@budibase/worker 2.1.22-alpha.5 → 2.1.22-alpha.6

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/worker",
   "email": "hi@budibase.com",
-  "version": "2.1.22-alpha.5",
+  "version": "2.1.22-alpha.6",
   "description": "Budibase background service",
   "main": "src/index.ts",
   "repository": {
@@ -36,10 +36,10 @@
   "author": "Budibase",
   "license": "GPL-3.0",
   "dependencies": {
-    "@budibase/backend-core": "2.1.22-alpha.5",
-    "@budibase/pro": "2.1.22-alpha.4",
-    "@budibase/string-templates": "2.1.22-alpha.5",
-    "@budibase/types": "2.1.22-alpha.5",
+    "@budibase/backend-core": "2.1.22-alpha.6",
+    "@budibase/pro": "2.1.22-alpha.5",
+    "@budibase/string-templates": "2.1.22-alpha.6",
+    "@budibase/types": "2.1.22-alpha.6",
     "@koa/router": "8.0.8",
     "@sentry/node": "6.17.7",
     "@techpass/passport-openidconnect": "0.3.2",
@@ -71,9 +71,11 @@
   },
   "devDependencies": {
     "@types/jest": "26.0.23",
+    "@types/jsonwebtoken": "8.5.1",
     "@types/koa": "2.13.4",
     "@types/koa__router": "8.0.11",
     "@types/node": "14.18.20",
+    "@types/node-fetch": "2.6.1",
     "@types/pouchdb": "6.4.0",
     "@types/uuid": "8.3.4",
     "@typescript-eslint/parser": "5.12.0",
@@ -92,5 +94,5 @@
     "typescript": "4.7.3",
     "update-dotenv": "1.1.1"
   },
-  "gitHead": "0367d466c3c566be54d45d040654929966c836ff"
+  "gitHead": "395a9a21c27c534fd2b4297f5d0d19a341089993"
 }

package/scripts/localdomain.js

@@ -2,6 +2,36 @@
 const updateDotEnv = require("update-dotenv")
 
 const arg = process.argv.slice(2)[0]
+const isEnable = arg === "enable"
+
+let domain = process.argv.slice(2)[1]
+if (!domain) {
+  domain = "local.com"
+}
+
+const getAccountPortalUrl = () => {
+  if (isEnable) {
+    return `http://account.${domain}:10001`
+  } else {
+    return `http://localhost:10001`
+  }
+}
+
+const getBudibaseUrl = () => {
+  if (isEnable) {
+    return `http://${domain}:10000`
+  } else {
+    return `http://localhost:10000`
+  }
+}
+
+const getCookieDomain = () => {
+  if (isEnable) {
+    return `.${domain}`
+  } else {
+    return ""
+  }
+}
 
 /**
  * For testing multi tenancy sub domains locally.
@@ -16,11 +46,7 @@ const arg = process.argv.slice(2)[0]
  * 127.0.0.1   t2.local.com
  */
 updateDotEnv({
-  ACCOUNT_PORTAL_URL:
-    arg === "enable"
-      ? "http://account.local.com:10001"
-      : "http://localhost:10001",
-  COOKIE_DOMAIN: arg === "enable" ? ".local.com" : "",
-  PLATFORM_URL:
-    arg === "enable" ? "http://local.com:10000" : "http://localhost:10000",
+  ACCOUNT_PORTAL_URL: getAccountPortalUrl(),
+  COOKIE_DOMAIN: getCookieDomain(),
+  PLATFORM_URL: getBudibaseUrl(),
 }).then(() => console.log("Updated worker!"))

package/src/api/controllers/global/auth.ts

@@ -1,4 +1,4 @@
-const core = require("@budibase/backend-core")
+import core from "@budibase/backend-core"
 const { Configs, EmailTemplatePurpose } = require("../../../constants")
 const { sendEmail, isEmailConfigured } = require("../../../utilities/email")
 const { setCookie, getCookie, clearCookie, hash, platformLogout } = core.utils

package/src/api/controllers/global/users.ts

@@ -5,6 +5,7 @@ import {
   BulkUserRequest,
   BulkUserResponse,
   CloudAccount,
+  CreateAdminUserRequest,
   InviteUserRequest,
   InviteUsersRequest,
   SearchUsersRequest,
@@ -67,7 +68,8 @@ const parseBooleanParam = (param: any) => {
 }
 
 export const adminUser = async (ctx: any) => {
-  const { email, password, tenantId } = ctx.request.body
+  const { email, password, tenantId } = ctx.request
+    .body as CreateAdminUserRequest
   await tenancy.doInTenant(tenantId, async () => {
     // account portal sends a pre-hashed password - honour param to prevent double hashing
     const hashPassword = parseBooleanParam(ctx.request.query.hashPassword)

package/src/api/controllers/system/{environment.js → environment.ts}

@@ -1,6 +1,7 @@
-const env = require("../../../environment")
+import { BBContext } from "@budibase/types"
+import env from "../../../environment"
 
