@budibase/worker 1.2.58 → 1.3.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/worker",
   "email": "hi@budibase.com",
-  "version": "1.2.58",
+  "version": "1.3.1",
   "description": "Budibase background service",
   "main": "src/index.ts",
   "repository": {
@@ -35,10 +35,10 @@
   "author": "Budibase",
   "license": "GPL-3.0",
   "dependencies": {
-    "@budibase/backend-core": "^1.2.58",
-    "@budibase/pro": "1.2.57",
-    "@budibase/string-templates": "^1.2.58",
-    "@budibase/types": "^1.2.58",
+    "@budibase/backend-core": "^1.3.1",
+    "@budibase/pro": "1.2.59",
+    "@budibase/string-templates": "^1.3.1",
+    "@budibase/types": "^1.3.1",
     "@koa/router": "8.0.8",
     "@sentry/node": "6.17.7",
     "@techpass/passport-openidconnect": "0.3.2",
@@ -74,6 +74,7 @@
     "@types/koa-router": "7.4.4",
     "@types/koa__router": "8.0.11",
     "@types/node": "14.18.20",
+    "@types/uuid": "8.3.4",
     "@typescript-eslint/parser": "5.12.0",
     "copyfiles": "2.4.1",
     "eslint": "6.8.0",
@@ -102,5 +103,5 @@
       "./scripts/jestSetup.js"
     ]
   },
-  "gitHead": "2922b47620173f41097d36b9dc5b1c0f8f7b063a"
+  "gitHead": "68d741c482a7a9c2ca2f4de6fedd809d06bd242b"
 }

package/scripts/jestSetup.js

@@ -14,3 +14,9 @@ const tk = require("timekeeper")
 tk.freeze(mocks.date.MOCK_DATE)
 
 global.console.log = jest.fn() // console.log are ignored in tests
+
+if (!process.env.CI) {
+  // set a longer timeout in dev for debugging
+  // 100 seconds
+  jest.setTimeout(100000)
+}

package/src/api/controllers/global/auth.ts

@@ -227,9 +227,22 @@ export const oidcPreAuth = async (ctx: any, next: any) => {
 
   setCookie(ctx, configId, Cookies.OIDC_CONFIG)
 
+  const db = getGlobalDB()
+  const config = await core.db.getScopedConfig(db, {
+    type: Configs.OIDC,
+    group: ctx.query.group,
+  })
+
+  const chosenConfig = config.configs.filter((c: any) => c.uuid === configId)[0]
+
+  let authScopes =
+    chosenConfig.scopes?.length > 0
+      ? chosenConfig.scopes
+      : ["profile", "email", "offline_access"]
+
   return passport.authenticate(strategy, {
     // required 'openid' scope is added by oidc strategy factory
-    scope: ["profile", "email", "offline_access"], //auth0 offline_access scope required for the refresh token behaviour.
+    scope: authScopes,
   })(ctx, next)
 }
 

package/src/api/controllers/global/users.ts

@@ -1,9 +1,13 @@
-import { EmailTemplatePurpose } from "../../../constants"
 import { checkInviteCode } from "../../../utilities/redis"
-import { sendEmail } from "../../../utilities/email"
 import { users } from "../../../sdk"
 import env from "../../../environment"
-import { CloudAccount, User } from "@budibase/types"
+import {
+  BulkDeleteUsersRequest,
+  CloudAccount,
+  InviteUserRequest,
+  InviteUsersRequest,
+  User,
+} from "@budibase/types"
 import {
   accounts,
   cache,
@@ -46,8 +50,8 @@ export const bulkCreate = async (ctx: any) => {
   }
 
   try {
-    let response = await users.bulkCreate(newUsersRequested, groups)
-    await groupUtils.bulkSaveGroupUsers(groupsToSave, response)
+    const response = await users.bulkCreate(newUsersRequested, groups)
+    await groupUtils.bulkSaveGroupUsers(groupsToSave, response.successful)
 
     ctx.body = response
   } catch (err: any) {
@@ -138,17 +142,15 @@ export const destroy = async (ctx: any) => {
 }
 
 export const bulkDelete = async (ctx: any) => {
-  const { userIds } = ctx.request.body
+  const { userIds } = ctx.request.body as BulkDeleteUsersRequest
   if (userIds?.indexOf(ctx.user._id) !== -1) {
     ctx.throw(400, "Unable to delete self.")
   }
 
   try {
-    let usersResponse = await users.bulkDelete(userIds)
+    let response = await users.bulkDelete(userIds)
 
