
+
   return passport.authenticate(strategy, {
     // required 'openid' scope is added by oidc strategy factory
-    scope: ["profile", "email", "offline_access"], //auth0 offline_access scope required for the refresh token behaviour.
+    scope: authScopes,
   })(ctx, next)
 }
 

package/src/api/controllers/global/users.ts

@@ -3,7 +3,7 @@ import { checkInviteCode } from "../../../utilities/redis"
 import { sendEmail } from "../../../utilities/email"
 import { users } from "../../../sdk"
 import env from "../../../environment"
-import { CloudAccount, User } from "@budibase/types"
+import { BulkDeleteUsersRequest, CloudAccount, User } from "@budibase/types"
 import {
   accounts,
   cache,
@@ -46,8 +46,8 @@ export const bulkCreate = async (ctx: any) => {
   }
 
   try {
-    let response = await users.bulkCreate(newUsersRequested, groups)
-    await groupUtils.bulkSaveGroupUsers(groupsToSave, response)
+    const response = await users.bulkCreate(newUsersRequested, groups)
+    await groupUtils.bulkSaveGroupUsers(groupsToSave, response.successful)
 
     ctx.body = response
   } catch (err: any) {
@@ -138,17 +138,15 @@ export const destroy = async (ctx: any) => {
 }
 
 export const bulkDelete = async (ctx: any) => {
-  const { userIds } = ctx.request.body
+  const { userIds } = ctx.request.body as BulkDeleteUsersRequest
   if (userIds?.indexOf(ctx.user._id) !== -1) {
     ctx.throw(400, "Unable to delete self.")
   }
 
   try {
-    let usersResponse = await users.bulkDelete(userIds)
+    let response = await users.bulkDelete(userIds)
 
-    ctx.body = {
-      message: `${usersResponse.length} user(s) deleted`,
-    }
+    ctx.body = response
   } catch (err) {
     ctx.throw(err)
   }

package/src/api/controllers/system/accounts.ts

@@ -0,0 +1,21 @@
+import { Account, AccountMetadata } from "@budibase/types"
+import { accounts } from "../../../sdk"
+
+export const save = async (ctx: any) => {
+  const account = ctx.request.body as Account
+  let metadata: AccountMetadata = {
+    _id: accounts.formatAccountMetadataId(account.accountId),
+    email: account.email,
+  }
+
+  metadata = await accounts.saveMetadata(metadata)
+
+  ctx.body = metadata
+  ctx.status = 200
+}
+
+export const destroy = async (ctx: any) => {
+  const accountId = accounts.formatAccountMetadataId(ctx.params.accountId)
+  await accounts.destroyMetadata(accountId)
+  ctx.status = 204
+}

package/src/api/{index.js → index.ts}

@@ -1,15 +1,10 @@
-const Router = require("@koa/router")
+import Router from "@koa/router"
 const compress = require("koa-compress")
 const zlib = require("zlib")
-const { routes } = require("./routes")
-const {
-  buildAuthMiddleware,
-  auditLog,
-  buildTenancyMiddleware,
-  buildCsrfMiddleware,
-} = require("@budibase/backend-core/auth")
-const { middleware: pro } = require("@budibase/pro")
-const { errors } = require("@budibase/backend-core")
+import { routes } from "./routes"
+import { middleware as pro } from "@budibase/pro"
+import { errors, auth, middleware } from "@budibase/backend-core"
+import { APIError } from "@budibase/types"
 
 const PUBLIC_ENDPOINTS = [
   // old deprecated endpoints kept for backwards compat
@@ -97,9 +92,9 @@ router
     })
   )
   .use("/health", ctx => (ctx.status = 200))
-  .use(buildAuthMiddleware(PUBLIC_ENDPOINTS))
-  .use(buildTenancyMiddleware(PUBLIC_ENDPOINTS, NO_TENANCY_ENDPOINTS))
-  .use(buildCsrfMiddleware({ noCsrfPatterns: NO_CSRF_ENDPOINTS }))
+  .use(auth.buildAuthMiddleware(PUBLIC_ENDPOINTS))
+  .use(auth.buildTenancyMiddleware(PUBLIC_ENDPOINTS, NO_TENANCY_ENDPOINTS))
+  .use(auth.buildCsrfMiddleware({ noCsrfPatterns: NO_CSRF_ENDPOINTS }))
   .use(pro.licensing())
   // for now no public access is allowed to worker (bar health check)
   .use((ctx, next) => {
@@ -114,21 +109,22 @@ router
     }
     return next()
   })
-  .use(auditLog)
+  .use(middleware.auditLog)
 
