@budibase/worker 2.1.43-alpha.6 → 2.1.44

package/src/api/controllers/system/restore.ts

@@ -6,7 +6,7 @@ export async function systemRestored(ctx: BBContext) {
   if (!env.SELF_HOSTED) {
     ctx.throw(405, "This operation is not allowed in cloud.")
   }
-  await cache.bustCache(cache.CacheKey.CHECKLIST)
+  await cache.bustCache(cache.CacheKeys.CHECKLIST)
   ctx.body = {
     message: "System prepared after restore.",
   }

package/src/api/controllers/system/{status.ts → status.js}

@@ -1,8 +1,7 @@
-import { accounts } from "@budibase/backend-core"
-import env from "../../../environment"
-import { BBContext } from "@budibase/types"
+const accounts = require("@budibase/backend-core/accounts")
+const env = require("../../../environment")
 
-export const fetch = async (ctx: BBContext) => {
+exports.fetch = async ctx => {
   if (!env.SELF_HOSTED && !env.DISABLE_ACCOUNT_PORTAL) {
     const status = await accounts.getStatus()
     ctx.body = status

package/src/api/controllers/system/tenants.ts

@@ -1,18 +1,61 @@
-import { BBContext } from "@budibase/types"
-import { deprovisioning } from "@budibase/backend-core"
+const { StaticDatabases, doWithDB } = require("@budibase/backend-core/db")
+const { getTenantId } = require("@budibase/backend-core/tenancy")
+const { deleteTenant } = require("@budibase/backend-core/deprovision")
 import { quotas } from "@budibase/pro"
 
-const _delete = async (ctx: BBContext) => {
-  const user = ctx.user!
-  const tenantId = ctx.params.tenantId
+export const exists = async (ctx: any) => {
+  const tenantId = ctx.request.params
+  ctx.body = {
+    exists: await doWithDB(
+      StaticDatabases.PLATFORM_INFO.name,
+      async (db: any) => {
+        let exists = false
+        try {
+          const tenantsDoc = await db.get(
+            StaticDatabases.PLATFORM_INFO.docs.tenants
+          )
+          if (tenantsDoc) {
+            exists = tenantsDoc.tenantIds.indexOf(tenantId) !== -1
+          }
+        } catch (err) {
+          // if error it doesn't exist
+        }
+        return exists
+      }
+    ),
+  }
+}
+
+export const fetch = async (ctx: any) => {
+  ctx.body = await doWithDB(
+    StaticDatabases.PLATFORM_INFO.name,
+    async (db: any) => {
+      let tenants = []
+      try {
+        const tenantsDoc = await db.get(
+          StaticDatabases.PLATFORM_INFO.docs.tenants
+        )
+        if (tenantsDoc) {
+          tenants = tenantsDoc.tenantIds
+        }
+      } catch (err) {
+        // if error it doesn't exist
+      }
+      return tenants
+    }
+  )
+}
+
+const _delete = async (ctx: any) => {
+  const tenantId = getTenantId()
 
-  if (tenantId !== user.tenantId) {
-    ctx.throw(403, "Tenant ID does not match current user")
+  if (ctx.params.tenantId !== tenantId) {
+    ctx.throw(403, "Unauthorized")
   }
 
   try {
+    await deleteTenant(tenantId)
     await quotas.bustCache()
-    await deprovisioning.deleteTenant(tenantId)
     ctx.status = 204
   } catch (err) {
     ctx.log.error(err)

package/src/api/index.ts

@@ -7,12 +7,11 @@ import { errors, auth, middleware } from "@budibase/backend-core"
 import { APIError } from "@budibase/types"
 
 const PUBLIC_ENDPOINTS = [
-  // deprecated single tenant sso callback
+  // old deprecated endpoints kept for backwards compat
   {
     route: "/api/admin/auth/google/callback",
     method: "GET",
   },
-  // deprecated single tenant sso callback
   {
     route: "/api/admin/auth/oidc/callback",
     method: "GET",
@@ -45,19 +44,17 @@ const PUBLIC_ENDPOINTS = [
     method: "POST",
   },
   {
-    route: "/api/system/environment",
+    route: "api/system/environment",
     method: "GET",
   },
   {
-    route: "/api/system/status",
+    route: "api/system/status",
     method: "GET",
   },
-  // TODO: This should be an internal api
   {
     route: "/api/global/users/tenant/:id",
     method: "GET",
   },
-  // TODO: This should be an internal api
   {
     route: "/api/system/restored",
     method: "POST",
@@ -65,37 +62,17 @@ const PUBLIC_ENDPOINTS = [
 ]
 