-    ctx.body = {
-      message: `${usersResponse.length} user(s) deleted`,
-    }
+    ctx.body = response
   } catch (err) {
     ctx.throw(err)
   }
@@ -193,58 +195,27 @@ export const tenantUserLookup = async (ctx: any) => {
 }
 
 export const invite = async (ctx: any) => {
-  let { email, userInfo } = ctx.request.body
-  const existing = await usersCore.getGlobalUserByEmail(email)
-  if (existing) {
-    ctx.throw(400, "Email address already in use.")
-  }
-  if (!userInfo) {
-    userInfo = {}
-  }
-  userInfo.tenantId = tenancy.getTenantId()
-  const opts: any = {
-    subject: "{{ company }} platform invitation",
-    info: userInfo,
+  const request = ctx.request.body as InviteUserRequest
+  const response = await users.invite([request])
+
+  // explicitly throw for single user invite
+  if (response.unsuccessful.length) {
+    const reason = response.unsuccessful[0].reason
+    if (reason === "Unavailable") {
+      ctx.throw(400, reason)
+    } else {
+      ctx.throw(500, reason)
+    }
   }
-  await sendEmail(email, EmailTemplatePurpose.INVITATION, opts)
+
   ctx.body = {
     message: "Invitation has been sent.",
   }
-  await events.user.invited()
 }
 
 export const inviteMultiple = async (ctx: any) => {
-  let users = ctx.request.body
-  let existing = false
-  let existingEmail
-  for (let user of users) {
-    if (await usersCore.getGlobalUserByEmail(user.email)) {
-      existing = true
-      existingEmail = user.email
-      break
-    }
-  }
-
-  if (existing) {
-    ctx.throw(400, `${existingEmail} already exists`)
-  }
-
-  for (let i = 0; i < users.length; i++) {
-    let userInfo = users[i].userInfo
-    if (!userInfo) {
-      userInfo = {}
-    }
-    userInfo.tenantId = tenancy.getTenantId()
-    const opts: any = {
-      subject: "{{ company }} platform invitation",
-      info: userInfo,
-    }
-    await sendEmail(users[i].email, EmailTemplatePurpose.INVITATION, opts)
-  }
-
-  ctx.body = {
-    message: "Invitations have been sent.",
-  }
+  const request = ctx.request.body as InviteUsersRequest
+  ctx.body = await users.invite(request)
 }
 
 export const inviteAccept = async (ctx: any) => {

package/src/api/controllers/system/accounts.ts

@@ -0,0 +1,21 @@
+import { Account, AccountMetadata } from "@budibase/types"
+import { accounts } from "../../../sdk"
+
+export const save = async (ctx: any) => {
+  const account = ctx.request.body as Account
+  let metadata: AccountMetadata = {
+    _id: accounts.formatAccountMetadataId(account.accountId),
+    email: account.email,
+  }
+
+  metadata = await accounts.saveMetadata(metadata)
+
+  ctx.body = metadata
+  ctx.status = 200
+}
+
+export const destroy = async (ctx: any) => {
+  const accountId = accounts.formatAccountMetadataId(ctx.params.accountId)
+  await accounts.destroyMetadata(accountId)
+  ctx.status = 204
+}