 // error handling middleware - TODO: This could be moved to backend-core
 router.use(async (ctx, next) => {
   try {
     await next()
-  } catch (err) {
+  } catch (err: any) {
     ctx.log.error(err)
     ctx.status = err.status || err.statusCode || 500
     const error = errors.getPublicError(err)
-    ctx.body = {
+    const body: APIError = {
       message: err.message,
       status: ctx.status,
       error,
     }
+    ctx.body = body
   }
 })
 

package/src/api/routes/global/configs.js

@@ -53,6 +53,7 @@ function oidcValidation() {
         name: Joi.string().allow("", null),
         uuid: Joi.string().required(),
         activated: Joi.boolean().required(),
+        scopes: Joi.array().optional()
       })
     ).required(true)
   }).unknown(true)

package/src/api/routes/{tests/auth.spec.js → global/tests/auth.spec.ts}

@@ -1,11 +1,11 @@
 jest.mock("nodemailer")
-const { config, request, mocks, structures } = require("../../../tests")
+import { TestConfiguration, mocks, API } from "../../../../tests"
 const sendMailMock = mocks.email.mock()
-const { events } = require("@budibase/backend-core")
-
-const TENANT_ID = structures.TENANT_ID
+import { events } from "@budibase/backend-core"
 
 describe("/api/global/auth", () => {
+  const config = new TestConfiguration()
+  const api = new API(config)
 
   beforeAll(async () => {
     await config.beforeAll()
@@ -19,56 +19,32 @@ describe("/api/global/auth", () => {
     jest.clearAllMocks()
   })
 
-  const requestPasswordReset = async () => {
-    await config.saveSmtpConfig()
-    await config.saveSettingsConfig()
-    await config.createUser()
-    const res = await request
-      .post(`/api/global/auth/${TENANT_ID}/reset`)
-      .send({
-        email: "test@test.com",
-      })
-      .expect("Content-Type", /json/)
-      .expect(200)
-    const emailCall = sendMailMock.mock.calls[0][0]
-    const parts = emailCall.html.split(`http://localhost:10000/builder/auth/reset?code=`)
-    const code = parts[1].split("\"")[0].split("&")[0]
-    return { code, res }
-  }
-
   it("should logout", async () => {
-    await request
-      .post("/api/global/auth/logout")
-      .set(config.defaultHeaders())
-      .expect(200)
+    await api.auth.logout()
     expect(events.auth.logout).toBeCalledTimes(1)
   })
 
   it("should be able to generate password reset email", async () => {
-    const { res, code } = await requestPasswordReset()
+    const { res, code } = await api.auth.requestPasswordReset(sendMailMock)
     const user = await config.getUser("test@test.com")
 
-    expect(res.body).toEqual({ message: "Please check your email for a reset link." })
+    expect(res.body).toEqual({
+      message: "Please check your email for a reset link.",
+    })
     expect(sendMailMock).toHaveBeenCalled()
-    
+
     expect(code).toBeDefined()
     expect(events.user.passwordResetRequested).toBeCalledTimes(1)
     expect(events.user.passwordResetRequested).toBeCalledWith(user)
   })
 
   it("should allow resetting user password with code", async () => {
-    const { code } = await requestPasswordReset()
+    const { code } = await api.auth.requestPasswordReset(sendMailMock)
     const user = await config.getUser("test@test.com")
-    delete user.password 
+    delete user.password
+
+    const res = await api.auth.updatePassword(code)
 
-    const res = await request
-      .post(`/api/global/auth/${TENANT_ID}/reset/update`)
-      .send({
-        password: "newpassword",
-        resetCode: code,
-      })
-      .expect("Content-Type", /json/)
-      .expect(200)
     expect(res.body).toEqual({ message: "password reset successfully." })
     expect(events.user.passwordReset).toBeCalledTimes(1)
     expect(events.user.passwordReset).toBeCalledWith(user)
@@ -79,15 +55,15 @@ describe("/api/global/auth", () => {
 
     const passportSpy = jest.spyOn(auth.passport, "authenticate")
     let oidcConf
-    let chosenConfig
-    let configId
+    let chosenConfig: any
+    let configId: string
 