 const NO_TENANCY_ENDPOINTS = [
-  // system endpoints are not specific to any tenant
+  ...PUBLIC_ENDPOINTS,
   {
     route: "/api/system",
     method: "ALL",
   },
-  // tenant is determined in request body
-  // used for creating the tenant
   {
-    route: "/api/global/users/init",
-    method: "POST",
-  },
-  // deprecated single tenant sso callback
-  {
-    route: "/api/admin/auth/google/callback",
-    method: "GET",
-  },
-  // deprecated single tenant sso callback
-  {
-    route: "/api/admin/auth/oidc/callback",
+    route: "/api/global/users/self",
     method: "GET",
   },
-  // tenant is determined from code in redis
   {
-    route: "/api/global/users/invite/accept",
-    method: "POST",
-  },
-  // global user search - no tenancy
-  // :id is user id
-  // TODO: this should really be `/api/system/users/:id`
-  {
-    route: "/api/global/users/tenant/:id",
+    route: "/api/global/self",
     method: "GET",
   },
 ]
@@ -104,7 +81,7 @@ const NO_TENANCY_ENDPOINTS = [
 // add them all to be safe
 const NO_CSRF_ENDPOINTS = [...PUBLIC_ENDPOINTS]
 
-const router: Router = new Router()
+const router = new Router()
 router
   .use(
     compress({
@@ -163,4 +140,4 @@ for (let route of routes) {
   router.use(route.allowedMethods())
 }
 
-export default router
+module.exports = router

package/src/api/routes/global/{auth.ts → auth.js}

@@ -1,13 +1,14 @@
-import Router from "@koa/router"
-import * as authController from "../../controllers/global/auth"
-import { auth } from "@budibase/backend-core"
-import Joi from "joi"
+const Router = require("@koa/router")
+const authController = require("../../controllers/global/auth")
+const { joiValidator } = require("@budibase/backend-core/auth")
+const Joi = require("joi")
+const { updateTenantId } = require("@budibase/backend-core/tenancy")
 
-const router: Router = new Router()
+const router = new Router()
 
 function buildAuthValidation() {
   // prettier-ignore
-  return auth.joiValidator.body(Joi.object({
+  return joiValidator.body(Joi.object({
     username: Joi.string().required(),
     password: Joi.string().required(),
   }).required().unknown(false))
@@ -15,74 +16,90 @@ function buildAuthValidation() {
 
 function buildResetValidation() {
   // prettier-ignore
-  return auth.joiValidator.body(Joi.object({
+  return joiValidator.body(Joi.object({
     email: Joi.string().required(),
   }).required().unknown(false))
 }
 
 function buildResetUpdateValidation() {
   // prettier-ignore
-  return auth.joiValidator.body(Joi.object({
+  return joiValidator.body(Joi.object({
     resetCode: Joi.string().required(),
     password: Joi.string().required(),
   }).required().unknown(false))
 }
 
+function updateTenant(ctx, next) {
+  if (ctx.params) {
+    updateTenantId(ctx.params.tenantId)
+  }
+  return next()
+}
+
 router
-  // PASSWORD
   .post(
     "/api/global/auth/:tenantId/login",
     buildAuthValidation(),
+    updateTenant,
     authController.authenticate
   )
-  .post("/api/global/auth/logout", authController.logout)
   .post(
     "/api/global/auth/:tenantId/reset",
     buildResetValidation(),
+    updateTenant,
     authController.reset
   )
   .post(
     "/api/global/auth/:tenantId/reset/update",
     buildResetUpdateValidation(),
+    updateTenant,
     authController.resetUpdate
   )
-  // INIT
+  .post("/api/global/auth/logout", authController.logout)
   .post("/api/global/auth/init", authController.setInitInfo)
   .get("/api/global/auth/init", authController.getInitInfo)
-
-  // DATASOURCE - MULTI TENANT
+  .get(
+    "/api/global/auth/:tenantId/google",
+    updateTenant,
+    authController.googlePreAuth
+  )
   .get(
     "/api/global/auth/:tenantId/datasource/:provider",
+    updateTenant,
     authController.datasourcePreAuth
   )
+  // single tenancy endpoint
+  .get("/api/global/auth/google/callback", authController.googleAuth)
   .get(
-    "/api/global/auth/:tenantId/datasource/:provider/callback",
+    "/api/global/auth/datasource/:provider/callback",
     authController.datasourceAuth
   )
-
-  // DATASOURCE - SINGLE TENANT - DEPRECATED
+  // multi-tenancy endpoint
   .get(
-    "/api/global/auth/datasource/:provider/callback",
+    "/api/global/auth/:tenantId/google/callback",
+    updateTenant,
+    authController.googleAuth
+  )
+  .get(
+    "/api/global/auth/:tenantId/datasource/:provider/callback",
+    updateTenant,
     authController.datasourceAuth
   )
-
-  // GOOGLE - MULTI TENANT
-  .get("/api/global/auth/:tenantId/google", authController.googlePreAuth)
-  .get("/api/global/auth/:tenantId/google/callback", authController.googleAuth)
-
-  // GOOGLE - SINGLE TENANT - DEPRECATED
-  .get("/api/global/auth/google/callback", authController.googleAuth)
-  .get("/api/admin/auth/google/callback", authController.googleAuth)
-
-  // OIDC - MULTI TENANT
   .get(
     "/api/global/auth/:tenantId/oidc/configs/:configId",
+    updateTenant,
     authController.oidcPreAuth
   )
-  .get("/api/global/auth/:tenantId/oidc/callback", authController.oidcAuth)
-
-  // OIDC - SINGLE TENANT - DEPRECATED
+  // single tenancy endpoint
   .get("/api/global/auth/oidc/callback", authController.oidcAuth)
+  // multi-tenancy endpoint
+  .get(
+    "/api/global/auth/:tenantId/oidc/callback",
+    updateTenant,
+    authController.oidcAuth
+  )
+  // deprecated - used by the default system before tenancy
+  .get("/api/admin/auth/google/callback", authController.googleAuth)
   .get("/api/admin/auth/oidc/callback", authController.oidcAuth)
 