package/src/api/{index.js → index.ts}

@@ -1,15 +1,10 @@
-const Router = require("@koa/router")
+import Router from "@koa/router"
 const compress = require("koa-compress")
 const zlib = require("zlib")
-const { routes } = require("./routes")
-const {
-  buildAuthMiddleware,
-  auditLog,
-  buildTenancyMiddleware,
-  buildCsrfMiddleware,
-} = require("@budibase/backend-core/auth")
-const { middleware: pro } = require("@budibase/pro")
-const { errors } = require("@budibase/backend-core")
+import { routes } from "./routes"
+import { middleware as pro } from "@budibase/pro"
+import { errors, auth, middleware } from "@budibase/backend-core"
+import { APIError } from "@budibase/types"
 
 const PUBLIC_ENDPOINTS = [
   // old deprecated endpoints kept for backwards compat
@@ -97,9 +92,9 @@ router
     })
   )
   .use("/health", ctx => (ctx.status = 200))
-  .use(buildAuthMiddleware(PUBLIC_ENDPOINTS))
-  .use(buildTenancyMiddleware(PUBLIC_ENDPOINTS, NO_TENANCY_ENDPOINTS))
-  .use(buildCsrfMiddleware({ noCsrfPatterns: NO_CSRF_ENDPOINTS }))
+  .use(auth.buildAuthMiddleware(PUBLIC_ENDPOINTS))
+  .use(auth.buildTenancyMiddleware(PUBLIC_ENDPOINTS, NO_TENANCY_ENDPOINTS))
+  .use(auth.buildCsrfMiddleware({ noCsrfPatterns: NO_CSRF_ENDPOINTS }))
   .use(pro.licensing())
   // for now no public access is allowed to worker (bar health check)
   .use((ctx, next) => {
@@ -114,21 +109,22 @@ router
     }
     return next()
   })
-  .use(auditLog)
+  .use(middleware.auditLog)
 
 // error handling middleware - TODO: This could be moved to backend-core
 router.use(async (ctx, next) => {
   try {
     await next()
-  } catch (err) {
+  } catch (err: any) {
     ctx.log.error(err)
     ctx.status = err.status || err.statusCode || 500
     const error = errors.getPublicError(err)
-    ctx.body = {
+    const body: APIError = {
       message: err.message,
       status: ctx.status,
       error,
     }
+    ctx.body = body
   }
 })
 

package/src/api/routes/global/configs.js

@@ -53,6 +53,7 @@ function oidcValidation() {
         name: Joi.string().allow("", null),
         uuid: Joi.string().required(),
         activated: Joi.boolean().required(),
+        scopes: Joi.array().optional()
       })
     ).required(true)
   }).unknown(true)

package/src/api/routes/{tests/auth.spec.js → global/tests/auth.spec.ts}

@@ -1,11 +1,11 @@
 jest.mock("nodemailer")
-const { config, request, mocks, structures } = require("../../../tests")
+import { TestConfiguration, mocks, API } from "../../../../tests"
 const sendMailMock = mocks.email.mock()
-const { events } = require("@budibase/backend-core")
-
-const TENANT_ID = structures.TENANT_ID
+import { events } from "@budibase/backend-core"
 
 describe("/api/global/auth", () => {
+  const config = new TestConfiguration()
+  const api = new API(config)
 
   beforeAll(async () => {
     await config.beforeAll()
@@ -19,56 +19,32 @@ describe("/api/global/auth", () => {
     jest.clearAllMocks()
   })
 
-  const requestPasswordReset = async () => {
-    await config.saveSmtpConfig()
-    await config.saveSettingsConfig()
-    await config.createUser()
-    const res = await request
-      .post(`/api/global/auth/${TENANT_ID}/reset`)
-      .send({
-        email: "test@test.com",
-      })
-      .expect("Content-Type", /json/)
-      .expect(200)
-    const emailCall = sendMailMock.mock.calls[0][0]
-    const parts = emailCall.html.split(`http://localhost:10000/builder/auth/reset?code=`)
-    const code = parts[1].split("\"")[0].split("&")[0]
-    return { code, res }
-  }
-
   it("should logout", async () => {
-    await request
-      .post("/api/global/auth/logout")
-      .set(config.defaultHeaders())
-      .expect(200)
+    await api.auth.logout()
     expect(events.auth.logout).toBeCalledTimes(1)
   })
 
   it("should be able to generate password reset email", async () => {
-    const { res, code } = await requestPasswordReset()
+    const { res, code } = await api.auth.requestPasswordReset(sendMailMock)
     const user = await config.getUser("test@test.com")
 