     // mock the oidc strategy implementation and return value
     let strategyFactory = jest.fn()
     let mockStrategyReturn = jest.fn()
     let mockStrategyConfig = jest.fn()
     auth.oidc.fetchStrategyConfig = mockStrategyConfig
-    
+
     strategyFactory.mockReturnValue(mockStrategyReturn)
     auth.oidc.strategyFactory = strategyFactory
 
@@ -99,34 +75,34 @@ describe("/api/global/auth", () => {
     })
 
     afterEach(() => {
-      expect(strategyFactory).toBeCalledWith(
-        chosenConfig, 
-        expect.any(Function)
-      )
+      expect(strategyFactory).toBeCalledWith(chosenConfig, expect.any(Function))
     })
 
     describe("oidc configs", () => {
       it("should load strategy and delegate to passport", async () => {
-        await request.get(`/api/global/auth/${TENANT_ID}/oidc/configs/${configId}`)
+        await api.configs.getOIDCConfig(configId)
 
         expect(passportSpy).toBeCalledWith(mockStrategyReturn, {
-          scope: ["profile", "email", "offline_access"]
+          scope: ["profile", "email", "offline_access"],
         })
-        expect(passportSpy.mock.calls.length).toBe(1);
+        expect(passportSpy.mock.calls.length).toBe(1)
       })
     })
 
     describe("oidc callback", () => {
       it("should load strategy and delegate to passport", async () => {
-        await request.get(`/api/global/auth/${TENANT_ID}/oidc/callback`)
-                     .set(config.getOIDConfigCookie(configId))
-      
-        expect(passportSpy).toBeCalledWith(mockStrategyReturn, {
-          successRedirect: "/", failureRedirect: "/error" 
-        }, expect.anything())
-        expect(passportSpy.mock.calls.length).toBe(1);
+        await api.configs.OIDCCallback(configId)
+
+        expect(passportSpy).toBeCalledWith(
+          mockStrategyReturn,
+          {
+            successRedirect: "/",
+            failureRedirect: "/error",
+          },
+          expect.anything()
+        )
+        expect(passportSpy.mock.calls.length).toBe(1)
       })
     })
-
   })
 })

package/src/api/routes/{tests/configs.spec.js → global/tests/configs.spec.ts}

@@ -1,11 +1,12 @@
 // mock the email system
 jest.mock("nodemailer")
-const { config, structures, mocks, request } = require("../../../tests")
+import { TestConfiguration, structures, mocks, API } from "../../../../tests"
 mocks.email.mock()
-const { Configs } = require("@budibase/backend-core/constants")
-const { events } = require("@budibase/backend-core")
+import { Configs, events } from "@budibase/backend-core"
 
 describe("configs", () => {
+  const config = new TestConfiguration()
+  const api = new API(config)
 
   beforeAll(async () => {
     await config.beforeAll()
@@ -20,35 +21,33 @@ describe("configs", () => {
   })
 
   describe("post /api/global/configs", () => {
-
-    const saveConfig = async (conf, _id, _rev) => {
+    const saveConfig = async (conf: any, _id?: string, _rev?: string) => {
       const data = {
         ...conf,
         _id,
-        _rev
+        _rev,
       }
 
-      const res = await request
-        .post(`/api/global/configs`)
-        .send(data)
-        .set(config.defaultHeaders())
-        .expect("Content-Type", /json/)
-        .expect(200)
+      const res = await api.configs.saveConfig(data)
 
       return {
         ...data,
-        ...res.body
+        ...res.body,
       }
     }
 
     describe("google", () => {
-      const saveGoogleConfig = async (conf, _id, _rev) => {
+      const saveGoogleConfig = async (
+        conf?: any,
+        _id?: string,
+        _rev?: string
+      ) => {
         const googleConfig = structures.configs.google(conf)
         return saveConfig(googleConfig, _id, _rev)
       }
-  
+
       describe("create", () => {
-        it ("should create activated google config", async () => {
+        it("should create activated google config", async () => {
           await saveGoogleConfig()
           expect(events.auth.SSOCreated).toBeCalledTimes(1)
           expect(events.auth.SSOCreated).toBeCalledWith(Configs.GOOGLE)
@@ -58,7 +57,7 @@ describe("configs", () => {
           await config.deleteConfig(Configs.GOOGLE)
         })
 
