@budibase/worker 1.2.58 → 1.3.1

package/src/api/routes/global/tests/users.spec.ts

@@ -0,0 +1,512 @@
+import { InviteUsersResponse } from "@budibase/types"
+
+jest.mock("nodemailer")
+import {
+  TestConfiguration,
+  mocks,
+  structures,
+  TENANT_1,
+  API,
+} from "../../../../tests"
+const sendMailMock = mocks.email.mock()
+import { events, tenancy } from "@budibase/backend-core"
+
+describe("/api/global/users", () => {
+  const config = new TestConfiguration()
+  const api = new API(config)
+
+  beforeAll(async () => {
+    await config.beforeAll()
+  })
+
+  afterAll(async () => {
+    await config.afterAll()
+  })
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+  })
+
+  describe("invite", () => {
+    it("should be able to generate an invitation", async () => {
+      const email = structures.users.newEmail()
+      const { code, res } = await api.users.sendUserInvite(sendMailMock, email)
+
+      expect(res.body).toEqual({ message: "Invitation has been sent." })
+      expect(sendMailMock).toHaveBeenCalled()
+      expect(code).toBeDefined()
+      expect(events.user.invited).toBeCalledTimes(1)
+    })
+
+    it("should not be able to generate an invitation for existing user", async () => {
+      const { code, res } = await api.users.sendUserInvite(
+        sendMailMock,
+        config.defaultUser!.email,
+        400
+      )
+
+      expect(res.body.message).toBe("Unavailable")
+      expect(sendMailMock).toHaveBeenCalledTimes(0)
+      expect(code).toBeUndefined()
+      expect(events.user.invited).toBeCalledTimes(0)
+    })
+
+    it("should be able to create new user from invite", async () => {
+      const email = structures.users.newEmail()
+      const { code } = await api.users.sendUserInvite(sendMailMock, email)
+
+      const res = await api.users.acceptInvite(code)
+
+      expect(res.body._id).toBeDefined()
+      const user = await config.getUser(email)
+      expect(user).toBeDefined()
+      expect(user._id).toEqual(res.body._id)
+      expect(events.user.inviteAccepted).toBeCalledTimes(1)
+      expect(events.user.inviteAccepted).toBeCalledWith(user)
+    })
+  })
+
+  describe("inviteMultiple", () => {
+    it("should be able to generate an invitation", async () => {
+      const newUserInvite = () => ({
+        email: structures.users.newEmail(),
+        userInfo: {},
+      })
+      const request = [newUserInvite(), newUserInvite()]
+
+      const res = await api.users.sendMultiUserInvite(request)
+
+      const body = res.body as InviteUsersResponse
+      expect(body.successful.length).toBe(2)
+      expect(body.unsuccessful.length).toBe(0)
+      expect(sendMailMock).toHaveBeenCalledTimes(2)
+      expect(events.user.invited).toBeCalledTimes(2)
+    })
+
+    it("should not be able to generate an invitation for existing user", async () => {
+      const request = [{ email: config.defaultUser!.email, userInfo: {} }]
+
+      const res = await api.users.sendMultiUserInvite(request)
+
+      const body = res.body as InviteUsersResponse
+      expect(body.successful.length).toBe(0)
+      expect(body.unsuccessful.length).toBe(1)
+      expect(body.unsuccessful[0].reason).toBe("Unavailable")
+      expect(sendMailMock).toHaveBeenCalledTimes(0)
+      expect(events.user.invited).toBeCalledTimes(0)
+    })
+  })
+
+  describe("bulkCreate", () => {
+    it("should ignore users existing in the same tenant", async () => {
+      const user = await config.createUser()
+      jest.clearAllMocks()
+
+      const response = await api.users.bulkCreateUsers([user])
+
+      expect(response.successful.length).toBe(0)
+      expect(response.unsuccessful.length).toBe(1)
+      expect(response.unsuccessful[0].email).toBe(user.email)
+      expect(events.user.created).toBeCalledTimes(0)
