@budibase/worker 1.4.17 → 1.4.18

package/Dockerfile

@@ -23,5 +23,7 @@ ENV NODE_ENV=production
 ENV CLUSTER_MODE=${CLUSTER_MODE}
 ENV SERVICE=worker-service
 ENV POSTHOG_TOKEN=phc_bIjZL7oh2GEUd2vqvTBH8WvrX0fWTFQMs6H5KQxiUxU
+ENV TENANT_FEATURE_FLAGS=*:LICENSING,*:USER_GROUPS
+ENV ACCOUNT_PORTAL_URL=https://account.budibase.app
 
 CMD ["./docker_run.sh"]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/worker",
   "email": "hi@budibase.com",
-  "version": "1.4.17",
+  "version": "1.4.18",
   "description": "Budibase background service",
   "main": "src/index.ts",
   "repository": {
@@ -36,10 +36,10 @@
   "author": "Budibase",
   "license": "GPL-3.0",
   "dependencies": {
-    "@budibase/backend-core": "^1.4.17",
-    "@budibase/pro": "1.4.16",
-    "@budibase/string-templates": "^1.4.17",
-    "@budibase/types": "^1.4.17",
+    "@budibase/backend-core": "^1.4.18",
+    "@budibase/pro": "1.4.18-alpha.0",
+    "@budibase/string-templates": "^1.4.18",
+    "@budibase/types": "^1.4.18",
     "@koa/router": "8.0.8",
     "@sentry/node": "6.17.7",
     "@techpass/passport-openidconnect": "0.3.2",
@@ -104,5 +104,5 @@
       "./scripts/jestSetup.js"
     ]
   },
-  "gitHead": "3ff0089293ddb047d76c1027f6e5ccf2c63c313d"
+  "gitHead": "395b2a45e083fb38f6ee4d3ed2b4d71534d6f526"
 }

package/scripts/dev/manage.js

@@ -28,6 +28,7 @@ async function init() {
       APPS_URL: "http://localhost:4001",
       SERVICE: "worker-service",
       DEPLOYMENT_ENVIRONMENT: "development",
+      TENANT_FEATURE_FLAGS: "*:LICENSING,*:USER_GROUPS",
     }
     let envFile = ""
     Object.keys(envFileJson).forEach(key => {

package/src/api/controllers/global/auth.ts

@@ -8,7 +8,7 @@ const { checkResetPasswordCode } = require("../../../utilities/redis")
 const { getGlobalDB } = require("@budibase/backend-core/tenancy")
 const env = require("../../../environment")
 import { events, users as usersCore, context } from "@budibase/backend-core"
-import { users } from "../../../sdk"
+import sdk from "../../../sdk"
 import { User } from "@budibase/types"
 
 export const googleCallbackUrl = async (config: any) => {
@@ -167,7 +167,11 @@ export const googlePreAuth = async (ctx: any, next: any) => {
     workspace: ctx.query.workspace,
   })
   let callbackUrl = await exports.googleCallbackUrl(config)
-  const strategy = await google.strategyFactory(config, callbackUrl, users.save)
+  const strategy = await google.strategyFactory(
+    config,
+    callbackUrl,
+    sdk.users.save
+  )
 
   return passport.authenticate(strategy, {
     scope: ["profile", "email"],
@@ -184,7 +188,11 @@ export const googleAuth = async (ctx: any, next: any) => {
     workspace: ctx.query.workspace,
   })
   const callbackUrl = await exports.googleCallbackUrl(config)
-  const strategy = await google.strategyFactory(config, callbackUrl, users.save)
+  const strategy = await google.strategyFactory(
+    config,
+    callbackUrl,
+    sdk.users.save
+  )
 
   return passport.authenticate(
     strategy,
@@ -214,7 +222,7 @@ export const oidcStrategyFactory = async (ctx: any, configId: any) => {
     chosenConfig,
     callbackUrl
   )
-  return oidc.strategyFactory(enrichedConfig, users.save)
+  return oidc.strategyFactory(enrichedConfig, sdk.users.save)
 }
 
 /**

package/src/api/controllers/global/email.js

@@ -10,6 +10,8 @@ exports.sendEmail = async ctx => {
     contents,
     from,
     subject,
+    cc,
+    bcc,
     automation,
   } = ctx.request.body
   let user
@@ -23,6 +25,8 @@ exports.sendEmail = async ctx => {
     contents,
     from,
     subject,
+    cc,
+    bcc,
     automation,
   })
   ctx.body = {

package/src/api/controllers/global/license.ts

@@ -24,6 +24,11 @@ export const getInfo = async (ctx: any) => {
   ctx.status = 200
 }
 
+export const deleteInfo = async (ctx: any) => {
+  await licensing.deleteLicenseInfo()
+  ctx.status = 200
+}
+
 export const getQuotaUsage = async (ctx: any) => {
   ctx.body = await quotas.getQuotaUsage()
 }

package/src/api/controllers/global/{self.js → self.ts}

@@ -1,39 +1,37 @@
-const {
-  getGlobalDB,
-  getTenantId,
-  isUserInAppTenant,
-} = require("@budibase/backend-core/tenancy")
-const { generateDevInfoID, SEPARATOR } = require("@budibase/backend-core/db")
-const { user: userCache } = require("@budibase/backend-core/cache")
-const {
-  hash,
-  platformLogout,
-  getCookie,
-  clearCookie,
-} = require("@budibase/backend-core/utils")
-const { encrypt } = require("@budibase/backend-core/encryption")
-const { newid } = require("@budibase/backend-core/utils")
-const { users } = require("../../../sdk")
-const { Cookies } = require("@budibase/backend-core/constants")
-const { events, featureFlags } = require("@budibase/backend-core")
-const env = require("../../../environment")
+import sdk from "../../../sdk"
+import {
+  events,
+  featureFlags,
+  tenancy,
+  constants,
+  db as dbCore,
+  utils,
+  cache,
+  encryption,
+} from "@budibase/backend-core"
+import env from "../../../environment"
+import { groups } from "@budibase/pro"
+const { hash, platformLogout, getCookie, clearCookie, newid } = utils
+const { user: userCache } = cache
 
 function newTestApiKey() {
   return env.ENCRYPTED_TEST_PUBLIC_API_KEY
 }
 
 function newApiKey() {
-  return encrypt(`${getTenantId()}${SEPARATOR}${newid()}`)
+  return encryption.encrypt(
+    `${tenancy.getTenantId()}${dbCore.SEPARATOR}${newid()}`
+  )
 }
 