-        it ("should create deactivated google config", async () => {
+        it("should create deactivated google config", async () => {
           await saveGoogleConfig({ activated: false })
           expect(events.auth.SSOCreated).toBeCalledTimes(1)
           expect(events.auth.SSOCreated).toBeCalledWith(Configs.GOOGLE)
@@ -69,10 +68,14 @@ describe("configs", () => {
       })
 
       describe("update", () => {
-        it ("should update google config to deactivated", async () => {
+        it("should update google config to deactivated", async () => {
           const googleConf = await saveGoogleConfig()
           jest.clearAllMocks()
-          await saveGoogleConfig({ ...googleConf.config, activated: false }, googleConf._id, googleConf._rev)
+          await saveGoogleConfig(
+            { ...googleConf.config, activated: false },
+            googleConf._id,
+            googleConf._rev
+          )
           expect(events.auth.SSOUpdated).toBeCalledTimes(1)
           expect(events.auth.SSOUpdated).toBeCalledWith(Configs.GOOGLE)
           expect(events.auth.SSOActivated).not.toBeCalled()
@@ -81,10 +84,14 @@ describe("configs", () => {
           await config.deleteConfig(Configs.GOOGLE)
         })
 
-        it ("should update google config to activated", async () => {
+        it("should update google config to activated", async () => {
           const googleConf = await saveGoogleConfig({ activated: false })
           jest.clearAllMocks()
-          await saveGoogleConfig({ ...googleConf.config, activated: true}, googleConf._id, googleConf._rev)
+          await saveGoogleConfig(
+            { ...googleConf.config, activated: true },
+            googleConf._id,
+            googleConf._rev
+          )
           expect(events.auth.SSOUpdated).toBeCalledTimes(1)
           expect(events.auth.SSOUpdated).toBeCalledWith(Configs.GOOGLE)
           expect(events.auth.SSODeactivated).not.toBeCalled()
@@ -92,17 +99,21 @@ describe("configs", () => {
           expect(events.auth.SSOActivated).toBeCalledWith(Configs.GOOGLE)
           await config.deleteConfig(Configs.GOOGLE)
         })
-      })     
+      })
     })
 
     describe("oidc", () => {
-      const saveOIDCConfig = async (conf, _id, _rev) => {
+      const saveOIDCConfig = async (
+        conf?: any,
+        _id?: string,
+        _rev?: string
+      ) => {
         const oidcConfig = structures.configs.oidc(conf)
         return saveConfig(oidcConfig, _id, _rev)
       }
 
       describe("create", () => {
-        it ("should create activated OIDC config", async () => {
+        it("should create activated OIDC config", async () => {
           await saveOIDCConfig()
           expect(events.auth.SSOCreated).toBeCalledTimes(1)
           expect(events.auth.SSOCreated).toBeCalledWith(Configs.OIDC)
@@ -112,7 +123,7 @@ describe("configs", () => {
           await config.deleteConfig(Configs.OIDC)
         })
 
-        it ("should create deactivated OIDC config", async () => {
+        it("should create deactivated OIDC config", async () => {
           await saveOIDCConfig({ activated: false })
           expect(events.auth.SSOCreated).toBeCalledTimes(1)
           expect(events.auth.SSOCreated).toBeCalledWith(Configs.OIDC)
@@ -123,10 +134,14 @@ describe("configs", () => {
       })
 
       describe("update", () => {
-        it ("should update OIDC config to deactivated", async () => {
+        it("should update OIDC config to deactivated", async () => {
           const oidcConf = await saveOIDCConfig()
           jest.clearAllMocks()
-          await saveOIDCConfig({ ...oidcConf.config.configs[0], activated: false }, oidcConf._id, oidcConf._rev)
+          await saveOIDCConfig(
+            { ...oidcConf.config.configs[0], activated: false },
+            oidcConf._id,
+            oidcConf._rev
+          )
           expect(events.auth.SSOUpdated).toBeCalledTimes(1)
           expect(events.auth.SSOUpdated).toBeCalledWith(Configs.OIDC)
           expect(events.auth.SSOActivated).not.toBeCalled()
@@ -135,10 +150,14 @@ describe("configs", () => {
           await config.deleteConfig(Configs.OIDC)
         })
 
