@budibase/worker 2.1.44 → 2.1.46-alpha.0

package/src/index.ts

@@ -1,5 +1,5 @@
 // need to load environment first
-const env = require("./environment")
+import env from "./environment"
 
 // enable APM if configured
 if (process.env.ELASTIC_APM_ENABLED) {
@@ -13,20 +13,18 @@ import { Scope } from "@sentry/node"
 import { Event } from "@sentry/types/dist/event"
 import Application from "koa"
 import { bootstrap } from "global-agent"
-import db from "./db"
+import * as db from "./db"
+import { auth, logging, events, pinoSettings } from "@budibase/backend-core"
 db.init()
-const Koa = require("koa")
-const destroyable = require("server-destroy")
-const koaBody = require("koa-body")
+import Koa from "koa"
+import koaBody from "koa-body"
+import http from "http"
+import api from "./api"
+import * as redis from "./utilities/redis"
+const Sentry = require("@sentry/node")
 const koaSession = require("koa-session")
-const { passport } = require("@budibase/backend-core/auth")
-const { logAlert } = require("@budibase/backend-core/logging")
 const logger = require("koa-pino-logger")
-const http = require("http")
-const api = require("./api")
-const redis = require("./utilities/redis")
-const Sentry = require("@sentry/node")
-import { events, pinoSettings } from "@budibase/backend-core"
+const destroyable = require("server-destroy")
 
 // this will setup http and https proxies form env variables
 bootstrap()
@@ -41,8 +39,8 @@ app.use(koaSession(app))
 app.use(logger(pinoSettings()))
 
 // authentication
-app.use(passport.initialize())
-app.use(passport.session())
+app.use(auth.passport.initialize())
+app.use(auth.passport.session())
 
 // api routes
 app.use(api.routes())
@@ -81,17 +79,18 @@ server.on("close", async () => {
 
 const shutdown = () => {
   server.close()
+  // @ts-ignore
   server.destroy()
 }
 
-export = server.listen(parseInt(env.PORT || 4002), async () => {
+export = server.listen(parseInt(env.PORT || "4002"), async () => {
   console.log(`Worker running on ${JSON.stringify(server.address())}`)
   await redis.init()
 })
 
 process.on("uncaughtException", err => {
   errCode = -1
-  logAlert("Uncaught exception.", err)
+  logging.logAlert("Uncaught exception.", err)
   shutdown()
 })
 

package/src/middleware/{cloudRestricted.js → cloudRestricted.ts}

@@ -1,13 +1,14 @@
-const env = require("../environment")
-const { Headers } = require("@budibase/backend-core/constants")
+import env from "../environment"
+import { constants } from "@budibase/backend-core"
+import { BBContext } from "@budibase/types"
 
 /**
  * This is a restricted endpoint in the cloud.
  * Ensure that the correct API key has been supplied.
  */
-module.exports = async (ctx, next) => {
+export = async (ctx: BBContext, next: any) => {
   if (!env.SELF_HOSTED && !env.DISABLE_ACCOUNT_PORTAL) {
-    const apiKey = ctx.request.headers[Headers.API_KEY]
+    const apiKey = ctx.request.headers[constants.Header.API_KEY]
     if (apiKey !== env.INTERNAL_API_KEY) {
       ctx.throw(403, "Unauthorized")
     }