-function cleanupDevInfo(info) {
+function cleanupDevInfo(info: any) {
   // user doesn't need to aware of dev doc info
   delete info._id
   delete info._rev
   return info
 }
 
-exports.generateAPIKey = async ctx => {
+export async function generateAPIKey(ctx: any) {
   let userId
   let apiKey
   if (env.isTest() && ctx.request.body.userId) {
@@ -44,8 +42,8 @@ exports.generateAPIKey = async ctx => {
     apiKey = newApiKey()
   }
 
-  const db = getGlobalDB()
-  const id = generateDevInfoID(userId)
+  const db = tenancy.getGlobalDB()
+  const id = dbCore.generateDevInfoID(userId)
   let devInfo
   try {
     devInfo = await db.get(id)
@@ -57,9 +55,9 @@ exports.generateAPIKey = async ctx => {
   ctx.body = cleanupDevInfo(devInfo)
 }
 
-exports.fetchAPIKey = async ctx => {
-  const db = getGlobalDB()
-  const id = generateDevInfoID(ctx.user._id)
+export async function fetchAPIKey(ctx: any) {
+  const db = tenancy.getGlobalDB()
+  const id = dbCore.generateDevInfoID(ctx.user._id)
   let devInfo
   try {
     devInfo = await db.get(id)
@@ -74,20 +72,20 @@ exports.fetchAPIKey = async ctx => {
   ctx.body = cleanupDevInfo(devInfo)
 }
 
-const checkCurrentApp = ctx => {
-  const appCookie = getCookie(ctx, Cookies.CurrentApp)
-  if (appCookie && !isUserInAppTenant(appCookie.appId)) {
+const checkCurrentApp = (ctx: any) => {
+  const appCookie = getCookie(ctx, constants.Cookies.CurrentApp)
+  if (appCookie && !tenancy.isUserInAppTenant(appCookie.appId)) {
     // there is a currentapp cookie from another tenant
     // remove the cookie as this is incompatible with the builder
     // due to builder and admin permissions being removed
-    clearCookie(ctx, Cookies.CurrentApp)
+    clearCookie(ctx, constants.Cookies.CurrentApp)
   }
 }
 
 /**
  * Add the attributes that are session based to the current user.
  */
-const addSessionAttributesToUser = ctx => {
+const addSessionAttributesToUser = (ctx: any) => {
   ctx.body.account = ctx.user.account
   ctx.body.license = ctx.user.license
   ctx.body.budibaseAccess = !!ctx.user.budibaseAccess
@@ -95,9 +93,9 @@ const addSessionAttributesToUser = ctx => {
   ctx.body.csrfToken = ctx.user.csrfToken
 }
 
-const sanitiseUserUpdate = ctx => {
+const sanitiseUserUpdate = (ctx: any) => {
   const allowed = ["firstName", "lastName", "password", "forceResetPassword"]
-  const resp = {}
+  const resp: { [key: string]: any } = {}
   for (let [key, value] of Object.entries(ctx.request.body)) {
     if (allowed.includes(key)) {
       resp[key] = value
@@ -106,7 +104,7 @@ const sanitiseUserUpdate = ctx => {
   return resp
 }
 
-exports.getSelf = async ctx => {
+export async function getSelf(ctx: any) {
   if (!ctx.user) {
     ctx.throw(403, "User not logged in")
   }
@@ -118,17 +116,18 @@ exports.getSelf = async ctx => {
   checkCurrentApp(ctx)
 
   // get the main body of the user
-  ctx.body = await users.getUser(userId)
+  const user = await sdk.users.getUser(userId)
+  ctx.body = await groups.enrichUserRolesFromGroups(user)
 
   // add the feature flags for this tenant
-  const tenantId = getTenantId()
+  const tenantId = tenancy.getTenantId()
   ctx.body.featureFlags = featureFlags.getTenantFeatureFlags(tenantId)
 
   addSessionAttributesToUser(ctx)
 }
 
-exports.updateSelf = async ctx => {
-  const db = getGlobalDB()
+export async function updateSelf(ctx: any) {
+  const db = tenancy.getGlobalDB()
   const user = await db.get(ctx.user._id)
   let passwordChange = false
 

package/src/api/controllers/global/{templates.js → templates.ts}

@@ -1,20 +1,19 @@
-const { generateTemplateID } = require("@budibase/backend-core/db")
-const {
+import {
   TemplateMetadata,
   TemplateBindings,
   GLOBAL_OWNER,
-} = require("../../../constants")
-const { getTemplates } = require("../../../constants/templates")
-const { getGlobalDB } = require("@budibase/backend-core/tenancy")
+} from "../../../constants"
+import { getTemplates } from "../../../constants/templates"
+import { tenancy, db as dbCore } from "@budibase/backend-core"
 
-exports.save = async ctx => {
-  const db = getGlobalDB()
+export async function save(ctx: any) {
+  const db = tenancy.getGlobalDB()
   let template = ctx.request.body
   if (!template.ownerId) {
     template.ownerId = GLOBAL_OWNER
   }
   if (!template._id) {
-    template._id = generateTemplateID(template.ownerId)
+    template._id = dbCore.generateTemplateID(template.ownerId)
   }
 
   const response = await db.put(template)
@@ -24,9 +23,9 @@ exports.save = async ctx => {
   }
 }
 