-export = router
+module.exports = router

package/src/api/routes/global/{configs.ts → configs.js}

@@ -1,10 +1,11 @@
-import Router from "@koa/router"
-import * as controller from "../../controllers/global/configs"
-import { auth } from "@budibase/backend-core"
-import Joi from "joi"
-import { ConfigType } from "@budibase/types"
+const Router = require("@koa/router")
+const controller = require("../../controllers/global/configs")
+const { joiValidator } = require("@budibase/backend-core/auth")
+const { adminOnly } = require("@budibase/backend-core/auth")
+const Joi = require("joi")
+const { Configs } = require("../../../constants")
 
-const router: Router = new Router()
+const router = new Router()
 
 function smtpValidation() {
   // prettier-ignore
@@ -54,27 +55,27 @@ function oidcValidation() {
         activated: Joi.boolean().required(),
         scopes: Joi.array().optional()
       })
-    ).required()
+    ).required(true)
   }).unknown(true)
 }
 
 function buildConfigSaveValidation() {
   // prettier-ignore
-  return auth.joiValidator.body(Joi.object({
+  return joiValidator.body(Joi.object({
     _id: Joi.string().optional(),
     _rev: Joi.string().optional(),
     workspace: Joi.string().optional(),
-    type: Joi.string().valid(...Object.values(ConfigType)).required(),
+    type: Joi.string().valid(...Object.values(Configs)).required(),
     createdAt: Joi.string().optional(),
     updatedAt: Joi.string().optional(),
     config: Joi.alternatives()
       .conditional("type", {
         switch: [
-          { is: ConfigType.SMTP, then: smtpValidation() },
-          { is: ConfigType.SETTINGS, then: settingValidation() },
-          { is: ConfigType.ACCOUNT, then: Joi.object().unknown(true) },
-          { is: ConfigType.GOOGLE, then: googleValidation() },
-          { is: ConfigType.OIDC, then: oidcValidation() }
+          { is: Configs.SMTP, then: smtpValidation() },
+          { is: Configs.SETTINGS, then: settingValidation() },
+          { is: Configs.ACCOUNT, then: Joi.object().unknown(true) },
+          { is: Configs.GOOGLE, then: googleValidation() },
+          { is: Configs.OIDC, then: oidcValidation() }
         ],
       }),
   }).required().unknown(true),
@@ -83,27 +84,27 @@ function buildConfigSaveValidation() {
 
 function buildUploadValidation() {
   // prettier-ignore
-  return auth.joiValidator.params(Joi.object({
-    type: Joi.string().valid(...Object.values(ConfigType)).required(),
+  return joiValidator.params(Joi.object({
+    type: Joi.string().valid(...Object.values(Configs)).required(),
     name: Joi.string().required(),
   }).required().unknown(true))
 }
 
 function buildConfigGetValidation() {
   // prettier-ignore
-  return auth.joiValidator.params(Joi.object({
-    type: Joi.string().valid(...Object.values(ConfigType)).required()
+  return joiValidator.params(Joi.object({
+    type: Joi.string().valid(...Object.values(Configs)).required()
   }).required().unknown(true))
 }
 