-    expect(res.body).toEqual({ message: "Please check your email for a reset link." })
+    expect(res.body).toEqual({
+      message: "Please check your email for a reset link.",
+    })
     expect(sendMailMock).toHaveBeenCalled()
-    
+
     expect(code).toBeDefined()
     expect(events.user.passwordResetRequested).toBeCalledTimes(1)
     expect(events.user.passwordResetRequested).toBeCalledWith(user)
   })
 
   it("should allow resetting user password with code", async () => {
-    const { code } = await requestPasswordReset()
+    const { code } = await api.auth.requestPasswordReset(sendMailMock)
     const user = await config.getUser("test@test.com")
-    delete user.password 
+    delete user.password
+
+    const res = await api.auth.updatePassword(code)
 
-    const res = await request
-      .post(`/api/global/auth/${TENANT_ID}/reset/update`)
-      .send({
-        password: "newpassword",
-        resetCode: code,
-      })
-      .expect("Content-Type", /json/)
-      .expect(200)
     expect(res.body).toEqual({ message: "password reset successfully." })
     expect(events.user.passwordReset).toBeCalledTimes(1)
     expect(events.user.passwordReset).toBeCalledWith(user)
@@ -79,15 +55,15 @@ describe("/api/global/auth", () => {
 
     const passportSpy = jest.spyOn(auth.passport, "authenticate")
     let oidcConf
-    let chosenConfig
-    let configId
+    let chosenConfig: any
+    let configId: string
 
     // mock the oidc strategy implementation and return value
     let strategyFactory = jest.fn()
     let mockStrategyReturn = jest.fn()
     let mockStrategyConfig = jest.fn()
     auth.oidc.fetchStrategyConfig = mockStrategyConfig
-    
+
     strategyFactory.mockReturnValue(mockStrategyReturn)
     auth.oidc.strategyFactory = strategyFactory
 
@@ -99,34 +75,34 @@ describe("/api/global/auth", () => {
     })
 
     afterEach(() => {
-      expect(strategyFactory).toBeCalledWith(
-        chosenConfig, 
-        expect.any(Function)
-      )
+      expect(strategyFactory).toBeCalledWith(chosenConfig, expect.any(Function))
     })
 
     describe("oidc configs", () => {
       it("should load strategy and delegate to passport", async () => {
-        await request.get(`/api/global/auth/${TENANT_ID}/oidc/configs/${configId}`)
+        await api.configs.getOIDCConfig(configId)
 
         expect(passportSpy).toBeCalledWith(mockStrategyReturn, {
-          scope: ["profile", "email", "offline_access"]
+          scope: ["profile", "email", "offline_access"],
         })
-        expect(passportSpy.mock.calls.length).toBe(1);
+        expect(passportSpy.mock.calls.length).toBe(1)
       })
     })
 
     describe("oidc callback", () => {
       it("should load strategy and delegate to passport", async () => {
-        await request.get(`/api/global/auth/${TENANT_ID}/oidc/callback`)
-                     .set(config.getOIDConfigCookie(configId))
-      
-        expect(passportSpy).toBeCalledWith(mockStrategyReturn, {
-          successRedirect: "/", failureRedirect: "/error" 
-        }, expect.anything())
-        expect(passportSpy.mock.calls.length).toBe(1);
+        await api.configs.OIDCCallback(configId)
+
+        expect(passportSpy).toBeCalledWith(
+          mockStrategyReturn,
+          {
+            successRedirect: "/",
+            failureRedirect: "/error",
+          },
+          expect.anything()
+        )
+        expect(passportSpy.mock.calls.length).toBe(1)
       })
     })
-
   })
 })