-exports.fetch = async ctx => {
+export const fetch = async (ctx: BBContext) => {
   ctx.body = {
     multiTenancy: !!env.MULTI_TENANCY,
     cloud: !env.SELF_HOSTED,

package/src/api/controllers/system/{status.js → status.ts}

@@ -1,7 +1,8 @@
-const accounts = require("@budibase/backend-core/accounts")
-const env = require("../../../environment")
+import { accounts } from "@budibase/backend-core"
+import env from "../../../environment"
+import { BBContext } from "@budibase/types"
 
-exports.fetch = async ctx => {
+export const fetch = async (ctx: BBContext) => {
   if (!env.SELF_HOSTED && !env.DISABLE_ACCOUNT_PORTAL) {
     const status = await accounts.getStatus()
     ctx.body = status

package/src/api/controllers/system/tenants.ts

@@ -1,61 +1,18 @@
-const { StaticDatabases, doWithDB } = require("@budibase/backend-core/db")
-const { getTenantId } = require("@budibase/backend-core/tenancy")
-const { deleteTenant } = require("@budibase/backend-core/deprovision")
+import { BBContext } from "@budibase/types"
+import { deprovisioning } from "@budibase/backend-core"
 import { quotas } from "@budibase/pro"
 
-export const exists = async (ctx: any) => {
-  const tenantId = ctx.request.params
-  ctx.body = {
-    exists: await doWithDB(
-      StaticDatabases.PLATFORM_INFO.name,
-      async (db: any) => {
-        let exists = false
-        try {
-          const tenantsDoc = await db.get(
-            StaticDatabases.PLATFORM_INFO.docs.tenants
-          )
-          if (tenantsDoc) {
-            exists = tenantsDoc.tenantIds.indexOf(tenantId) !== -1
-          }
-        } catch (err) {
-          // if error it doesn't exist
-        }
-        return exists
-      }
-    ),
-  }
-}
-
-export const fetch = async (ctx: any) => {
-  ctx.body = await doWithDB(
-    StaticDatabases.PLATFORM_INFO.name,
-    async (db: any) => {
-      let tenants = []
-      try {
-        const tenantsDoc = await db.get(
-          StaticDatabases.PLATFORM_INFO.docs.tenants
-        )
-        if (tenantsDoc) {
-          tenants = tenantsDoc.tenantIds
-        }
-      } catch (err) {
-        // if error it doesn't exist
-      }
-      return tenants
-    }
-  )
-}
-
-const _delete = async (ctx: any) => {
-  const tenantId = getTenantId()
+const _delete = async (ctx: BBContext) => {
+  const user = ctx.user!
+  const tenantId = ctx.params.tenantId
 
-  if (ctx.params.tenantId !== tenantId) {
-    ctx.throw(403, "Unauthorized")
+  if (tenantId !== user.tenantId) {
+    ctx.throw(403, "Tenant ID does not match current user")
   }
 
   try {
-    await deleteTenant(tenantId)
     await quotas.bustCache()
+    await deprovisioning.deleteTenant(tenantId)
     ctx.status = 204
   } catch (err) {
     ctx.log.error(err)

package/src/api/index.ts

@@ -7,11 +7,12 @@ import { errors, auth, middleware } from "@budibase/backend-core"
 import { APIError } from "@budibase/types"
 
 const PUBLIC_ENDPOINTS = [
-  // old deprecated endpoints kept for backwards compat
+  // deprecated single tenant sso callback
   {
     route: "/api/admin/auth/google/callback",
     method: "GET",
   },
+  // deprecated single tenant sso callback
   {
     route: "/api/admin/auth/oidc/callback",
     method: "GET",
@@ -44,17 +45,19 @@ const PUBLIC_ENDPOINTS = [
     method: "POST",
   },
   {
-    route: "api/system/environment",
+    route: "/api/system/environment",
     method: "GET",
   },
   {
-    route: "api/system/status",
+    route: "/api/system/status",
     method: "GET",
   },
+  // TODO: This should be an internal api
   {
     route: "/api/global/users/tenant/:id",
     method: "GET",
   },
+  // TODO: This should be an internal api
   {
     route: "/api/system/restored",
     method: "POST",
@@ -62,17 +65,37 @@ const PUBLIC_ENDPOINTS = [
 ]
 