package/src/middleware/tests/tenancy.spec.ts

@@ -0,0 +1,73 @@
+import { TestConfiguration, structures } from "../../tests"
+import { constants } from "@budibase/backend-core"
+
+describe("tenancy middleware", () => {
+  const config = new TestConfiguration()
+
+  beforeAll(async () => {
+    await config.beforeAll()
+  })
+
+  afterAll(async () => {
+    await config.afterAll()
+  })
+
+  afterEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it("should get tenant id from user", async () => {
+    const user = await config.createTenant()
+    await config.createSession(user)
+    const res = await config.api.self.getSelf(user)
+    expect(res.headers[constants.Header.TENANT_ID]).toBe(user.tenantId)
+  })
+
+  it("should get tenant id from header", async () => {
+    const tenantId = structures.uuid()
+    const headers = {
+      [constants.Header.TENANT_ID]: tenantId,
+    }
+    const res = await config.request
+      .get(`/api/global/configs/checklist`)
+      .set(headers)
+    expect(res.headers[constants.Header.TENANT_ID]).toBe(tenantId)
+  })
+
+  it("should get tenant id from query param", async () => {
+    const tenantId = structures.uuid()
+    const res = await config.request.get(
+      `/api/global/configs/checklist?tenantId=${tenantId}`
+    )
+    expect(res.headers[constants.Header.TENANT_ID]).toBe(tenantId)
+  })
+
+  it("should get tenant id from subdomain", async () => {
+    const tenantId = structures.uuid()
+    const headers = {
+      host: `${tenantId}.localhost:10000`,
+    }
+    const res = await config.request
+      .get(`/api/global/configs/checklist`)
+      .set(headers)
+    expect(res.headers[constants.Header.TENANT_ID]).toBe(tenantId)
+  })
+
+  it("should get tenant id from path variable", async () => {
+    const user = await config.createTenant()
+    const res = await config.request
+      .post(`/api/global/auth/${user.tenantId}/login`)
+      .send({
+        username: user.email,
+        password: user.password,
+      })
+    expect(res.headers[constants.Header.TENANT_ID]).toBe(user.tenantId)
+  })
+
+  it("should throw when no tenant id is found", async () => {
+    const res = await config.request.get(`/api/global/configs/checklist`)
+    expect(res.status).toBe(403)
+    expect(res.text).toBe("Tenant id not set")
+    expect(res.headers[constants.Header.TENANT_ID]).toBe(undefined)
+  })
+})

package/src/sdk/users/users.ts

@@ -29,6 +29,7 @@ import {
   RowResponse,
   SearchUsersRequest,
   User,
+  ThirdPartyUser,
 } from "@budibase/types"
 import { sendEmail } from "../../utilities/email"
 import { EmailTemplatePurpose } from "../../constants"
@@ -103,13 +104,14 @@ export const getUser = async (userId: string) => {
   return user
 }
 
-interface SaveUserOpts {
+export interface SaveUserOpts {
   hashPassword?: boolean
   requirePassword?: boolean
+  currentUserId?: string
 }
 
 const buildUser = async (
-  user: User,
+  user: User | ThirdPartyUser,
   opts: SaveUserOpts = {
     hashPassword: true,
     requirePassword: true,
@@ -117,7 +119,8 @@ const buildUser = async (
   tenantId: string,
   dbUser?: any
 ): Promise<User> => {
-  let { password, _id } = user
+  let fullUser = user as User
+  let { password, _id } = fullUser
 
   let hashedPassword
   if (password) {
@@ -130,24 +133,24 @@ const buildUser = async (
 
   _id = _id || dbUtils.generateGlobalUserID()
 
-  user = {
+  fullUser = {
     createdAt: Date.now(),
     ...dbUser,
-    ...user,
+    ...fullUser,
     _id,
     password: hashedPassword,
     tenantId,
   }
   // make sure the roles object is always present
-  if (!user.roles) {
-    user.roles = {}
+  if (!fullUser.roles) {
+    fullUser.roles = {}
   }
   // add the active status to a user if its not provided
-  if (user.status == null) {
-    user.status = constants.UserStatus.ACTIVE
+  if (fullUser.status == null) {
+    fullUser.status = constants.UserStatus.ACTIVE
   }
 
-  return user
+  return fullUser
 }
 
 const validateUniqueUser = async (email: string, tenantId: string) => {
@@ -169,12 +172,16 @@ const validateUniqueUser = async (email: string, tenantId: string) => {
 }
 
 export const save = async (
-  user: User,
-  opts: SaveUserOpts = {
-    hashPassword: true,
-    requirePassword: true,
-  }
+  user: User | ThirdPartyUser,
+  opts: SaveUserOpts = {}
 ): Promise<CreateUserResponse> => {
+  // default booleans to true
+  if (opts.hashPassword == null) {
+    opts.hashPassword = true
+  }
+  if (opts.requirePassword == null) {
+    opts.requirePassword = true
+  }
   const tenantId = tenancy.getTenantId()
   const db = tenancy.getGlobalDB()
 
@@ -213,6 +220,12 @@ export const save = async (
   await validateUniqueUser(email, tenantId)
 
   let builtUser = await buildUser(user, opts, tenantId, dbUser)
+  // don't allow a user to update its own roles/perms
+  if (opts.currentUserId && opts.currentUserId === dbUser?._id) {
+    builtUser.builder = dbUser.builder
+    builtUser.admin = dbUser.admin
+    builtUser.roles = dbUser.roles
+  }
 
