@budibase/worker 2.3.17-alpha.4 → 2.3.17-alpha.5

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/worker",
   "email": "hi@budibase.com",
-  "version": "2.3.17-alpha.4",
+  "version": "2.3.17-alpha.5",
   "description": "Budibase background service",
   "main": "src/index.ts",
   "repository": {
@@ -36,10 +36,10 @@
   "author": "Budibase",
   "license": "GPL-3.0",
   "dependencies": {
-    "@budibase/backend-core": "2.3.17-alpha.4",
-    "@budibase/pro": "2.3.17-alpha.3",
-    "@budibase/string-templates": "2.3.17-alpha.4",
-    "@budibase/types": "2.3.17-alpha.4",
+    "@budibase/backend-core": "2.3.17-alpha.5",
+    "@budibase/pro": "2.3.17-alpha.4",
+    "@budibase/string-templates": "2.3.17-alpha.5",
+    "@budibase/types": "2.3.17-alpha.5",
     "@koa/router": "8.0.8",
     "@sentry/node": "6.17.7",
     "@techpass/passport-openidconnect": "0.3.2",
@@ -74,7 +74,7 @@
     "@swc/core": "^1.3.25",
     "@swc/jest": "^0.2.24",
     "@trendyol/jest-testcontainers": "^2.1.1",
-    "@types/jest": "26.0.23",
+    "@types/jest": "28.1.1",
     "@types/jsonwebtoken": "8.5.1",
     "@types/koa": "2.13.4",
     "@types/koa__router": "8.0.8",
@@ -82,6 +82,7 @@
     "@types/node-fetch": "2.6.1",
     "@types/pouchdb": "6.4.0",
     "@types/server-destroy": "1.0.1",
+    "@types/supertest": "2.0.12",
     "@types/uuid": "8.3.4",
     "@typescript-eslint/parser": "5.45.0",
     "copyfiles": "2.4.1",
@@ -99,5 +100,5 @@
     "typescript": "4.7.3",
     "update-dotenv": "1.1.1"
   },
-  "gitHead": "4145478e3835309343700c2593247399255205b5"
+  "gitHead": "f336cec967d590cae2b6bb5ff78b9ccc84c418f1"
 }

package/scripts/dev/manage.js

@@ -29,6 +29,7 @@ async function init() {
       SERVICE: "worker-service",
       DEPLOYMENT_ENVIRONMENT: "development",
       TENANT_FEATURE_FLAGS: "*:LICENSING,*:USER_GROUPS,*:ONBOARDING_TOUR",
+      ENABLE_EMAIL_TEST_MODE: 1,
     }
     let envFile = ""
     Object.keys(envFileJson).forEach(key => {

package/src/api/controllers/global/auth.ts

@@ -1,49 +1,55 @@
 import {
-  auth,
+  auth as authCore,
   constants,
   context,
   db as dbCore,
   events,
   tenancy,
-  users as usersCore,
-  utils,
+  utils as utilsCore,
 } from "@budibase/backend-core"
-import { EmailTemplatePurpose } from "../../../constants"
-import { isEmailConfigured, sendEmail } from "../../../utilities/email"
-import { checkResetPasswordCode } from "../../../utilities/redis"
+import {
+  ConfigType,
+  User,
+  Ctx,
+  LoginRequest,
+  SSOUser,
+  PasswordResetRequest,
+  PasswordResetUpdateRequest,
+} from "@budibase/types"
 import env from "../../../environment"
-import sdk from "../../../sdk"
-import { ConfigType, User } from "@budibase/types"
 
-const { setCookie, getCookie, clearCookie, hash, platformLogout } = utils
-const { Cookie, Header } = constants
-const { passport, ssoCallbackUrl, google, oidc } = auth
+import * as authSdk from "../../../sdk/auth"
+import * as userSdk from "../../../sdk/users"
 
-export async function googleCallbackUrl(config?: { callbackURL?: string }) {
-  return ssoCallbackUrl(tenancy.getGlobalDB(), config, ConfigType.GOOGLE)
-}
+const { Cookie, Header } = constants
+const { passport, ssoCallbackUrl, google, oidc } = authCore
+const { setCookie, getCookie, clearCookie } = utilsCore
 
-export async function oidcCallbackUrl(config?: { callbackURL?: string }) {
-  return ssoCallbackUrl(tenancy.getGlobalDB(), config, ConfigType.OIDC)
-}
+// LOGIN / LOGOUT
 
-async function authInternal(ctx: any, user: any, err: any = null, info = null) {
+async function passportCallback(
+  ctx: Ctx,
+  user: User,
+  err: any = null,
+  info: { message: string } | null = null
+) {
   if (err) {
     console.error("Authentication error")
     console.error(err)
     console.trace(err)
     return ctx.throw(403, info ? info : "Unauthorized")
   }
-
   if (!user) {
     console.error("Authentication error - no user provided")
     return ctx.throw(403, info ? info : "Unauthorized")
   }
 