 router
   .post(
     "/api/global/configs",
-    auth.adminOnly,
+    adminOnly,
     buildConfigSaveValidation(),
     controller.save
   )
-  .delete("/api/global/configs/:id/:rev", auth.adminOnly, controller.destroy)
+  .delete("/api/global/configs/:id/:rev", adminOnly, controller.destroy)
   .get("/api/global/configs", controller.fetch)
   .get("/api/global/configs/checklist", controller.configChecklist)
   .get(
@@ -116,9 +117,9 @@ router
   .get("/api/global/configs/:type", buildConfigGetValidation(), controller.find)
   .post(
     "/api/global/configs/upload/:type/:name",
-    auth.adminOnly,
+    adminOnly,
     buildUploadValidation(),
     controller.upload
   )
 
-export = router
+module.exports = router

package/src/api/routes/global/{email.ts → email.js}

@@ -1,14 +1,15 @@
-import Router from "@koa/router"
-import * as controller from "../../controllers/global/email"
-import { EmailTemplatePurpose } from "../../../constants"
-import { auth } from "@budibase/backend-core"
-import Joi from "joi"
+const Router = require("@koa/router")
+const controller = require("../../controllers/global/email")
+const { EmailTemplatePurpose } = require("../../../constants")
+const { joiValidator } = require("@budibase/backend-core/auth")
+const { adminOnly } = require("@budibase/backend-core/auth")
+const Joi = require("joi")
 
-const router: Router = new Router()
+const router = new Router()
 
 function buildEmailSendValidation() {
   // prettier-ignore
-  return auth.joiValidator.body(Joi.object({
+  return joiValidator.body(Joi.object({
     email: Joi.string().email({
       multiple: true,
     }),
@@ -29,8 +30,8 @@ function buildEmailSendValidation() {
 router.post(
   "/api/global/email/send",
   buildEmailSendValidation(),
-  auth.adminOnly,
+  adminOnly,
   controller.sendEmail
 )
 
-export = router
+module.exports = router

package/src/api/routes/global/license.ts

@@ -1,7 +1,7 @@
 import Router from "@koa/router"
 import * as controller from "../../controllers/global/license"
 
-const router: Router = new Router()
+const router = new Router()
 
 router
   .post("/api/global/license/activate", controller.activate)

package/src/api/routes/global/roles.js

@@ -0,0 +1,12 @@
+const Router = require("@koa/router")
+const controller = require("../../controllers/global/roles")
+const { builderOrAdmin } = require("@budibase/backend-core/auth")
+
+const router = new Router()
+
+router
+  .get("/api/global/roles", builderOrAdmin, controller.fetch)
+  .get("/api/global/roles/:appId", builderOrAdmin, controller.find)
+  .delete("/api/global/roles/:appId", builderOrAdmin, controller.removeAppRole)
+
+module.exports = router

package/src/api/routes/global/self.ts

@@ -3,7 +3,7 @@ import * as controller from "../../controllers/global/self"
 import { auth } from "@budibase/backend-core"
 import { users } from "../validation"
 
-const router: Router = new Router()
+const router = new Router()
 
 router
   .post("/api/global/self/api_key", auth.builderOnly, controller.generateAPIKey)
@@ -15,4 +15,4 @@ router
     controller.updateSelf
   )
 
-export = router
+export default router as any

package/src/api/routes/global/templates.ts

@@ -1,11 +1,11 @@
 import Router from "@koa/router"
 import * as controller from "../../controllers/global/templates"
-import { TemplatePurpose, TemplateType } from "../../../constants"
+import { TemplatePurpose, TemplateTypes } from "../../../constants"
 import { auth as authCore } from "@budibase/backend-core"
 import Joi from "joi"
 const { adminOnly, joiValidator } = authCore
 
-const router: Router = new Router()
+const router = new Router()
 
 function buildTemplateSaveValidation() {
   // prettier-ignore
@@ -16,7 +16,7 @@ function buildTemplateSaveValidation() {
     name: Joi.string().allow(null, ""),
     contents: Joi.string().required(),
     purpose: Joi.string().required().valid(...Object.values(TemplatePurpose)),
-    type: Joi.string().required().valid(...Object.values(TemplateType)),
+    type: Joi.string().required().valid(...Object.values(TemplateTypes)),
   }).required().unknown(true).optional())
 }
 
@@ -34,4 +34,4 @@ router
   .get("/api/global/template/:id", controller.find)
   .delete("/api/global/template/:id/:rev", adminOnly, controller.destroy)
 
-export = router
+export default router