   // make sure we set the _id field for a new user
   // Also if this is a new user, associate groups with them

package/src/tests/TestConfiguration.ts

@@ -1,41 +1,42 @@
 import "./mocks"
-import dbConfig from "../db"
+import * as dbConfig from "../db"
 dbConfig.init()
 import env from "../environment"
-import controllers from "./controllers"
+import * as controllers from "./controllers"
 const supertest = require("supertest")
-import { Configs } from "../constants"
+import { Config } from "../constants"
 import {
   users,
   tenancy,
-  Cookies,
-  Headers,
   sessions,
   auth,
+  constants,
+  env as coreEnv,
 } from "@budibase/backend-core"
-import { TENANT_ID, TENANT_1, CSRF_TOKEN } from "./structures"
-import structures from "./structures"
+import structures, { TENANT_ID, TENANT_1, CSRF_TOKEN } from "./structures"
 import { CreateUserResponse, User, AuthToken } from "@budibase/types"
+import API from "./api"
 
 enum Mode {
-  ACCOUNT = "account",
+  CLOUD = "cloud",
   SELF = "self",
 }
 
 class TestConfiguration {
   server: any
   request: any
+  api: API
   defaultUser?: User
   tenant1User?: User
 
   constructor(
     opts: { openServer: boolean; mode: Mode } = {
       openServer: true,
-      mode: Mode.ACCOUNT,
+      mode: Mode.CLOUD,
     }
   ) {
-    if (opts.mode === Mode.ACCOUNT) {
-      this.modeAccount()
+    if (opts.mode === Mode.CLOUD) {
+      this.modeCloud()
     } else if (opts.mode === Mode.SELF) {
       this.modeSelf()
     }
@@ -46,6 +47,8 @@ class TestConfiguration {
       // we need the request for logging in, involves cookies, hard to fake
       this.request = supertest(this.server)
     }
+
+    this.api = new API(this)
   }
 
   getRequest() {
@@ -54,20 +57,24 @@ class TestConfiguration {
 
   // MODES
 
-  modeAccount = () => {
-    env.SELF_HOSTED = false
-    // @ts-ignore
-    env.MULTI_TENANCY = true
-    // @ts-ignore
-    env.DISABLE_ACCOUNT_PORTAL = false
+  setMultiTenancy = (value: boolean) => {
+    env._set("MULTI_TENANCY", value)
+    coreEnv._set("MULTI_TENANCY", value)
+  }
+
+  setSelfHosted = (value: boolean) => {
+    env._set("SELF_HOSTED", value)
+    coreEnv._set("SELF_HOSTED", value)
+  }
+
+  modeCloud = () => {
+    this.setSelfHosted(false)
+    this.setMultiTenancy(true)
   }
 
   modeSelf = () => {
-    env.SELF_HOSTED = true
-    // @ts-ignore
-    env.MULTI_TENANCY = false
-    // @ts-ignore
-    env.DISABLE_ACCOUNT_PORTAL = true
+    this.setSelfHosted(true)
+    this.setMultiTenancy(false)
   }
 
   // UTILS
@@ -114,6 +121,25 @@ class TestConfiguration {
 
   // TENANCY
 
+  createTenant = async (): Promise<User> => {
+    // create user / new tenant
+    const res = await this.api.users.createAdminUser()
+
+    // return the created user
+    const userRes = await this.api.users.getUser(res.userId, {
+      headers: {
+        ...this.internalAPIHeaders(),
+        [constants.Header.TENANT_ID]: res.tenantId,
+      },
+    })
+
+    // create a session for the new user
+    const user = userRes.body
+    await this.createSession(user)
+
+    return user
+  }
+
   getTenantId() {
     try {
       return tenancy.getTenantId()
@@ -122,35 +148,32 @@ class TestConfiguration {
     }
   }
 
-  // USER / AUTH
-
-  async createDefaultUser() {
-    const user = structures.users.adminUser({
-      email: "test@test.com",
-      password: "test",
-    })
-    this.defaultUser = await this.createUser(user)
-  }
+  // AUTH
 