-exports.definitions = async ctx => {
-  const bindings = {}
-  const info = {}
+export async function definitions(ctx: any) {
+  const bindings: any = {}
+  const info: any = {}
   for (let template of TemplateMetadata.email) {
     bindings[template.purpose] = template.bindings
     info[template.purpose] = {
@@ -45,30 +44,33 @@ exports.definitions = async ctx => {
   }
 }
 
-exports.fetch = async ctx => {
+export async function fetch(ctx: any) {
   ctx.body = await getTemplates()
 }
 
-exports.fetchByType = async ctx => {
+export async function fetchByType(ctx: any) {
+  // @ts-ignore
   ctx.body = await getTemplates({
     type: ctx.params.type,
   })
 }
 
-exports.fetchByOwner = async ctx => {
+export async function fetchByOwner(ctx: any) {
+  // @ts-ignore
   ctx.body = await getTemplates({
     ownerId: ctx.params.ownerId,
   })
 }
 
-exports.find = async ctx => {
+export async function find(ctx: any) {
+  // @ts-ignore
   ctx.body = await getTemplates({
     id: ctx.params.id,
   })
 }
 
-exports.destroy = async ctx => {
-  const db = getGlobalDB()
+export async function destroy(ctx: any) {
+  const db = tenancy.getGlobalDB()
   await db.remove(ctx.params.id, ctx.params.rev)
   ctx.message = `Template ${ctx.params.id} deleted.`
   ctx.status = 200

package/src/api/controllers/global/users.ts

@@ -1,8 +1,9 @@
 import { checkInviteCode } from "../../../utilities/redis"
-import { users } from "../../../sdk"
+import sdk from "../../../sdk"
 import env from "../../../environment"
 import {
-  BulkDeleteUsersRequest,
+  BulkUserRequest,
+  BulkUserResponse,
   CloudAccount,
   InviteUserRequest,
   InviteUsersRequest,
@@ -16,46 +17,48 @@ import {
   tenancy,
 } from "@budibase/backend-core"
 import { checkAnyUserExists } from "../../../utilities/users"
-import { groups as groupUtils } from "@budibase/pro"
 
 const MAX_USERS_UPLOAD_LIMIT = 1000
 
 export const save = async (ctx: any) => {
   try {
-    ctx.body = await users.save(ctx.request.body)
+    ctx.body = await sdk.users.save(ctx.request.body)
   } catch (err: any) {
     ctx.throw(err.status || 400, err)
   }
 }
 
-export const bulkCreate = async (ctx: any) => {
-  let { users: newUsersRequested, groups } = ctx.request.body
+const bulkDelete = async (userIds: string[], currentUserId: string) => {
+  if (userIds?.indexOf(currentUserId) !== -1) {
+    throw new Error("Unable to delete self.")
+  }
+  return await sdk.users.bulkDelete(userIds)
+}
 
-  if (!env.SELF_HOSTED && newUsersRequested.length > MAX_USERS_UPLOAD_LIMIT) {
-    ctx.throw(
-      400,
+const bulkCreate = async (users: User[], groupIds: string[]) => {
+  if (!env.SELF_HOSTED && users.length > MAX_USERS_UPLOAD_LIMIT) {
+    throw new Error(
       "Max limit for upload is 1000 users. Please reduce file size and try again."
     )
   }
+  return await sdk.users.bulkCreate(users, groupIds)
+}
 
-  const db = tenancy.getGlobalDB()
-  let groupsToSave: any[] = []
-
-  if (groups.length) {
-    for (const groupId of groups) {
-      let oldGroup = await db.get(groupId)
-      groupsToSave.push(oldGroup)
-    }
-  }
-
+export const bulkUpdate = async (ctx: any) => {
+  const currentUserId = ctx.user._id
+  const input = ctx.request.body as BulkUserRequest
+  let created, deleted
   try {
-    const response = await users.bulkCreate(newUsersRequested, groups)
-    await groupUtils.bulkSaveGroupUsers(groupsToSave, response.successful)
-
-    ctx.body = response
+    if (input.create) {
+      created = await bulkCreate(input.create.users, input.create.groups)
+    }
+    if (input.delete) {
+      deleted = await bulkDelete(input.delete.userIds, currentUserId)
+    }
   } catch (err: any) {
-    ctx.throw(err.status || 400, err)
+    ctx.throw(err.status || 400, err?.message || err)
   }
+  ctx.body = { created, deleted } as BulkUserResponse
 }
 
 const parseBooleanParam = (param: any) => {
@@ -99,7 +102,7 @@ export const adminUser = async (ctx: any) => {
       // always bust checklist beforehand, if an error occurs but can proceed, don't get
       // stuck in a cycle
       await cache.bustCache(cache.CacheKeys.CHECKLIST)
-      const finalUser = await users.save(user, {
+      const finalUser = await sdk.users.save(user, {
         hashPassword,
         requirePassword,
       })
@@ -121,7 +124,7 @@ export const adminUser = async (ctx: any) => {
 export const countByApp = async (ctx: any) => {
   const appId = ctx.params.appId
   try {
-    ctx.body = await users.countUsersByApp(appId)
+    ctx.body = await sdk.users.countUsersByApp(appId)
   } catch (err: any) {
     ctx.throw(err.status || 400, err)
   }
@@ -133,28 +136,15 @@ export const destroy = async (ctx: any) => {
     ctx.throw(400, "Unable to delete self.")
   }
 
