@budibase/worker 1.2.58-alpha.6 → 1.2.58

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/worker",
   "email": "hi@budibase.com",
-  "version": "1.2.58-alpha.6",
+  "version": "1.2.58",
   "description": "Budibase background service",
   "main": "src/index.ts",
   "repository": {
@@ -35,10 +35,10 @@
   "author": "Budibase",
   "license": "GPL-3.0",
   "dependencies": {
-    "@budibase/backend-core": "1.2.58-alpha.6",
-    "@budibase/pro": "1.2.58-alpha.5",
-    "@budibase/string-templates": "1.2.58-alpha.6",
-    "@budibase/types": "1.2.58-alpha.6",
+    "@budibase/backend-core": "^1.2.58",
+    "@budibase/pro": "1.2.57",
+    "@budibase/string-templates": "^1.2.58",
+    "@budibase/types": "^1.2.58",
     "@koa/router": "8.0.8",
     "@sentry/node": "6.17.7",
     "@techpass/passport-openidconnect": "0.3.2",
@@ -74,7 +74,6 @@
     "@types/koa-router": "7.4.4",
     "@types/koa__router": "8.0.11",
     "@types/node": "14.18.20",
-    "@types/uuid": "8.3.4",
     "@typescript-eslint/parser": "5.12.0",
     "copyfiles": "2.4.1",
     "eslint": "6.8.0",
@@ -103,5 +102,5 @@
       "./scripts/jestSetup.js"
     ]
   },
-  "gitHead": "6225d7d6a9d66f5675411db8292acadb3d78446f"
+  "gitHead": "2922b47620173f41097d36b9dc5b1c0f8f7b063a"
 }

package/scripts/jestSetup.js

@@ -14,9 +14,3 @@ const tk = require("timekeeper")
 tk.freeze(mocks.date.MOCK_DATE)
 
 global.console.log = jest.fn() // console.log are ignored in tests
-
-if (!process.env.CI) {
-  // set a longer timeout in dev for debugging
-  // 100 seconds
-  jest.setTimeout(100000)
-}

package/scripts/load/users.js

@@ -0,0 +1,97 @@
+// get the JWT secret etc
+require("../../src/environment")
+require("@budibase/backend-core").init()
+const {
+  getProdAppID,
+  generateGlobalUserID,
+} = require("@budibase/backend-core/db")
+const { doInTenant, getGlobalDB } = require("@budibase/backend-core/tenancy")
+const users = require("../../src/sdk/users")
+const { publicApiUserFix } = require("../../src/utilities/users")
+const { hash } = require("@budibase/backend-core/utils")
+
+const USER_LOAD_NUMBER = 10000
+const BATCH_SIZE = 200
+const PASSWORD = "test"
+const TENANT_ID = "default"
+
+const APP_ID = process.argv[2]
+
+const words = [
+  "test",
+  "testing",
+  "budi",
+  "mail",
+  "age",
+  "risk",
+  "load",
+  "uno",
+  "arm",
+  "leg",
+  "pen",
+  "glass",
+  "box",
+  "chicken",
+  "bottle",
+]
+
+if (!APP_ID) {
+  console.error("Must supply app ID as first CLI option!")
+  process.exit(-1)
+}
+
+const WORD_1 = words[Math.floor(Math.random() * words.length)]
+const WORD_2 = words[Math.floor(Math.random() * words.length)]
+let HASHED_PASSWORD
+
+function generateUser(count) {
+  return {
+    _id: generateGlobalUserID(),
+    password: HASHED_PASSWORD,
+    email: `${WORD_1}${count}@${WORD_2}.com`,
+    roles: {
+      [getProdAppID(APP_ID)]: "BASIC",
+    },
+    status: "active",
+    forceResetPassword: false,
+    firstName: "John",
+    lastName: "Smith",
+  }
+}
+
+async function run() {
+  HASHED_PASSWORD = await hash(PASSWORD)
+  return doInTenant(TENANT_ID, async () => {
+    const db = getGlobalDB()
+    for (let i = 0; i < USER_LOAD_NUMBER; i += BATCH_SIZE) {
+      let userSavePromises = []
+      for (let j = 0; j < BATCH_SIZE; j++) {
+        // like the public API
+        const ctx = publicApiUserFix({
+          request: {
+            body: generateUser(i + j),
+          },
+        })
+        userSavePromises.push(
+          users.save(ctx.request.body, {
+            hashPassword: false,
+            requirePassword: true,
+            bulkCreate: true,
+          })
+        )
+      }
+      const allUsers = await Promise.all(userSavePromises)
+      await db.bulkDocs(allUsers)
+      console.log(`${i + BATCH_SIZE} users have been created.`)
+    }
+  })
+}
+
+run()
+  .then(() => {
+    console.log(`Generated ${USER_LOAD_NUMBER} users!`)
+  })
+  .catch(err => {
+    console.error("Failed for reason: ", err)
+    process.exit(-1)
+  })

package/src/api/controllers/global/auth.ts

@@ -227,22 +227,9 @@ export const oidcPreAuth = async (ctx: any, next: any) => {
 
   setCookie(ctx, configId, Cookies.OIDC_CONFIG)
 