+    })
+
+    it("should ignore users existing in other tenants", async () => {
+      const user = await config.createUser()
+      jest.resetAllMocks()
+
+      await tenancy.doInTenant(TENANT_1, async () => {
+        const response = await api.users.bulkCreateUsers([user])
+
+        expect(response.successful.length).toBe(0)
+        expect(response.unsuccessful.length).toBe(1)
+        expect(response.unsuccessful[0].email).toBe(user.email)
+        expect(events.user.created).toBeCalledTimes(0)
+      })
+    })
+
+    it("should ignore accounts using the same email", async () => {
+      const account = structures.accounts.account()
+      const resp = await api.accounts.saveMetadata(account)
+      const user = structures.users.user({ email: resp.email })
+      jest.clearAllMocks()
+
+      const response = await api.users.bulkCreateUsers([user])
+
+      expect(response.successful.length).toBe(0)
+      expect(response.unsuccessful.length).toBe(1)
+      expect(response.unsuccessful[0].email).toBe(user.email)
+      expect(events.user.created).toBeCalledTimes(0)
+    })
+
+    it("should be able to bulkCreate users", async () => {
+      const builder = structures.users.builderUser()
+      const admin = structures.users.adminUser()
+      const user = structures.users.user()
+
+      const response = await api.users.bulkCreateUsers([builder, admin, user])
+
+      expect(response.successful.length).toBe(3)
+      expect(response.successful[0].email).toBe(builder.email)
+      expect(response.successful[1].email).toBe(admin.email)
+      expect(response.successful[2].email).toBe(user.email)
+      expect(response.unsuccessful.length).toBe(0)
+      expect(events.user.created).toBeCalledTimes(3)
+      expect(events.user.permissionAdminAssigned).toBeCalledTimes(1)
+      expect(events.user.permissionBuilderAssigned).toBeCalledTimes(2)
+    })
+  })
+
+  describe("create", () => {
+    it("should be able to create a basic user", async () => {
+      const user = structures.users.user()
+
+      await api.users.saveUser(user)
+
+      expect(events.user.created).toBeCalledTimes(1)
+      expect(events.user.updated).not.toBeCalled()
+      expect(events.user.permissionBuilderAssigned).not.toBeCalled()
+      expect(events.user.permissionAdminAssigned).not.toBeCalled()
+    })
+
+    it("should be able to create an admin user", async () => {
+      const user = structures.users.adminUser()
+
+      await api.users.saveUser(user)
+
+      expect(events.user.created).toBeCalledTimes(1)
+      expect(events.user.updated).not.toBeCalled()
+      expect(events.user.permissionBuilderAssigned).toBeCalledTimes(1)
+      expect(events.user.permissionAdminAssigned).toBeCalledTimes(1)
+    })
+
+    it("should be able to create a builder user", async () => {
+      const user = structures.users.builderUser()
+
+      await api.users.saveUser(user)
+
+      expect(events.user.created).toBeCalledTimes(1)
+      expect(events.user.updated).not.toBeCalled()
+      expect(events.user.permissionBuilderAssigned).toBeCalledTimes(1)
+      expect(events.user.permissionAdminAssigned).not.toBeCalled()
+    })
+
+    it("should be able to assign app roles", async () => {
+      const user = structures.users.user()
+      user.roles = {
+        app_123: "role1",
+        app_456: "role2",
+      }
+
+      await api.users.saveUser(user)
+
+      const savedUser = await config.getUser(user.email)
+      expect(events.user.created).toBeCalledTimes(1)
+      expect(events.user.updated).not.toBeCalled()
+      expect(events.role.assigned).toBeCalledTimes(2)
+      expect(events.role.assigned).toBeCalledWith(savedUser, "role1")
+      expect(events.role.assigned).toBeCalledWith(savedUser, "role2")