-  await users.destroy(id, ctx.user)
+  await sdk.users.destroy(id, ctx.user)
 
   ctx.body = {
     message: `User ${id} deleted.`,
   }
 }
 
-export const bulkDelete = async (ctx: any) => {
-  const { userIds } = ctx.request.body as BulkDeleteUsersRequest
-  if (userIds?.indexOf(ctx.user._id) !== -1) {
-    ctx.throw(400, "Unable to delete self.")
-  }
-
-  try {
-    ctx.body = await users.bulkDelete(userIds)
-  } catch (err) {
-    ctx.throw(err)
-  }
-}
-
 export const search = async (ctx: any) => {
-  const paginated = await users.paginatedUsers(ctx.request.body)
+  const paginated = await sdk.users.paginatedUsers(ctx.request.body)
   // user hashed password shouldn't ever be returned
   for (let user of paginated.data) {
     if (user) {
@@ -166,7 +156,7 @@ export const search = async (ctx: any) => {
 
 // called internally by app server user fetch
 export const fetch = async (ctx: any) => {
-  const all = await users.allUsers()
+  const all = await sdk.users.allUsers()
   // user hashed password shouldn't ever be returned
   for (let user of all) {
     if (user) {
@@ -178,7 +168,7 @@ export const fetch = async (ctx: any) => {
 
 // called internally by app server user find
 export const find = async (ctx: any) => {
-  ctx.body = await users.getUser(ctx.params.id)
+  ctx.body = await sdk.users.getUser(ctx.params.id)
 }
 
 export const tenantUserLookup = async (ctx: any) => {
@@ -193,7 +183,7 @@ export const tenantUserLookup = async (ctx: any) => {
 
 export const invite = async (ctx: any) => {
   const request = ctx.request.body as InviteUserRequest
-  const response = await users.invite([request])
+  const response = await sdk.users.invite([request])
 
   // explicitly throw for single user invite
   if (response.unsuccessful.length) {
@@ -212,7 +202,7 @@ export const invite = async (ctx: any) => {
 
 export const inviteMultiple = async (ctx: any) => {
   const request = ctx.request.body as InviteUsersRequest
-  ctx.body = await users.invite(request)
+  ctx.body = await sdk.users.invite(request)
 }
 
 export const inviteAccept = async (ctx: any) => {
@@ -221,7 +211,7 @@ export const inviteAccept = async (ctx: any) => {
     // info is an extension of the user object that was stored by global
     const { email, info }: any = await checkInviteCode(inviteCode)
     ctx.body = await tenancy.doInTenant(info.tenantId, async () => {
-      const saved = await users.save({
+      const saved = await sdk.users.save({
         firstName,
         lastName,
         password,

package/src/api/controllers/system/accounts.ts

@@ -1,21 +1,21 @@
 import { Account, AccountMetadata } from "@budibase/types"
-import { accounts } from "../../../sdk"
+import sdk from "../../../sdk"
 
 export const save = async (ctx: any) => {
   const account = ctx.request.body as Account
   let metadata: AccountMetadata = {
-    _id: accounts.formatAccountMetadataId(account.accountId),
+    _id: sdk.accounts.formatAccountMetadataId(account.accountId),
     email: account.email,
   }
 
-  metadata = await accounts.saveMetadata(metadata)
+  metadata = await sdk.accounts.saveMetadata(metadata)
 
   ctx.body = metadata
   ctx.status = 200
 }
 
 export const destroy = async (ctx: any) => {
-  const accountId = accounts.formatAccountMetadataId(ctx.params.accountId)
-  await accounts.destroyMetadata(accountId)
+  const accountId = sdk.accounts.formatAccountMetadataId(ctx.params.accountId)
+  await sdk.accounts.destroyMetadata(accountId)
   ctx.status = 204
 }

package/src/api/routes/global/auth.js

@@ -4,7 +4,7 @@ const { joiValidator } = require("@budibase/backend-core/auth")
 const Joi = require("joi")
 const { updateTenantId } = require("@budibase/backend-core/tenancy")
 
-const router = Router()
+const router = new Router()
 
 function buildAuthValidation() {
   // prettier-ignore

package/src/api/routes/global/configs.js

@@ -5,7 +5,7 @@ const { adminOnly } = require("@budibase/backend-core/auth")
 const Joi = require("joi")
 const { Configs } = require("../../../constants")
 
-const router = Router()
+const router = new Router()
 
 function smtpValidation() {
   // prettier-ignore

package/src/api/routes/global/email.js

@@ -5,12 +5,20 @@ const { joiValidator } = require("@budibase/backend-core/auth")
 const { adminOnly } = require("@budibase/backend-core/auth")
 const Joi = require("joi")
 
-const router = Router()
+const router = new Router()
 
 function buildEmailSendValidation() {
   // prettier-ignore
   return joiValidator.body(Joi.object({
-    email: Joi.string().email(),
+    email: Joi.string().email({
+      multiple: true,
+    }),
+    cc: Joi.string().email({
+      multiple: true,
+    }).allow("", null),
+    bcc: Joi.string().email({
+      multiple: true,
+    }).allow("", null),
     purpose: Joi.string().valid(...Object.values(EmailTemplatePurpose)),
     workspaceId: Joi.string().allow("", null),
     from: Joi.string().allow("", null),

package/src/api/routes/global/license.ts

@@ -7,6 +7,7 @@ router
   .post("/api/global/license/activate", controller.activate)
   .post("/api/global/license/refresh", controller.refresh)
   .get("/api/global/license/info", controller.getInfo)
+  .delete("/api/global/license/info", controller.deleteInfo)
   .get("/api/global/license/usage", controller.getQuotaUsage)
 
 export = router

package/src/api/routes/global/roles.js

@@ -2,7 +2,7 @@ const Router = require("@koa/router")
 const controller = require("../../controllers/global/roles")
 const { builderOrAdmin } = require("@budibase/backend-core/auth")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/global/roles", builderOrAdmin, controller.fetch)

package/src/api/routes/global/self.ts

@@ -0,0 +1,18 @@
+import Router from "@koa/router"
+import * as controller from "../../controllers/global/self"
+import { auth } from "@budibase/backend-core"
+import { users } from "../validation"
+
+const router = new Router()
+
+router
+  .post("/api/global/self/api_key", auth.builderOnly, controller.generateAPIKey)
+  .get("/api/global/self/api_key", auth.builderOnly, controller.fetchAPIKey)
+  .get("/api/global/self", controller.getSelf)
+  .post(
+    "/api/global/self",
+    users.buildUserSaveValidation(true),
+    controller.updateSelf
+  )
+
+export default router as any