-        it ("should update OIDC config to activated", async () => {
+        it("should update OIDC config to activated", async () => {
           const oidcConf = await saveOIDCConfig({ activated: false })
           jest.clearAllMocks()
-          await saveOIDCConfig({ ...oidcConf.config.configs[0], activated: true}, oidcConf._id, oidcConf._rev)
+          await saveOIDCConfig(
+            { ...oidcConf.config.configs[0], activated: true },
+            oidcConf._id,
+            oidcConf._rev
+          )
           expect(events.auth.SSOUpdated).toBeCalledTimes(1)
           expect(events.auth.SSOUpdated).toBeCalledWith(Configs.OIDC)
           expect(events.auth.SSODeactivated).not.toBeCalled()
@@ -147,17 +166,20 @@ describe("configs", () => {
           await config.deleteConfig(Configs.OIDC)
         })
       })
-
     })
 
     describe("smtp", () => {
-      const saveSMTPConfig = async (conf, _id, _rev) => {
+      const saveSMTPConfig = async (
+        conf?: any,
+        _id?: string,
+        _rev?: string
+      ) => {
         const smtpConfig = structures.configs.smtp(conf)
         return saveConfig(smtpConfig, _id, _rev)
       }
 
       describe("create", () => {
-        it ("should create SMTP config", async () => {
+        it("should create SMTP config", async () => {
           await config.deleteConfig(Configs.SMTP)
           await saveSMTPConfig()
           expect(events.email.SMTPUpdated).not.toBeCalled()
@@ -167,7 +189,7 @@ describe("configs", () => {
       })
 
       describe("update", () => {
-        it ("should update SMTP config", async () => {
+        it("should update SMTP config", async () => {
           const smtpConf = await saveSMTPConfig()
           jest.clearAllMocks()
           await saveSMTPConfig(smtpConf.config, smtpConf._id, smtpConf._rev)
@@ -179,15 +201,19 @@ describe("configs", () => {
     })
 
     describe("settings", () => {
-      const saveSettingsConfig = async (conf, _id, _rev) => {
+      const saveSettingsConfig = async (
+        conf?: any,
+        _id?: string,
+        _rev?: string
+      ) => {
         const settingsConfig = structures.configs.settings(conf)
         return saveConfig(settingsConfig, _id, _rev)
       }
 
       describe("create", () => {
-        it ("should create settings config with default settings", async () => {
+        it("should create settings config with default settings", async () => {
           await config.deleteConfig(Configs.SETTINGS)
-          
+
           await saveSettingsConfig()
 
           expect(events.org.nameUpdated).not.toBeCalled()
@@ -195,35 +221,43 @@ describe("configs", () => {
           expect(events.org.platformURLUpdated).not.toBeCalled()
         })
 
-        it ("should create settings config with non-default settings", async () => {
+        it("should create settings config with non-default settings", async () => {
+          config.modeSelf()
           await config.deleteConfig(Configs.SETTINGS)
           const conf = {
             company: "acme",
             logoUrl: "http://example.com",
-            platformUrl: "http://example.com"
+            platformUrl: "http://example.com",
           }
 
           await saveSettingsConfig(conf)
-          
+
           expect(events.org.nameUpdated).toBeCalledTimes(1)
           expect(events.org.logoUpdated).toBeCalledTimes(1)
           expect(events.org.platformURLUpdated).toBeCalledTimes(1)
+          config.modeAccount()
         })
       })
 
       describe("update", () => {
-        it ("should update settings config", async () => {
+        it("should update settings config", async () => {
+          config.modeSelf()
           await config.deleteConfig(Configs.SETTINGS)
           const settingsConfig = await saveSettingsConfig()
           settingsConfig.config.company = "acme"
           settingsConfig.config.logoUrl = "http://example.com"
           settingsConfig.config.platformUrl = "http://example.com"
 
-          await saveSettingsConfig(settingsConfig.config, settingsConfig._id, settingsConfig._rev)
+          await saveSettingsConfig(
+            settingsConfig.config,
+            settingsConfig._id,
+            settingsConfig._rev
+          )
 
           expect(events.org.nameUpdated).toBeCalledTimes(1)
           expect(events.org.logoUpdated).toBeCalledTimes(1)
           expect(events.org.platformURLUpdated).toBeCalledTimes(1)
+          config.modeAccount()
         })
       })
     })
@@ -232,12 +266,7 @@ describe("configs", () => {
   it("should return the correct checklist status based on the state of the budibase installation", async () => {
     await config.saveSmtpConfig()
 
-    const res = await request
-      .get(`/api/global/configs/checklist`)
-      .set(config.defaultHeaders())
-      .expect("Content-Type", /json/)
-      .expect(200)
-
+    const res = await api.configs.getConfigChecklist()
     const checklist = res.body
 
     expect(checklist.apps.checked).toBeFalsy()