+    })
+
+    it("should not be able to create user that exists in same tenant", async () => {
+      const user = await config.createUser()
+      jest.clearAllMocks()
+      delete user._id
+      delete user._rev
+
+      const response = await api.users.saveUser(user, 400)
+
+      expect(response.body.message).toBe(`Unavailable`)
+      expect(events.user.created).toBeCalledTimes(0)
+    })
+
+    it("should not be able to create user that exists in other tenant", async () => {
+      const user = await config.createUser()
+      jest.resetAllMocks()
+
+      await tenancy.doInTenant(TENANT_1, async () => {
+        delete user._id
+        const response = await api.users.saveUser(user, 400)
+
+        expect(response.body.message).toBe(`Unavailable`)
+        expect(events.user.created).toBeCalledTimes(0)
+      })
+    })
+
+    it("should not be able to create user with the same email as an account", async () => {
+      const user = structures.users.user()
+      const account = structures.accounts.cloudAccount()
+      mocks.accounts.getAccount.mockReturnValueOnce(account)
+
+      const response = await api.users.saveUser(user, 400)
+
+      expect(response.body.message).toBe(`Unavailable`)
+      expect(events.user.created).toBeCalledTimes(0)
+    })
+  })
+
+  describe("update", () => {
+    it("should be able to update a basic user", async () => {
+      const user = await config.createUser()
+      jest.clearAllMocks()
+
+      await api.users.saveUser(user)
+
+      expect(events.user.created).not.toBeCalled()
+      expect(events.user.updated).toBeCalledTimes(1)
+      expect(events.user.permissionBuilderAssigned).not.toBeCalled()
+      expect(events.user.permissionAdminAssigned).not.toBeCalled()
+      expect(events.user.passwordForceReset).not.toBeCalled()
+    })
+
+    it("should be able to force reset password", async () => {
+      const user = await config.createUser()
+      jest.clearAllMocks()
+
+      user.forceResetPassword = true
+      user.password = "tempPassword"
+      await api.users.saveUser(user)
+
+      expect(events.user.created).not.toBeCalled()
+      expect(events.user.updated).toBeCalledTimes(1)
+      expect(events.user.permissionBuilderAssigned).not.toBeCalled()
+      expect(events.user.permissionAdminAssigned).not.toBeCalled()
+      expect(events.user.passwordForceReset).toBeCalledTimes(1)
+    })
+
+    it("should be able to update a basic user to an admin user", async () => {
+      const user = await config.createUser()
+      jest.clearAllMocks()
+
+      await api.users.saveUser(structures.users.adminUser(user))
+
+      expect(events.user.created).not.toBeCalled()
+      expect(events.user.updated).toBeCalledTimes(1)
+      expect(events.user.permissionBuilderAssigned).toBeCalledTimes(1)
+      expect(events.user.permissionAdminAssigned).toBeCalledTimes(1)
+    })
+
+    it("should be able to update a basic user to a builder user", async () => {
+      const user = await config.createUser()
+      jest.clearAllMocks()
+
+      await api.users.saveUser(structures.users.builderUser(user))
+
+      expect(events.user.created).not.toBeCalled()
+      expect(events.user.updated).toBeCalledTimes(1)
+      expect(events.user.permissionBuilderAssigned).toBeCalledTimes(1)
+      expect(events.user.permissionAdminAssigned).not.toBeCalled()
+    })
+
+    it("should be able to update an admin user to a basic user", async () => {
+      const user = await config.createUser(structures.users.adminUser())
+      jest.clearAllMocks()
+      user.admin!.global = false
+      user.builder!.global = false
+
+      await api.users.saveUser(user)
+
+      expect(events.user.created).not.toBeCalled()
+      expect(events.user.updated).toBeCalledTimes(1)