package/src/api/routes/global/{templates.js → templates.ts}

@@ -1,11 +1,11 @@
-const Router = require("@koa/router")
-const controller = require("../../controllers/global/templates")
-const { joiValidator } = require("@budibase/backend-core/auth")
-const Joi = require("joi")
-const { TemplatePurpose, TemplateTypes } = require("../../../constants")
-const { adminOnly } = require("@budibase/backend-core/auth")
+import Router from "@koa/router"
+import * as controller from "../../controllers/global/templates"
+import { TemplatePurpose, TemplateTypes } from "../../../constants"
+import { auth as authCore } from "@budibase/backend-core"
+import Joi from "joi"
+const { adminOnly, joiValidator } = authCore
 
-const router = Router()
+const router = new Router()
 
 function buildTemplateSaveValidation() {
   // prettier-ignore
@@ -34,4 +34,4 @@ router
   .get("/api/global/template/:id", controller.find)
   .delete("/api/global/template/:id/:rev", adminOnly, controller.destroy)
 
-module.exports = router
+export default router

package/src/api/routes/global/tests/users.spec.ts

@@ -97,16 +97,16 @@ describe("/api/global/users", () => {
     })
   })
 
-  describe("bulkCreate", () => {
+  describe("bulk (create)", () => {
     it("should ignore users existing in the same tenant", async () => {
       const user = await config.createUser()
       jest.clearAllMocks()
 
       const response = await api.users.bulkCreateUsers([user])
 
-      expect(response.successful.length).toBe(0)
-      expect(response.unsuccessful.length).toBe(1)
-      expect(response.unsuccessful[0].email).toBe(user.email)
+      expect(response.created?.successful.length).toBe(0)
+      expect(response.created?.unsuccessful.length).toBe(1)
+      expect(response.created?.unsuccessful[0].email).toBe(user.email)
       expect(events.user.created).toBeCalledTimes(0)
     })
 
@@ -117,9 +117,9 @@ describe("/api/global/users", () => {
       await tenancy.doInTenant(TENANT_1, async () => {
         const response = await api.users.bulkCreateUsers([user])
 
-        expect(response.successful.length).toBe(0)
-        expect(response.unsuccessful.length).toBe(1)
-        expect(response.unsuccessful[0].email).toBe(user.email)
+        expect(response.created?.successful.length).toBe(0)
+        expect(response.created?.unsuccessful.length).toBe(1)
+        expect(response.created?.unsuccessful[0].email).toBe(user.email)
         expect(events.user.created).toBeCalledTimes(0)
       })
     })
@@ -132,24 +132,24 @@ describe("/api/global/users", () => {
 
       const response = await api.users.bulkCreateUsers([user])
 
-      expect(response.successful.length).toBe(0)
-      expect(response.unsuccessful.length).toBe(1)
-      expect(response.unsuccessful[0].email).toBe(user.email)
+      expect(response.created?.successful.length).toBe(0)
+      expect(response.created?.unsuccessful.length).toBe(1)
+      expect(response.created?.unsuccessful[0].email).toBe(user.email)
       expect(events.user.created).toBeCalledTimes(0)
     })
 
-    it("should be able to bulkCreate users", async () => {
+    it("should be able to bulk create users", async () => {
       const builder = structures.users.builderUser()
       const admin = structures.users.adminUser()
       const user = structures.users.user()
 
       const response = await api.users.bulkCreateUsers([builder, admin, user])
 
-      expect(response.successful.length).toBe(3)
-      expect(response.successful[0].email).toBe(builder.email)
-      expect(response.successful[1].email).toBe(admin.email)
-      expect(response.successful[2].email).toBe(user.email)
-      expect(response.unsuccessful.length).toBe(0)
+      expect(response.created?.successful.length).toBe(3)
+      expect(response.created?.successful[0].email).toBe(builder.email)
+      expect(response.created?.successful[1].email).toBe(admin.email)
+      expect(response.created?.successful[2].email).toBe(user.email)
+      expect(response.created?.unsuccessful.length).toBe(0)
       expect(events.user.created).toBeCalledTimes(3)
       expect(events.user.permissionAdminAssigned).toBeCalledTimes(1)
       expect(events.user.permissionBuilderAssigned).toBeCalledTimes(2)
@@ -420,33 +420,30 @@ describe("/api/global/users", () => {
     })
   })
 
-  describe("bulkDelete", () => {
-    it("should not be able to bulkDelete current user", async () => {
+  describe("bulk (delete)", () => {
+    it("should not be able to bulk delete current user", async () => {
       const user = await config.defaultUser!
-      const request = { userIds: [user._id!] }
 
-      const response = await api.users.bulkDeleteUsers(request, 400)
+      const response = await api.users.bulkDeleteUsers([user._id!], 400)
 
-      expect(response.body.message).toBe("Unable to delete self.")
+      expect(response.message).toBe("Unable to delete self.")
       expect(events.user.deleted).not.toBeCalled()
     })
 
-    it("should not be able to bulkDelete account owner", async () => {
+    it("should not be able to bulk delete account owner", async () => {
       const user = await config.createUser()
       const account = structures.accounts.cloudAccount()
       account.budibaseUserId = user._id!
       mocks.accounts.getAccountByTenantId.mockReturnValue(account)
 
-      const request = { userIds: [user._id!] }
-
-      const response = await api.users.bulkDeleteUsers(request)
+      const response = await api.users.bulkDeleteUsers([user._id!])
 