 const NO_TENANCY_ENDPOINTS = [
-  ...PUBLIC_ENDPOINTS,
+  // system endpoints are not specific to any tenant
   {
     route: "/api/system",
     method: "ALL",
   },
+  // tenant is determined in request body
+  // used for creating the tenant
   {
-    route: "/api/global/users/self",
+    route: "/api/global/users/init",
+    method: "POST",
+  },
+  // deprecated single tenant sso callback
+  {
+    route: "/api/admin/auth/google/callback",
+    method: "GET",
+  },
+  // deprecated single tenant sso callback
+  {
+    route: "/api/admin/auth/oidc/callback",
     method: "GET",
   },
+  // tenant is determined from code in redis
   {
-    route: "/api/global/self",
+    route: "/api/global/users/invite/accept",
+    method: "POST",
+  },
+  // global user search - no tenancy
+  // :id is user id
+  // TODO: this should really be `/api/system/users/:id`
+  {
+    route: "/api/global/users/tenant/:id",
     method: "GET",
   },
 ]

package/src/api/routes/global/auth.js

@@ -2,7 +2,6 @@ const Router = require("@koa/router")
 const authController = require("../../controllers/global/auth")
 const { joiValidator } = require("@budibase/backend-core/auth")
 const Joi = require("joi")
-const { updateTenantId } = require("@budibase/backend-core/tenancy")
 
 const router = new Router()
 
@@ -29,77 +28,61 @@ function buildResetUpdateValidation() {
   }).required().unknown(false))
 }
 
-function updateTenant(ctx, next) {
-  if (ctx.params) {
-    updateTenantId(ctx.params.tenantId)
-  }
-  return next()
-}
-
 router
+  // PASSWORD
   .post(
     "/api/global/auth/:tenantId/login",
     buildAuthValidation(),
-    updateTenant,
     authController.authenticate
   )
+  .post("/api/global/auth/logout", authController.logout)
   .post(
     "/api/global/auth/:tenantId/reset",
     buildResetValidation(),
-    updateTenant,
     authController.reset
   )
   .post(
     "/api/global/auth/:tenantId/reset/update",
     buildResetUpdateValidation(),
-    updateTenant,
     authController.resetUpdate
   )
-  .post("/api/global/auth/logout", authController.logout)
+  // INIT
   .post("/api/global/auth/init", authController.setInitInfo)
   .get("/api/global/auth/init", authController.getInitInfo)
-  .get(
-    "/api/global/auth/:tenantId/google",
-    updateTenant,
-    authController.googlePreAuth
-  )
+
+  // DATASOURCE - MULTI TENANT
   .get(
     "/api/global/auth/:tenantId/datasource/:provider",
-    updateTenant,
     authController.datasourcePreAuth
   )
-  // single tenancy endpoint
-  .get("/api/global/auth/google/callback", authController.googleAuth)
   .get(
-    "/api/global/auth/datasource/:provider/callback",
+    "/api/global/auth/:tenantId/datasource/:provider/callback",
     authController.datasourceAuth
   )
-  // multi-tenancy endpoint
-  .get(
-    "/api/global/auth/:tenantId/google/callback",
-    updateTenant,
-    authController.googleAuth
-  )
+
+  // DATASOURCE - SINGLE TENANT - DEPRECATED
   .get(
-    "/api/global/auth/:tenantId/datasource/:provider/callback",
-    updateTenant,
+    "/api/global/auth/datasource/:provider/callback",
     authController.datasourceAuth
   )
+
+  // GOOGLE - MULTI TENANT
+  .get("/api/global/auth/:tenantId/google", authController.googlePreAuth)
+  .get("/api/global/auth/:tenantId/google/callback", authController.googleAuth)
+
+  // GOOGLE - SINGLE TENANT - DEPRECATED
+  .get("/api/global/auth/google/callback", authController.googleAuth)
+  .get("/api/admin/auth/google/callback", authController.googleAuth)
+
+  // OIDC - MULTI TENANT
   .get(
     "/api/global/auth/:tenantId/oidc/configs/:configId",
-    updateTenant,
     authController.oidcPreAuth
   )
-  // single tenancy endpoint
+  .get("/api/global/auth/:tenantId/oidc/callback", authController.oidcAuth)
+
+  // OIDC - SINGLE TENANT - DEPRECATED
   .get("/api/global/auth/oidc/callback", authController.oidcAuth)
-  // multi-tenancy endpoint
-  .get(
-    "/api/global/auth/:tenantId/oidc/callback",
-    updateTenant,
-    authController.oidcAuth
-  )
-  // deprecated - used by the default system before tenancy
-  .get("/api/admin/auth/google/callback", authController.googleAuth)
   .get("/api/admin/auth/oidc/callback", authController.oidcAuth)
 