+      expect(events.user.permissionAdminRemoved).toBeCalledTimes(1)
+      expect(events.user.permissionBuilderRemoved).toBeCalledTimes(1)
+    })
+
+    it("should be able to update an builder user to a basic user", async () => {
+      const user = await config.createUser(structures.users.builderUser())
+      jest.clearAllMocks()
+      user.builder!.global = false
+
+      await api.users.saveUser(user)
+
+      expect(events.user.created).not.toBeCalled()
+      expect(events.user.updated).toBeCalledTimes(1)
+      expect(events.user.permissionBuilderRemoved).toBeCalledTimes(1)
+      expect(events.user.permissionAdminRemoved).not.toBeCalled()
+    })
+
+    it("should be able to assign app roles", async () => {
+      const user = await config.createUser()
+      jest.clearAllMocks()
+      user.roles = {
+        app_123: "role1",
+        app_456: "role2",
+      }
+
+      await api.users.saveUser(user)
+
+      const savedUser = await config.getUser(user.email)
+      expect(events.user.created).not.toBeCalled()
+      expect(events.user.updated).toBeCalledTimes(1)
+      expect(events.role.assigned).toBeCalledTimes(2)
+      expect(events.role.assigned).toBeCalledWith(savedUser, "role1")
+      expect(events.role.assigned).toBeCalledWith(savedUser, "role2")
+    })
+
+    it("should be able to unassign app roles", async () => {
+      let user = structures.users.user()
+      user.roles = {
+        app_123: "role1",
+        app_456: "role2",
+      }
+      user = await config.createUser(user)
+      jest.clearAllMocks()
+      user.roles = {}
+
+      await api.users.saveUser(user)
+
+      const savedUser = await config.getUser(user.email)
+      expect(events.user.created).not.toBeCalled()
+      expect(events.user.updated).toBeCalledTimes(1)
+      expect(events.role.unassigned).toBeCalledTimes(2)
+      expect(events.role.unassigned).toBeCalledWith(savedUser, "role1")
+      expect(events.role.unassigned).toBeCalledWith(savedUser, "role2")
+    })
+
+    it("should be able to update existing app roles", async () => {
+      let user = structures.users.user()
+      user.roles = {
+        app_123: "role1",
+        app_456: "role2",
+      }
+      user = await config.createUser(user)
+      jest.clearAllMocks()
+      user.roles = {
+        app_123: "role1",
+        app_456: "role2-edit",
+      }
+
+      await api.users.saveUser(user)
+
+      const savedUser = await config.getUser(user.email)
+      expect(events.user.created).not.toBeCalled()
+      expect(events.user.updated).toBeCalledTimes(1)
+      expect(events.role.unassigned).toBeCalledTimes(1)
+      expect(events.role.unassigned).toBeCalledWith(savedUser, "role2")
+      expect(events.role.assigned).toBeCalledTimes(1)
+      expect(events.role.assigned).toBeCalledWith(savedUser, "role2-edit")
+    })
+
+    it("should not be able to update email address", async () => {
+      const email = "email@test.com"
+      const user = await config.createUser(structures.users.user({ email }))
+      user.email = "new@test.com"
+
+      const response = await api.users.saveUser(user, 400)
+
+      const dbUser = await config.getUser(email)
+      user.email = email
+      expect(user).toStrictEqual(dbUser)
+      expect(response.body.message).toBe("Email address cannot be changed")
+    })
+  })
+
+  describe("bulkDelete", () => {
+    it("should not be able to bulkDelete current user", async () => {
+      const user = await config.defaultUser!
+      const request = { userIds: [user._id!] }
+
+      const response = await api.users.bulkDeleteUsers(request, 400)
+
+      expect(response.body.message).toBe("Unable to delete self.")
+      expect(events.user.deleted).not.toBeCalled()
+    })
+