-      expect(response.body.successful.length).toBe(0)
-      expect(response.body.unsuccessful.length).toBe(1)
-      expect(response.body.unsuccessful[0].reason).toBe(
+      expect(response.deleted?.successful.length).toBe(0)
+      expect(response.deleted?.unsuccessful.length).toBe(1)
+      expect(response.deleted?.unsuccessful[0].reason).toBe(
         "Account holder cannot be deleted"
       )
-      expect(response.body.unsuccessful[0]._id).toBe(user._id)
+      expect(response.deleted?.unsuccessful[0]._id).toBe(user._id)
       expect(events.user.deleted).not.toBeCalled()
     })
 
@@ -462,12 +459,14 @@ describe("/api/global/users", () => {
         admin,
         user,
       ])
-      const request = { userIds: createdUsers.successful.map(u => u._id!) }
 
-      const response = await api.users.bulkDeleteUsers(request)
+      const toDelete = createdUsers.created?.successful.map(
+        u => u._id!
+      ) as string[]
+      const response = await api.users.bulkDeleteUsers(toDelete)
 
-      expect(response.body.successful.length).toBe(3)
-      expect(response.body.unsuccessful.length).toBe(0)
+      expect(response.deleted?.successful.length).toBe(3)
+      expect(response.deleted?.unsuccessful.length).toBe(0)
       expect(events.user.deleted).toBeCalledTimes(3)
       expect(events.user.permissionAdminRemoved).toBeCalledTimes(1)
       expect(events.user.permissionBuilderRemoved).toBeCalledTimes(2)

package/src/api/routes/global/users.js

@@ -8,7 +8,7 @@ const { users } = require("../validation")
 const selfController = require("../../controllers/global/self")
 const { builderOrAdmin } = require("@budibase/backend-core/auth")
 
-const router = Router()
+const router = new Router()
 
 function buildAdminInitValidation() {
   return joiValidator.body(
@@ -56,16 +56,15 @@ router
     controller.save
   )
   .post(
-    "/api/global/users/bulkCreate",
+    "/api/global/users/bulk",
     adminOnly,
-    users.buildUserBulkSaveValidation(),
-    controller.bulkCreate
+    users.buildUserBulkUserValidation(),
+    controller.bulkUpdate
   )
 
   .get("/api/global/users", builderOrAdmin, controller.fetch)
   .post("/api/global/users/search", builderOrAdmin, controller.search)
   .delete("/api/global/users/:id", adminOnly, controller.destroy)
-  .post("/api/global/users/bulkDelete", adminOnly, controller.bulkDelete)
   .get("/api/global/users/count/:appId", builderOrAdmin, controller.countByApp)
   .get("/api/global/roles/:appId")
   .post(
@@ -74,12 +73,6 @@ router
     buildInviteValidation(),
     controller.invite
   )
-  .post(
-    "/api/global/users/invite",
-    adminOnly,
-    buildInviteValidation(),
-    controller.invite
-  )
   .post(
     "/api/global/users/multi/invite",
     adminOnly,

package/src/api/routes/global/workspaces.js

@@ -4,7 +4,7 @@ const { joiValidator } = require("@budibase/backend-core/auth")
 const { adminOnly } = require("@budibase/backend-core/auth")
 const Joi = require("joi")
 
-const router = Router()
+const router = new Router()
 
 function buildWorkspaceSaveValidation() {
   // prettier-ignore

package/src/api/routes/index.ts

@@ -0,0 +1,34 @@
+import { api } from "@budibase/pro"
+import userRoutes from "./global/users"
+import configRoutes from "./global/configs"
+import workspaceRoutes from "./global/workspaces"
+import templateRoutes from "./global/templates"
+import emailRoutes from "./global/email"
+import authRoutes from "./global/auth"
+import roleRoutes from "./global/roles"
+import environmentRoutes from "./system/environment"
+import tenantsRoutes from "./system/tenants"
+import statusRoutes from "./system/status"
+import selfRoutes from "./global/self"
+import licenseRoutes from "./global/license"
+import migrationRoutes from "./system/migrations"
+import accountRoutes from "./system/accounts"
+
+let userGroupRoutes = api.groups
+export const routes = [
+  configRoutes,
+  userRoutes,
+  workspaceRoutes,
+  authRoutes,
+  templateRoutes,
+  tenantsRoutes,
+  emailRoutes,
+  roleRoutes,
+  environmentRoutes,
+  statusRoutes,
+  selfRoutes,
+  licenseRoutes,
+  userGroupRoutes,
+  migrationRoutes,
+  accountRoutes,
+]

package/src/api/routes/system/environment.js

@@ -1,7 +1,7 @@
 const Router = require("@koa/router")
 const controller = require("../../controllers/system/environment")
 
-const router = Router()
+const router = new Router()
 
 router.get("/api/system/environment", controller.fetch)
 

package/src/api/routes/system/status.js

@@ -1,7 +1,7 @@
 const Router = require("@koa/router")
 const controller = require("../../controllers/system/status")
 
-const router = Router()
+const router = new Router()
 
 router.get("/api/system/status", controller.fetch)
 

package/src/api/routes/system/tenants.js

@@ -2,7 +2,7 @@ const Router = require("@koa/router")
 const controller = require("../../controllers/system/tenants")
 const { adminOnly } = require("@budibase/backend-core/auth")
 
-const router = Router()
+const router = new Router()
 
 router
   .get("/api/system/tenants/:tenantId/exists", controller.exists)

package/src/api/routes/system/tests/accounts.spec.ts

@@ -1,4 +1,4 @@
-import { accounts } from "../../../../sdk"
+import sdk from "../../../../sdk"
 import { TestConfiguration, structures, API } from "../../../../tests"
 import { v4 as uuid } from "uuid"
 
@@ -25,8 +25,8 @@ describe("accounts", () => {
 
         const response = await api.accounts.saveMetadata(account)
 