-  async createTenant1User() {
-    const user = structures.users.adminUser({
-      email: "tenant1@test.com",
-      password: "test",
+  async _createSession({
+    userId,
+    tenantId,
+  }: {
+    userId: string
+    tenantId: string
+  }) {
+    await sessions.createASession(userId!, {
+      sessionId: "sessionid",
+      tenantId: tenantId,
+      csrfToken: CSRF_TOKEN,
     })
-    this.tenant1User = await this.createUser(user)
   }
 
   async createSession(user: User) {
-    await sessions.createASession(user._id!, {
-      sessionId: "sessionid",
-      tenantId: user.tenantId,
-      csrfToken: CSRF_TOKEN,
-    })
+    return this._createSession({ userId: user._id!, tenantId: user.tenantId })
   }
 
   cookieHeader(cookies: any) {
+    if (!Array.isArray(cookies)) {
+      cookies = [cookies]
+    }
     return {
-      Cookie: [cookies],
+      Cookie: cookies,
     }
   }
 
@@ -163,8 +186,8 @@ class TestConfiguration {
     const authCookie = auth.jwt.sign(authToken, env.JWT_SECRET)
     return {
       Accept: "application/json",
-      ...this.cookieHeader([`${Cookies.Auth}=${authCookie}`]),
-      [Headers.CSRF_TOKEN]: CSRF_TOKEN,
+      ...this.cookieHeader([`${constants.Cookie.Auth}=${authCookie}`]),
+      [constants.Header.CSRF_TOKEN]: CSRF_TOKEN,
     }
   }
 
@@ -179,6 +202,32 @@ class TestConfiguration {
     }
   }
 
+  internalAPIHeaders() {
+    return { [constants.Header.API_KEY]: env.INTERNAL_API_KEY }
+  }
+
+  adminOnlyResponse = () => {
+    return { message: "Admin user only endpoint.", status: 403 }
+  }
+
+  // USERS
+
+  async createDefaultUser() {
+    const user = structures.users.adminUser({
+      email: "test@test.com",
+      password: "test",
+    })
+    this.defaultUser = await this.createUser(user)
+  }
+
+  async createTenant1User() {
+    const user = structures.users.adminUser({
+      email: "tenant1@test.com",
+      password: "test",
+    })
+    this.tenant1User = await this.createUser(user)
+  }
+
   async getUser(email: string): Promise<User> {
     return tenancy.doInTenant(this.getTenantId(), () => {
       return users.getGlobalUserByEmail(email)
@@ -223,7 +272,7 @@ class TestConfiguration {
   // CONFIGS - SETTINGS
 
   async saveSettingsConfig() {
-    await this.deleteConfig(Configs.SETTINGS)
+    await this.deleteConfig(Config.SETTINGS)
     await this._req(
       structures.configs.settings(),
       null,
@@ -234,7 +283,7 @@ class TestConfiguration {
   // CONFIGS - GOOGLE
 
   async saveGoogleConfig() {
-    await this.deleteConfig(Configs.GOOGLE)
+    await this.deleteConfig(Config.GOOGLE)
     await this._req(structures.configs.google(), null, controllers.config.save)
   }
 
@@ -242,11 +291,11 @@ class TestConfiguration {
 
   getOIDConfigCookie(configId: string) {
     const token = auth.jwt.sign(configId, env.JWT_SECRET)
-    return this.cookieHeader([[`${Cookies.OIDC_CONFIG}=${token}`]])
+    return this.cookieHeader([[`${constants.Cookie.OIDC_CONFIG}=${token}`]])
   }
 
   async saveOIDCConfig() {
-    await this.deleteConfig(Configs.OIDC)
+    await this.deleteConfig(Config.OIDC)
     const config = structures.configs.oidc()
 
     await this._req(config, null, controllers.config.save)
@@ -256,12 +305,12 @@ class TestConfiguration {
   // CONFIGS - SMTP
 
   async saveSmtpConfig() {
-    await this.deleteConfig(Configs.SMTP)
+    await this.deleteConfig(Config.SMTP)
     await this._req(structures.configs.smtp(), null, controllers.config.save)
   }
 
   async saveEtherealSmtpConfig() {
-    await this.deleteConfig(Configs.SMTP)
+    await this.deleteConfig(Config.SMTP)
     await this._req(
       structures.configs.smtpEthereal(),
       null,

package/src/tests/api/accounts.ts

@@ -1,20 +1,17 @@
 import { Account, AccountMetadata } from "@budibase/types"
 import TestConfiguration from "../TestConfiguration"
+import { TestAPI } from "./base"
 