+    it("should not be able to bulkDelete account owner", async () => {
+      const user = await config.createUser()
+      const account = structures.accounts.cloudAccount()
+      account.budibaseUserId = user._id!
+      mocks.accounts.getAccountByTenantId.mockReturnValue(account)
+
+      const request = { userIds: [user._id!] }
+
+      const response = await api.users.bulkDeleteUsers(request)
+
+      expect(response.body.successful.length).toBe(0)
+      expect(response.body.unsuccessful.length).toBe(1)
+      expect(response.body.unsuccessful[0].reason).toBe(
+        "Account holder cannot be deleted"
+      )
+      expect(response.body.unsuccessful[0]._id).toBe(user._id)
+      expect(events.user.deleted).not.toBeCalled()
+    })
+
+    it("should be able to bulk delete users", async () => {
+      const account = structures.accounts.cloudAccount()
+      mocks.accounts.getAccountByTenantId.mockReturnValue(account)
+
+      const builder = structures.users.builderUser()
+      const admin = structures.users.adminUser()
+      const user = structures.users.user()
+      const createdUsers = await api.users.bulkCreateUsers([
+        builder,
+        admin,
+        user,
+      ])
+      const request = { userIds: createdUsers.successful.map(u => u._id!) }
+
+      const response = await api.users.bulkDeleteUsers(request)
+
+      expect(response.body.successful.length).toBe(3)
+      expect(response.body.unsuccessful.length).toBe(0)
+      expect(events.user.deleted).toBeCalledTimes(3)
+      expect(events.user.permissionAdminRemoved).toBeCalledTimes(1)
+      expect(events.user.permissionBuilderRemoved).toBeCalledTimes(2)
+    })
+  })
+
+  describe("destroy", () => {
+    it("should be able to destroy a basic user", async () => {
+      const user = await config.createUser()
+      jest.clearAllMocks()
+
+      await api.users.deleteUser(user._id!)
+
+      expect(events.user.deleted).toBeCalledTimes(1)
+      expect(events.user.permissionBuilderRemoved).not.toBeCalled()
+      expect(events.user.permissionAdminRemoved).not.toBeCalled()
+    })
+
+    it("should be able to destroy an admin user", async () => {
+      const user = await config.createUser(structures.users.adminUser())
+      jest.clearAllMocks()
+
+      await api.users.deleteUser(user._id!)
+
+      expect(events.user.deleted).toBeCalledTimes(1)
+      expect(events.user.permissionBuilderRemoved).toBeCalledTimes(1)
+      expect(events.user.permissionAdminRemoved).toBeCalledTimes(1)
+    })
+
+    it("should be able to destroy a builder user", async () => {
+      const user = await config.createUser(structures.users.builderUser())
+      jest.clearAllMocks()
+
+      await api.users.deleteUser(user._id!)
+
+      expect(events.user.deleted).toBeCalledTimes(1)
+      expect(events.user.permissionBuilderRemoved).toBeCalledTimes(1)
+      expect(events.user.permissionAdminRemoved).not.toBeCalled()
+    })
+
+    it("should not be able to destroy account owner", async () => {
+      const user = await config.createUser()
+      const account = structures.accounts.cloudAccount()
+      mocks.accounts.getAccount.mockReturnValueOnce(account)
+
+      const response = await api.users.deleteUser(user._id!, 400)
+
+      expect(response.body.message).toBe("Account holder cannot be deleted")
+    })
+
+    it("should not be able to destroy account owner as account owner", async () => {
+      const user = await config.defaultUser!
+      const account = structures.accounts.cloudAccount()
+      account.email = user.email
+      mocks.accounts.getAccount.mockReturnValueOnce(account)
+
+      const response = await api.users.deleteUser(user._id!, 400)
+
+      expect(response.body.message).toBe("Unable to delete self.")
+    })
+  })
+})