-        const id = accounts.formatAccountMetadataId(account.accountId)
-        const metadata = await accounts.getMetadata(id)
+        const id = sdk.accounts.formatAccountMetadataId(account.accountId)
+        const metadata = await sdk.accounts.getMetadata(id)
         expect(response).toStrictEqual(metadata)
       })
     })
@@ -38,7 +38,7 @@ describe("accounts", () => {
 
         await api.accounts.destroyMetadata(account.accountId)
 
-        const deleted = await accounts.getMetadata(account.accountId)
+        const deleted = await sdk.accounts.getMetadata(account.accountId)
         expect(deleted).toBe(undefined)
       })
 

package/src/api/routes/validation/users.ts

@@ -28,7 +28,7 @@ export const buildUserSaveValidation = (isSelf = false) => {
   return joiValidator.body(Joi.object(schema).required().unknown(true))
 }
 
-export const buildUserBulkSaveValidation = (isSelf = false) => {
+export const buildUserBulkUserValidation = (isSelf = false) => {
   if (!isSelf) {
     schema = {
       ...schema,
@@ -36,10 +36,15 @@ export const buildUserBulkSaveValidation = (isSelf = false) => {
       _rev: Joi.string(),
     }
   }
-  let bulkSaveSchema = {
-    groups: Joi.array().optional(),
-    users: Joi.array().items(Joi.object(schema).required().unknown(true)),
+  let bulkSchema = {
+    create: Joi.object({
+      groups: Joi.array().optional(),
+      users: Joi.array().items(Joi.object(schema).required().unknown(true)),
+    }),
+    delete: Joi.object({
+      userIds: Joi.array().items(Joi.string()),
+    }),
   }
 
-  return joiValidator.body(Joi.object(bulkSaveSchema).required().unknown(true))
+  return joiValidator.body(Joi.object(bulkSchema).required().unknown(true))
 }

package/src/db/index.js

@@ -3,7 +3,7 @@ const env = require("../environment")
 
 exports.init = () => {
   const dbConfig = {}
-  if (env.isTest()) {
+  if (env.isTest() && !env.COUCH_DB_URL) {
     dbConfig.inMemory = true
     dbConfig.allDbs = true
   }

package/src/migrations/functions/globalInfoSyncUsers.ts

@@ -1,5 +1,5 @@
 import { User } from "@budibase/types"
-import * as sdk from "../../sdk"
+import sdk from "../../sdk"
 
 /**
  * Date:

package/src/sdk/index.ts

@@ -1,2 +1,7 @@
-export * as users from "./users"
-export * as accounts from "./accounts"
+import * as users from "./users"
+import * as accounts from "./accounts"
+
+export default {
+  users,
+  accounts,
+}

package/src/sdk/users/users.ts

@@ -19,9 +19,7 @@ import {
 import {
   AccountMetadata,
   AllDocsResponse,
-  BulkCreateUsersResponse,
-  BulkDeleteUsersResponse,
-  BulkDocsResponse,
+  BulkUserResponse,
   CloudAccount,
   CreateUserResponse,
   InviteUsersRequest,
@@ -31,9 +29,9 @@ import {
   RowResponse,
   User,
 } from "@budibase/types"
-import { groups as groupUtils } from "@budibase/pro"
 import { sendEmail } from "../../utilities/email"
 import { EmailTemplatePurpose } from "../../constants"
+import { groups as groupsSdk } from "@budibase/pro"
 
 const PAGE_LIMIT = 8
 
@@ -349,8 +347,7 @@ const searchExistingEmails = async (emails: string[]) => {
 export const bulkCreate = async (
   newUsersRequested: User[],
   groups: string[]
-): Promise<BulkCreateUsersResponse> => {
-  const db = tenancy.getGlobalDB()
+): Promise<BulkUserResponse["created"]> => {
   const tenantId = tenancy.getTenantId()
 
   let usersToSave: any[] = []
@@ -392,9 +389,9 @@ export const bulkCreate = async (
   })
 
   const usersToBulkSave = await Promise.all(usersToSave)
-  await db.bulkDocs(usersToBulkSave)
+  await usersCore.bulkUpdateGlobalUsers(usersToBulkSave)
 
-  // Post processing of bulk added users, i.e events and cache operations
+  // Post-processing of bulk added users, e.g. events and cache operations
   for (const user of usersToBulkSave) {
     // TODO: Refactor to bulk insert users into the info db
     // instead of relying on looping tenant creation
@@ -410,6 +407,16 @@ export const bulkCreate = async (
     }
   })
 
+  // now update the groups
+  if (Array.isArray(saved) && groups) {
+    const groupPromises = []
+    const createdUserIds = saved.map(user => user._id)
+    for (let groupId of groups) {
+      groupPromises.push(groupsSdk.addUsers(groupId, createdUserIds))
+    }
+    await Promise.all(groupPromises)
+  }
+
   return {
     successful: saved,
     unsuccessful,
@@ -438,10 +445,10 @@ const getAccountHolderFromUserIds = async (
 
 export const bulkDelete = async (
   userIds: string[]
-): Promise<BulkDeleteUsersResponse> => {
+): Promise<BulkUserResponse["deleted"]> => {
   const db = tenancy.getGlobalDB()
 
-  const response: BulkDeleteUsersResponse = {
+  const response: BulkUserResponse["deleted"] = {
     successful: [],
     unsuccessful: [],
   }
@@ -458,7 +465,6 @@ export const bulkDelete = async (
     })
   }
 
-  let groupsToModify: any = {}
   // Get users and delete
   const allDocsResponse: AllDocsResponse<User> = await db.allDocs({
     include_docs: true,
@@ -466,33 +472,16 @@ export const bulkDelete = async (
   })
   const usersToDelete: User[] = allDocsResponse.rows.map(
     (user: RowResponse<User>) => {
-      // if we find a user that has an associated group, add it to
-      // an array so we can easily use allDocs on them later.
-      // This prevents us having to re-loop over all the users
-      if (user.doc.userGroups) {
-        for (let groupId of user.doc.userGroups) {
-          if (!Object.keys(groupsToModify).includes(groupId)) {
-            groupsToModify[groupId] = [user.id]
-          } else {
-            groupsToModify[groupId] = [...groupsToModify[groupId], user.id]
-          }
-        }
-      }
-
       return user.doc
     }
   )
 