-  const db = getGlobalDB()
-  const config = await core.db.getScopedConfig(db, {
-    type: Configs.OIDC,
-    group: ctx.query.group,
-  })
-
-  const chosenConfig = config.configs.filter((c: any) => c.uuid === configId)[0]
-
-  let authScopes =
-    chosenConfig.scopes?.length > 0
-      ? chosenConfig.scopes
-      : ["profile", "email", "offline_access"]
-
   return passport.authenticate(strategy, {
     // required 'openid' scope is added by oidc strategy factory
-    scope: authScopes,
+    scope: ["profile", "email", "offline_access"], //auth0 offline_access scope required for the refresh token behaviour.
   })(ctx, next)
 }
 

package/src/api/controllers/global/users.ts

@@ -1,13 +1,9 @@
+import { EmailTemplatePurpose } from "../../../constants"
 import { checkInviteCode } from "../../../utilities/redis"
+import { sendEmail } from "../../../utilities/email"
 import { users } from "../../../sdk"
 import env from "../../../environment"
-import {
-  BulkDeleteUsersRequest,
-  CloudAccount,
-  InviteUserRequest,
-  InviteUsersRequest,
-  User,
-} from "@budibase/types"
+import { CloudAccount, User } from "@budibase/types"
 import {
   accounts,
   cache,
@@ -50,8 +46,8 @@ export const bulkCreate = async (ctx: any) => {
   }
 
   try {
-    const response = await users.bulkCreate(newUsersRequested, groups)
-    await groupUtils.bulkSaveGroupUsers(groupsToSave, response.successful)
+    let response = await users.bulkCreate(newUsersRequested, groups)
+    await groupUtils.bulkSaveGroupUsers(groupsToSave, response)
 
     ctx.body = response
   } catch (err: any) {
@@ -142,15 +138,17 @@ export const destroy = async (ctx: any) => {
 }
 
 export const bulkDelete = async (ctx: any) => {
-  const { userIds } = ctx.request.body as BulkDeleteUsersRequest
+  const { userIds } = ctx.request.body
   if (userIds?.indexOf(ctx.user._id) !== -1) {
     ctx.throw(400, "Unable to delete self.")
   }
 
   try {
-    let response = await users.bulkDelete(userIds)
+    let usersResponse = await users.bulkDelete(userIds)
 
-    ctx.body = response
+    ctx.body = {
+      message: `${usersResponse.length} user(s) deleted`,
+    }
   } catch (err) {
     ctx.throw(err)
   }
@@ -195,27 +193,58 @@ export const tenantUserLookup = async (ctx: any) => {
 }
 
 export const invite = async (ctx: any) => {
-  const request = ctx.request.body as InviteUserRequest
-  const response = await users.invite([request])
-
-  // explicitly throw for single user invite
-  if (response.unsuccessful.length) {
-    const reason = response.unsuccessful[0].reason
-    if (reason === "Unavailable") {
-      ctx.throw(400, reason)
-    } else {
-      ctx.throw(500, reason)
-    }
+  let { email, userInfo } = ctx.request.body
+  const existing = await usersCore.getGlobalUserByEmail(email)
+  if (existing) {
+    ctx.throw(400, "Email address already in use.")
   }
-
+  if (!userInfo) {
+    userInfo = {}
+  }
+  userInfo.tenantId = tenancy.getTenantId()
+  const opts: any = {
+    subject: "{{ company }} platform invitation",
+    info: userInfo,
+  }
+  await sendEmail(email, EmailTemplatePurpose.INVITATION, opts)
   ctx.body = {
     message: "Invitation has been sent.",
   }
+  await events.user.invited()
 }
 