package/src/api/routes/index.js

@@ -12,6 +12,7 @@ const statusRoutes = require("./system/status")
 const selfRoutes = require("./global/self")
 const licenseRoutes = require("./global/license")
 const migrationRoutes = require("./system/migrations")
+const accountRoutes = require("./system/accounts")
 
 let userGroupRoutes = api.groups
 exports.routes = [
@@ -29,4 +30,5 @@ exports.routes = [
   licenseRoutes,
   userGroupRoutes,
   migrationRoutes,
+  accountRoutes,
 ]

package/src/api/routes/system/accounts.ts

@@ -0,0 +1,19 @@
+import Router from "@koa/router"
+import * as controller from "../../controllers/system/accounts"
+import { middleware } from "@budibase/backend-core"
+
+const router = new Router()
+
+router
+  .put(
+    "/api/system/accounts/:accountId/metadata",
+    middleware.internalApi,
+    controller.save
+  )
+  .delete(
+    "/api/system/accounts/:accountId/metadata",
+    middleware.internalApi,
+    controller.destroy
+  )
+
+export = router

package/src/api/routes/system/tests/accounts.spec.ts

@@ -0,0 +1,57 @@
+import { accounts } from "../../../../sdk"
+import { TestConfiguration, structures, API } from "../../../../tests"
+import { v4 as uuid } from "uuid"
+
+describe("accounts", () => {
+  const config = new TestConfiguration()
+  const api = new API(config)
+
+  beforeAll(async () => {
+    await config.beforeAll()
+  })
+
+  afterAll(async () => {
+    await config.afterAll()
+  })
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+  })
+
+  describe("metadata", () => {
+    describe("saveMetadata", () => {
+      it("saves account metadata", async () => {
+        let account = structures.accounts.account()
+
+        const response = await api.accounts.saveMetadata(account)
+
+        const id = accounts.formatAccountMetadataId(account.accountId)
+        const metadata = await accounts.getMetadata(id)
+        expect(response).toStrictEqual(metadata)
+      })
+    })
+
+    describe("destroyMetadata", () => {
+      it("destroys account metadata", async () => {
+        const account = structures.accounts.account()
+        await api.accounts.saveMetadata(account)
+
+        await api.accounts.destroyMetadata(account.accountId)
+
+        const deleted = await accounts.getMetadata(account.accountId)
+        expect(deleted).toBe(undefined)
+      })
+
+      it("destroys account metadata that does not exist", async () => {
+        const id = uuid()
+
+        const response = await api.accounts.destroyMetadata(id)
+
+        expect(response.status).toBe(404)
+        expect(response.body.message).toBe(
+          `id=${accounts.formatAccountMetadataId(id)} does not exist`
+        )
+      })
+    })
+  })
+})

package/src/{environment.js → environment.ts}

@@ -20,13 +20,13 @@ if (!LOADED && isDev() && !isTest()) {
   LOADED = true
 }
 
-function parseIntSafe(number) {
+function parseIntSafe(number: any) {
   if (number) {
     return parseInt(number)
   }
 }
 
-module.exports = {
+const env = {
   // auth
   MINIO_ACCESS_KEY: process.env.MINIO_ACCESS_KEY,
   MINIO_SECRET_KEY: process.env.MINIO_SECRET_KEY,
@@ -47,7 +47,7 @@ module.exports = {
   CLUSTER_PORT: process.env.CLUSTER_PORT,
   // flags
   NODE_ENV: process.env.NODE_ENV,
-  SELF_HOSTED: !!parseInt(process.env.SELF_HOSTED),
+  SELF_HOSTED: !!parseInt(process.env.SELF_HOSTED || ""),
   LOG_LEVEL: process.env.LOG_LEVEL,
   MULTI_TENANCY: process.env.MULTI_TENANCY,
   DISABLE_ACCOUNT_PORTAL: process.env.DISABLE_ACCOUNT_PORTAL,
@@ -62,7 +62,7 @@ module.exports = {
   // other
   CHECKLIST_CACHE_TTL: parseIntSafe(process.env.CHECKLIST_CACHE_TTL) || 3600,
   SESSION_UPDATE_PERIOD: process.env.SESSION_UPDATE_PERIOD,
-  _set(key, value) {
+  _set(key: any, value: any) {
     process.env[key] = value
     module.exports[key] = value
   },
@@ -74,16 +74,17 @@ module.exports = {
 }
 
 // if some var haven't been set, define them
-if (!module.exports.APPS_URL) {
-  module.exports.APPS_URL = isDev()
-    ? "http://localhost:4001"
-    : "http://app-service:4002"
+if (!env.APPS_URL) {
+  env.APPS_URL = isDev() ? "http://localhost:4001" : "http://app-service:4002"
 }
 
 // clean up any environment variable edge cases
 for (let [key, value] of Object.entries(module.exports)) {
   // handle the edge case of "0" to disable an environment variable
   if (value === "0") {
-    module.exports[key] = 0
+    // @ts-ignore
+    env[key] = 0
   }
 }
+
+export = env

package/src/index.ts

@@ -71,9 +71,7 @@ server.on("close", async () => {
     return
   }
   shuttingDown = true
-  if (!env.isTest()) {
-    console.log("Server Closed")
-  }
+  console.log("Server Closed")
   await redis.shutdown()
   await events.shutdown()
   if (!env.isTest()) {
@@ -86,7 +84,7 @@ const shutdown = () => {
   server.destroy()
 }
 
-module.exports = server.listen(parseInt(env.PORT || 4002), async () => {
+export = server.listen(parseInt(env.PORT || 4002), async () => {
   console.log(`Worker running on ${JSON.stringify(server.address())}`)
   await redis.init()
 })
@@ -100,3 +98,7 @@ process.on("uncaughtException", err => {
 process.on("SIGTERM", () => {
   shutdown()
 })
+
+process.on("SIGINT", () => {
+  shutdown()
+})