 module.exports = router

package/src/api/routes/global/tests/auth.spec.ts

@@ -1,11 +1,16 @@
 jest.mock("nodemailer")
-import { TestConfiguration, mocks, API } from "../../../../tests"
+import { TestConfiguration, mocks } from "../../../../tests"
 const sendMailMock = mocks.email.mock()
 import { events } from "@budibase/backend-core"
 
+const expectSetAuthCookie = (res: any) => {
+  expect(
+    res.get("Set-Cookie").find((c: string) => c.startsWith("budibase:auth"))
+  ).toBeDefined()
+}
+
 describe("/api/global/auth", () => {
   const config = new TestConfiguration()
-  const api = new API(config)
 
   beforeAll(async () => {
     await config.beforeAll()
@@ -19,90 +24,155 @@ describe("/api/global/auth", () => {
     jest.clearAllMocks()
   })
 
-  it("should logout", async () => {
-    await api.auth.logout()
-    expect(events.auth.logout).toBeCalledTimes(1)
-  })
+  describe("password", () => {
+    describe("POST /api/global/auth/:tenantId/login", () => {
+      it("should login", () => {})
+    })
 
-  it("should be able to generate password reset email", async () => {
-    const { res, code } = await api.auth.requestPasswordReset(sendMailMock)
-    const user = await config.getUser("test@test.com")
+    describe("POST /api/global/auth/logout", () => {
+      it("should logout", async () => {
+        await config.api.auth.logout()
+        expect(events.auth.logout).toBeCalledTimes(1)
 
-    expect(res.body).toEqual({
-      message: "Please check your email for a reset link.",
+        // TODO: Verify sessions deleted
+      })
     })
-    expect(sendMailMock).toHaveBeenCalled()
 
-    expect(code).toBeDefined()
-    expect(events.user.passwordResetRequested).toBeCalledTimes(1)
-    expect(events.user.passwordResetRequested).toBeCalledWith(user)
+    describe("POST /api/global/auth/:tenantId/reset", () => {
+      it("should generate password reset email", async () => {
+        const { res, code } = await config.api.auth.requestPasswordReset(
+          sendMailMock
+        )
+        const user = await config.getUser("test@test.com")
+
+        expect(res.body).toEqual({
+          message: "Please check your email for a reset link.",
+        })
+        expect(sendMailMock).toHaveBeenCalled()
+
+        expect(code).toBeDefined()
+        expect(events.user.passwordResetRequested).toBeCalledTimes(1)
+        expect(events.user.passwordResetRequested).toBeCalledWith(user)
+      })
+    })
+
+    describe("POST /api/global/auth/:tenantId/reset/update", () => {
+      it("should reset password", async () => {
+        const { code } = await config.api.auth.requestPasswordReset(
+          sendMailMock
+        )
+        const user = await config.getUser("test@test.com")
+        delete user.password
+
+        const res = await config.api.auth.updatePassword(code)
+
+        expect(res.body).toEqual({ message: "password reset successfully." })
+        expect(events.user.passwordReset).toBeCalledTimes(1)
+        expect(events.user.passwordReset).toBeCalledWith(user)
+
+        // TODO: Login using new password
+      })
+    })
+  })
+
+  describe("init", () => {
+    describe("POST /api/global/auth/init", () => {})
+
+    describe("GET /api/global/auth/init", () => {})
   })
 
-  it("should allow resetting user password with code", async () => {
-    const { code } = await api.auth.requestPasswordReset(sendMailMock)
-    const user = await config.getUser("test@test.com")
-    delete user.password
+  describe("datasource", () => {
+    // MULTI TENANT
+
+    describe("GET /api/global/auth/:tenantId/datasource/:provider", () => {})
+
+    describe("GET /api/global/auth/:tenantId/datasource/:provider/callback", () => {})
 
-    const res = await api.auth.updatePassword(code)
+    // SINGLE TENANT
 
-    expect(res.body).toEqual({ message: "password reset successfully." })
-    expect(events.user.passwordReset).toBeCalledTimes(1)
-    expect(events.user.passwordReset).toBeCalledWith(user)
+    describe("GET /api/global/auth/datasource/:provider/callback", () => {})
   })
 