 export const inviteMultiple = async (ctx: any) => {
-  const request = ctx.request.body as InviteUsersRequest
-  ctx.body = await users.invite(request)
+  let users = ctx.request.body
+  let existing = false
+  let existingEmail
+  for (let user of users) {
+    if (await usersCore.getGlobalUserByEmail(user.email)) {
+      existing = true
+      existingEmail = user.email
+      break
+    }
+  }
+
+  if (existing) {
+    ctx.throw(400, `${existingEmail} already exists`)
+  }
+
+  for (let i = 0; i < users.length; i++) {
+    let userInfo = users[i].userInfo
+    if (!userInfo) {
+      userInfo = {}
+    }
+    userInfo.tenantId = tenancy.getTenantId()
+    const opts: any = {
+      subject: "{{ company }} platform invitation",
+      info: userInfo,
+    }
+    await sendEmail(users[i].email, EmailTemplatePurpose.INVITATION, opts)
+  }
+
+  ctx.body = {
+    message: "Invitations have been sent.",
+  }
 }
 
 export const inviteAccept = async (ctx: any) => {

package/src/api/{index.ts → index.js}

@@ -1,10 +1,15 @@
-import Router from "@koa/router"
+const Router = require("@koa/router")
 const compress = require("koa-compress")
 const zlib = require("zlib")
-import { routes } from "./routes"
-import { middleware as pro } from "@budibase/pro"
-import { errors, auth, middleware } from "@budibase/backend-core"
-import { APIError } from "@budibase/types"
+const { routes } = require("./routes")
+const {
+  buildAuthMiddleware,
+  auditLog,
+  buildTenancyMiddleware,
+  buildCsrfMiddleware,
+} = require("@budibase/backend-core/auth")
+const { middleware: pro } = require("@budibase/pro")
+const { errors } = require("@budibase/backend-core")
 
 const PUBLIC_ENDPOINTS = [
   // old deprecated endpoints kept for backwards compat
@@ -92,9 +97,9 @@ router
     })
   )
   .use("/health", ctx => (ctx.status = 200))
-  .use(auth.buildAuthMiddleware(PUBLIC_ENDPOINTS))
-  .use(auth.buildTenancyMiddleware(PUBLIC_ENDPOINTS, NO_TENANCY_ENDPOINTS))
-  .use(auth.buildCsrfMiddleware({ noCsrfPatterns: NO_CSRF_ENDPOINTS }))
+  .use(buildAuthMiddleware(PUBLIC_ENDPOINTS))
+  .use(buildTenancyMiddleware(PUBLIC_ENDPOINTS, NO_TENANCY_ENDPOINTS))
+  .use(buildCsrfMiddleware({ noCsrfPatterns: NO_CSRF_ENDPOINTS }))
   .use(pro.licensing())
   // for now no public access is allowed to worker (bar health check)
   .use((ctx, next) => {
@@ -109,22 +114,21 @@ router
     }
     return next()
   })
-  .use(middleware.auditLog)
+  .use(auditLog)
 
 // error handling middleware - TODO: This could be moved to backend-core
 router.use(async (ctx, next) => {
   try {
     await next()
-  } catch (err: any) {
+  } catch (err) {
     ctx.log.error(err)
     ctx.status = err.status || err.statusCode || 500
     const error = errors.getPublicError(err)
-    const body: APIError = {
+    ctx.body = {
       message: err.message,
       status: ctx.status,
       error,
     }
-    ctx.body = body
   }
 })
 

package/src/api/routes/global/configs.js

@@ -53,7 +53,6 @@ function oidcValidation() {
         name: Joi.string().allow("", null),
         uuid: Joi.string().required(),
         activated: Joi.boolean().required(),
-        scopes: Joi.array().optional()
       })
     ).required(true)
   }).unknown(true)

package/src/api/routes/index.js

@@ -12,7 +12,6 @@ const statusRoutes = require("./system/status")
 const selfRoutes = require("./global/self")
 const licenseRoutes = require("./global/license")
 const migrationRoutes = require("./system/migrations")
-const accountRoutes = require("./system/accounts")
 
 let userGroupRoutes = api.groups
 exports.routes = [
@@ -30,5 +29,4 @@ exports.routes = [
   licenseRoutes,
   userGroupRoutes,
   migrationRoutes,
-  accountRoutes,
 ]

package/src/api/routes/{global/tests/auth.spec.ts → tests/auth.spec.js}

@@ -1,11 +1,11 @@
 jest.mock("nodemailer")
-import { TestConfiguration, mocks, API } from "../../../../tests"
+const { config, request, mocks, structures } = require("../../../tests")
 const sendMailMock = mocks.email.mock()
-import { events } from "@budibase/backend-core"
+const { events } = require("@budibase/backend-core")
+
+const TENANT_ID = structures.TENANT_ID
 
 describe("/api/global/auth", () => {
-  const config = new TestConfiguration()
-  const api = new API(config)
 
   beforeAll(async () => {
     await config.beforeAll()
@@ -19,32 +19,56 @@ describe("/api/global/auth", () => {
     jest.clearAllMocks()
   })
 