   // Delete from DB
-  const dbResponse: BulkDocsResponse = await db.bulkDocs(
-    usersToDelete.map(user => ({
-      ...user,
-      _deleted: true,
-    }))
-  )
-
-  // Deletion post processing
-  await groupUtils.bulkDeleteGroupUsers(groupsToModify)
+  const toDelete = usersToDelete.map(user => ({
+    ...user,
+    _deleted: true,
+  }))
+  const dbResponse = await usersCore.bulkUpdateGlobalUsers(toDelete)
   for (let user of usersToDelete) {
     await bulkDeleteProcessing(user)
   }
@@ -526,7 +515,6 @@ export const destroy = async (id: string, currentUser: any) => {
   const db = tenancy.getGlobalDB()
   const dbUser = await db.get(id)
   const userId = dbUser._id as string
-  let groups = dbUser.userGroups
 
   if (!env.SELF_HOSTED && !env.DISABLE_ACCOUNT_PORTAL) {
     // root account holder can't be deleted from inside budibase
@@ -545,10 +533,6 @@ export const destroy = async (id: string, currentUser: any) => {
 
   await db.remove(userId, dbUser._rev)
 
-  if (groups) {
-    await groupUtils.deleteGroupUsers(groups, dbUser)
-  }
-
   await eventHelpers.handleDeleteEvents(dbUser)
   await cache.user.invalidateUser(userId)
   await sessions.invalidateSessions(userId, { reason: "deletion" })

package/src/tests/api/users.ts

@@ -1,8 +1,6 @@
 import {
-  BulkCreateUsersRequest,
-  BulkCreateUsersResponse,
-  BulkDeleteUsersRequest,
-  BulkDeleteUsersResponse,
+  BulkUserResponse,
+  BulkUserRequest,
   InviteUsersRequest,
   User,
 } from "@budibase/types"
@@ -69,24 +67,26 @@ export class UserAPI {
   // BULK
 
   bulkCreateUsers = async (users: User[], groups: any[] = []) => {
-    const body: BulkCreateUsersRequest = { users, groups }
+    const body: BulkUserRequest = { create: { users, groups } }
     const res = await this.request
-      .post(`/api/global/users/bulkCreate`)
+      .post(`/api/global/users/bulk`)
       .send(body)
       .set(this.config.defaultHeaders())
       .expect("Content-Type", /json/)
       .expect(200)
 
-    return res.body as BulkCreateUsersResponse
+    return res.body as BulkUserResponse
   }
 
-  bulkDeleteUsers = (body: BulkDeleteUsersRequest, status?: number) => {
-    return this.request
-      .post(`/api/global/users/bulkDelete`)
+  bulkDeleteUsers = async (userIds: string[], status?: number) => {
+    const body: BulkUserRequest = { delete: { userIds } }
+    const res = await this.request
+      .post(`/api/global/users/bulk`)
       .send(body)
       .set(this.config.defaultHeaders())
       .expect("Content-Type", /json/)
       .expect(status ? status : 200)
+    return res.body as BulkUserResponse
   }
 
   // USER

package/src/utilities/email.js

@@ -174,7 +174,7 @@ exports.isEmailConfigured = async (workspaceId = null) => {
 exports.sendEmail = async (
   email,
   purpose,
-  { workspaceId, user, from, contents, subject, info, automation } = {}
+  { workspaceId, user, from, contents, subject, info, cc, bcc, automation } = {}
 ) => {
   const db = getGlobalDB()
   let config = (await getSmtpConfiguration(db, workspaceId, automation)) || {}
@@ -197,6 +197,8 @@ exports.sendEmail = async (
   message = {
     ...message,
     to: email,
+    cc: cc,
+    bcc: bcc,
   }
 
   if (subject || config.subject) {

package/src/api/routes/global/self.js

@@ -1,18 +0,0 @@
-const Router = require("@koa/router")
-const controller = require("../../controllers/global/self")
-const { builderOnly } = require("@budibase/backend-core/auth")
-const { users } = require("../validation")
-
-const router = Router()
-
-router
-  .post("/api/global/self/api_key", builderOnly, controller.generateAPIKey)
-  .get("/api/global/self/api_key", builderOnly, controller.fetchAPIKey)
-  .get("/api/global/self", controller.getSelf)
-  .post(
-    "/api/global/self",
-    users.buildUserSaveValidation(true),
-    controller.updateSelf
-  )
-
-module.exports = router

package/src/api/routes/index.js

@@ -1,34 +0,0 @@
-const { api } = require("@budibase/pro")
-const userRoutes = require("./global/users")
-const configRoutes = require("./global/configs")
-const workspaceRoutes = require("./global/workspaces")
-const templateRoutes = require("./global/templates")
-const emailRoutes = require("./global/email")
-const authRoutes = require("./global/auth")
-const roleRoutes = require("./global/roles")
-const environmentRoutes = require("./system/environment")
-const tenantsRoutes = require("./system/tenants")
-const statusRoutes = require("./system/status")
-const selfRoutes = require("./global/self")
-const licenseRoutes = require("./global/license")
-const migrationRoutes = require("./system/migrations")
-const accountRoutes = require("./system/accounts")
-
-let userGroupRoutes = api.groups
-exports.routes = [
-  configRoutes,
-  userRoutes,
-  workspaceRoutes,
-  authRoutes,
-  templateRoutes,
-  tenantsRoutes,
-  emailRoutes,
-  roleRoutes,
-  environmentRoutes,
-  statusRoutes,
-  selfRoutes,
-  licenseRoutes,
-  userGroupRoutes,
-  migrationRoutes,
-  accountRoutes,
-]