-  describe("oidc", () => {
-    const auth = require("@budibase/backend-core/auth")
+  describe("google", () => {
+    // MULTI TENANT
+
+    describe("GET /api/global/auth/:tenantId/google", () => {})
 
-    const passportSpy = jest.spyOn(auth.passport, "authenticate")
-    let oidcConf
-    let chosenConfig: any
-    let configId: string
+    describe("GET /api/global/auth/:tenantId/google/callback", () => {})
 
-    // mock the oidc strategy implementation and return value
-    let strategyFactory = jest.fn()
-    let mockStrategyReturn = jest.fn()
-    let mockStrategyConfig = jest.fn()
-    auth.oidc.fetchStrategyConfig = mockStrategyConfig
+    // SINGLE TENANT
 
-    strategyFactory.mockReturnValue(mockStrategyReturn)
-    auth.oidc.strategyFactory = strategyFactory
+    describe("GET /api/global/auth/google/callback", () => {})
 
+    describe("GET /api/admin/auth/google/callback", () => {})
+  })
+
+  describe("oidc", () => {
     beforeEach(async () => {
-      oidcConf = await config.saveOIDCConfig()
-      chosenConfig = oidcConf.config.configs[0]
-      configId = chosenConfig.uuid
-      mockStrategyConfig.mockReturnValue(chosenConfig)
-    })
+      jest.clearAllMocks()
+      mockGetWellKnownConfig()
 
-    afterEach(() => {
-      expect(strategyFactory).toBeCalledWith(chosenConfig, expect.any(Function))
+      // see: __mocks__/oauth
+      // for associated mocking inside passport
     })
 
-    describe("oidc configs", () => {
-      it("should load strategy and delegate to passport", async () => {
-        await api.configs.getOIDCConfig(configId)
-
-        expect(passportSpy).toBeCalledWith(mockStrategyReturn, {
-          scope: ["profile", "email", "offline_access"],
-        })
-        expect(passportSpy.mock.calls.length).toBe(1)
+    const generateOidcConfig = async () => {
+      const oidcConf = await config.saveOIDCConfig()
+      const chosenConfig = oidcConf.config.configs[0]
+      return chosenConfig.uuid
+    }
+
+    const mockGetWellKnownConfig = () => {
+      mocks.fetch.mockReturnValue({
+        ok: true,
+        json: () => ({
+          issuer: "test",
+          authorization_endpoint: "http://localhost/auth",
+          token_endpoint: "http://localhost/token",
+          userinfo_endpoint: "http://localhost/userinfo",
+        }),
+      })
+    }
+
+    // MULTI TENANT
+    describe("GET /api/global/auth/:tenantId/oidc/configs/:configId", () => {
+      it("redirects to auth provider", async () => {
+        const configId = await generateOidcConfig()
+
+        const res = await config.api.configs.getOIDCConfig(configId)
+
+        expect(res.status).toBe(302)
+        const location: string = res.get("location")
+        expect(
+          location.startsWith(
+            "http://localhost/auth?response_type=code&client_id=clientId&redirect_uri=http%3A%2F%2Flocalhost%3A10000%2Fapi%2Fglobal%2Fauth%2Fdefault%2Foidc%2Fcallback&scope=openid%20profile%20email%20offline_access"
+          )
+        ).toBe(true)
       })
     })
 
-    describe("oidc callback", () => {
-      it("should load strategy and delegate to passport", async () => {
-        await api.configs.OIDCCallback(configId)
-
-        expect(passportSpy).toBeCalledWith(
-          mockStrategyReturn,
-          {
-            successRedirect: "/",
-            failureRedirect: "/error",
-          },
-          expect.anything()
-        )
-        expect(passportSpy.mock.calls.length).toBe(1)
+    describe("GET /api/global/auth/:tenantId/oidc/callback", () => {
+      it("logs in", async () => {
+        const configId = await generateOidcConfig()
+        const preAuthRes = await config.api.configs.getOIDCConfig(configId)
+
+        const res = await config.api.configs.OIDCCallback(configId, preAuthRes)
+
+        expect(events.auth.login).toBeCalledWith("oidc")
+        expect(events.auth.login).toBeCalledTimes(1)
+        expect(res.status).toBe(302)
+        const location: string = res.get("location")
+        expect(location).toBe("/")
+        expectSetAuthCookie(res)
       })
     })
+
+    // SINGLE TENANT
+
+    describe("GET /api/global/auth/oidc/callback", () => {})
+
+    describe("GET /api/global/auth/oidc/callback", () => {})
+
+    describe("GET /api/admin/auth/oidc/callback", () => {})
   })
 })