+  const requestPasswordReset = async () => {
+    await config.saveSmtpConfig()
+    await config.saveSettingsConfig()
+    await config.createUser()
+    const res = await request
+      .post(`/api/global/auth/${TENANT_ID}/reset`)
+      .send({
+        email: "test@test.com",
+      })
+      .expect("Content-Type", /json/)
+      .expect(200)
+    const emailCall = sendMailMock.mock.calls[0][0]
+    const parts = emailCall.html.split(`http://localhost:10000/builder/auth/reset?code=`)
+    const code = parts[1].split("\"")[0].split("&")[0]
+    return { code, res }
+  }
+
   it("should logout", async () => {
-    await api.auth.logout()
+    await request
+      .post("/api/global/auth/logout")
+      .set(config.defaultHeaders())
+      .expect(200)
     expect(events.auth.logout).toBeCalledTimes(1)
   })
 
   it("should be able to generate password reset email", async () => {
-    const { res, code } = await api.auth.requestPasswordReset(sendMailMock)
+    const { res, code } = await requestPasswordReset()
     const user = await config.getUser("test@test.com")
 
-    expect(res.body).toEqual({
-      message: "Please check your email for a reset link.",
-    })
+    expect(res.body).toEqual({ message: "Please check your email for a reset link." })
     expect(sendMailMock).toHaveBeenCalled()
-
+    
     expect(code).toBeDefined()
     expect(events.user.passwordResetRequested).toBeCalledTimes(1)
     expect(events.user.passwordResetRequested).toBeCalledWith(user)
   })
 
   it("should allow resetting user password with code", async () => {
-    const { code } = await api.auth.requestPasswordReset(sendMailMock)
+    const { code } = await requestPasswordReset()
     const user = await config.getUser("test@test.com")
-    delete user.password
-
-    const res = await api.auth.updatePassword(code)
+    delete user.password 
 
+    const res = await request
+      .post(`/api/global/auth/${TENANT_ID}/reset/update`)
+      .send({
+        password: "newpassword",
+        resetCode: code,
+      })
+      .expect("Content-Type", /json/)
+      .expect(200)
     expect(res.body).toEqual({ message: "password reset successfully." })
     expect(events.user.passwordReset).toBeCalledTimes(1)
     expect(events.user.passwordReset).toBeCalledWith(user)
@@ -55,15 +79,15 @@ describe("/api/global/auth", () => {
 
     const passportSpy = jest.spyOn(auth.passport, "authenticate")
     let oidcConf
-    let chosenConfig: any
-    let configId: string
+    let chosenConfig
+    let configId
 
     // mock the oidc strategy implementation and return value
     let strategyFactory = jest.fn()
     let mockStrategyReturn = jest.fn()
     let mockStrategyConfig = jest.fn()
     auth.oidc.fetchStrategyConfig = mockStrategyConfig
-
+    
     strategyFactory.mockReturnValue(mockStrategyReturn)
     auth.oidc.strategyFactory = strategyFactory
 
@@ -75,34 +99,34 @@ describe("/api/global/auth", () => {
     })
 
     afterEach(() => {
-      expect(strategyFactory).toBeCalledWith(chosenConfig, expect.any(Function))
+      expect(strategyFactory).toBeCalledWith(
+        chosenConfig, 
+        expect.any(Function)
+      )
     })
 
     describe("oidc configs", () => {
       it("should load strategy and delegate to passport", async () => {
-        await api.configs.getOIDCConfig(configId)
+        await request.get(`/api/global/auth/${TENANT_ID}/oidc/configs/${configId}`)
 
         expect(passportSpy).toBeCalledWith(mockStrategyReturn, {
-          scope: ["profile", "email", "offline_access"],
+          scope: ["profile", "email", "offline_access"]
         })
-        expect(passportSpy.mock.calls.length).toBe(1)
+        expect(passportSpy.mock.calls.length).toBe(1);
       })
     })
 
     describe("oidc callback", () => {
       it("should load strategy and delegate to passport", async () => {
-        await api.configs.OIDCCallback(configId)
-
-        expect(passportSpy).toBeCalledWith(
-          mockStrategyReturn,
-          {
-            successRedirect: "/",
-            failureRedirect: "/error",
-          },
-          expect.anything()
-        )
-        expect(passportSpy.mock.calls.length).toBe(1)
+        await request.get(`/api/global/auth/${TENANT_ID}/oidc/callback`)
+                     .set(config.getOIDConfigCookie(configId))
+      
+        expect(passportSpy).toBeCalledWith(mockStrategyReturn, {
+          successRedirect: "/", failureRedirect: "/error" 
+        }, expect.anything())
+        expect(passportSpy.mock.calls.length).toBe(1);
       })
     })
+
   })
 })