-export class AccountAPI {
-  config: TestConfiguration
-  request: any
-
+export class AccountAPI extends TestAPI {
   constructor(config: TestConfiguration) {
-    this.config = config
-    this.request = config.request
+    super(config)
   }
 
   saveMetadata = async (account: Account) => {
     const res = await this.request
       .put(`/api/system/accounts/${account.accountId}/metadata`)
       .send(account)
-      .set(this.config.defaultHeaders())
+      .set(this.config.internalAPIHeaders())
       .expect("Content-Type", /json/)
       .expect(200)
     return res.body as AccountMetadata
@@ -23,6 +20,6 @@ export class AccountAPI {
   destroyMetadata = (accountId: string) => {
     return this.request
       .del(`/api/system/accounts/${accountId}/metadata`)
-      .set(this.config.defaultHeaders())
+      .set(this.config.internalAPIHeaders())
   }
 }

package/src/tests/api/auth.ts

@@ -1,12 +1,9 @@
 import TestConfiguration from "../TestConfiguration"
+import { TestAPI } from "./base"
 
-export class AuthAPI {
-  config: TestConfiguration
-  request: any
-
+export class AuthAPI extends TestAPI {
   constructor(config: TestConfiguration) {
-    this.config = config
-    this.request = config.request
+    super(config)
   }
 
   updatePassword = (code: string) => {

package/src/tests/api/base.ts

@@ -0,0 +1,16 @@
+import TestConfiguration from "../TestConfiguration"
+
+export interface TestAPIOpts {
+  headers?: any
+  status?: number
+}
+
+export abstract class TestAPI {
+  config: TestConfiguration
+  request: any
+
+  protected constructor(config: TestConfiguration) {
+    this.config = config
+    this.request = config.request
+  }
+}

package/src/tests/api/configs.ts

@@ -1,12 +1,9 @@
 import TestConfiguration from "../TestConfiguration"
+import { TestAPI } from "./base"
 
-export class ConfigAPI {
-  config: TestConfiguration
-  request: any
-
+export class ConfigAPI extends TestAPI {
   constructor(config: TestConfiguration) {
-    this.config = config
-    this.request = config.request
+    super(config)
   }
 
   getConfigChecklist = () => {
@@ -26,10 +23,20 @@ export class ConfigAPI {
       .expect(200)
   }
 
-  OIDCCallback = (configId: string) => {
+  OIDCCallback = (configId: string, preAuthRes: any) => {
+    const cookie = this.config.cookieHeader(preAuthRes.get("set-cookie"))
+    const setKoaSession = cookie.Cookie.find((c: string) =>
+      c.includes("koa:sess")
+    )
+    const koaSession = setKoaSession.split("=")[1] + "=="
+    const sessionContent = JSON.parse(
+      Buffer.from(koaSession, "base64").toString("utf-8")
+    )
+    const handle = sessionContent["openidconnect:localhost"].state.handle
     return this.request
       .get(`/api/global/auth/${this.config.getTenantId()}/oidc/callback`)
-      .set(this.config.getOIDConfigCookie(configId))
+      .query({ code: "test", state: handle })
+      .set(cookie)
   }
 
   getOIDCConfig = (configId: string) => {

package/src/tests/api/email.ts

@@ -1,12 +1,9 @@
 import TestConfiguration from "../TestConfiguration"
+import { TestAPI } from "./base"
 
-export class EmailAPI {
-  config: TestConfiguration
-  request: any
-
+export class EmailAPI extends TestAPI {
   constructor(config: TestConfiguration) {
-    this.config = config
-    this.request = config.request
+    super(config)
   }
 
   sendEmail = (purpose: string) => {

package/src/tests/api/environment.ts

@@ -0,0 +1,15 @@
+import TestConfiguration from "../TestConfiguration"
+import { TestAPI } from "./base"
+
+export class EnvironmentAPI extends TestAPI {
+  constructor(config: TestConfiguration) {
+    super(config)
+  }
+
+  getEnvironment = () => {
+    return this.request
+      .get(`/api/system/environment`)
+      .expect("Content-Type", /json/)
+      .expect(200)
+  }
+}