+  const token = await authSdk.loginUser(user)
+
   // set a cookie for browser access
-  setCookie(ctx, user.token, Cookie.Auth, { sign: false })
+  setCookie(ctx, token, Cookie.Auth, { sign: false })
   // set the token in a header as well for APIs
-  ctx.set(Header.TOKEN, user.token)
+  ctx.set(Header.TOKEN, token)
   // get rid of any app cookies on login
   // have to check test because this breaks cypress
   if (!env.isTest()) {
@@ -51,11 +57,18 @@ async function authInternal(ctx: any, user: any, err: any = null, info = null) {
   }
 }
 
-export const authenticate = async (ctx: any, next: any) => {
+export const login = async (ctx: Ctx<LoginRequest>, next: any) => {
+  const email = ctx.request.body.username
+
+  const user = await userSdk.getUserByEmail(email)
+  if (user && (await userSdk.isPreventSSOPasswords(user))) {
+    ctx.throw(400, "SSO user cannot login using password")
+  }
+
   return passport.authenticate(
     "local",
     async (err: any, user: User, info: any) => {
-      await authInternal(ctx, user, err, info)
+      await passportCallback(ctx, user, err, info)
       await context.identity.doInUserContext(user, async () => {
         await events.auth.login("local")
       })
@@ -64,6 +77,15 @@ export const authenticate = async (ctx: any, next: any) => {
   )(ctx, next)
 }
 
+export const logout = async (ctx: any) => {
+  if (ctx.user && ctx.user._id) {
+    await authSdk.logout({ ctx, userId: ctx.user._id })
+  }
+  ctx.body = { message: "User logged out." }
+}
+
+// INIT
+
 export const setInitInfo = (ctx: any) => {
   const initInfo = ctx.request.body
   setCookie(ctx, initInfo, Cookie.Init)
@@ -79,32 +101,16 @@ export const getInitInfo = (ctx: any) => {
   }
 }
 
+// PASSWORD MANAGEMENT
+
 /**
  * Reset the user password, used as part of a forgotten password flow.
  */
-export const reset = async (ctx: any) => {
+export const reset = async (ctx: Ctx<PasswordResetRequest>) => {
   const { email } = ctx.request.body
-  const configured = await isEmailConfigured()
-  if (!configured) {
-    ctx.throw(
-      400,
-      "Please contact your platform administrator, SMTP is not configured."
-    )
-  }
-  try {
-    const user = (await usersCore.getGlobalUserByEmail(email)) as User
-    // only if user exists, don't error though if they don't
-    if (user) {
-      await sendEmail(email, EmailTemplatePurpose.PASSWORD_RECOVERY, {
-        user,
-        subject: "{{ company }} platform password reset",
-      })
-      await events.user.passwordResetRequested(user)
-    }
-  } catch (err) {
-    console.log(err)
-    // don't throw any kind of error to the user, this might give away something
-  }
+
+  await authSdk.reset(email)
+
   ctx.body = {
     message: "Please check your email for a reset link.",
   }
@@ -113,32 +119,21 @@ export const reset = async (ctx: any) => {
 /**
  * Perform the user password update if the provided reset code is valid.
  */
-export const resetUpdate = async (ctx: any) => {
+export const resetUpdate = async (ctx: Ctx<PasswordResetUpdateRequest>) => {
   const { resetCode, password } = ctx.request.body
   try {
-    const { userId } = await checkResetPasswordCode(resetCode)
-    const db = tenancy.getGlobalDB()
-    const user = await db.get(userId)
-    user.password = await hash(password)
-    await db.put(user)
+    await authSdk.resetUpdate(resetCode, password)
     ctx.body = {
       message: "password reset successfully.",
     }
-    // remove password from the user before sending events
-    delete user.password
-    await events.user.passwordReset(user)
   } catch (err) {
-    console.error(err)
+    console.warn(err)
+    // hide any details of the error for security
     ctx.throw(400, "Cannot reset password.")
   }
 }
 
-export const logout = async (ctx: any) => {
-  if (ctx.user && ctx.user._id) {
-    await platformLogout({ ctx, userId: ctx.user._id })
-  }
-  ctx.body = { message: "User logged out." }
-}
+// DATASOURCE
 
 export const datasourcePreAuth = async (ctx: any, next: any) => {
   const provider = ctx.params.provider
@@ -166,6 +161,12 @@ export const datasourceAuth = async (ctx: any, next: any) => {
   return handler.postAuth(passport, ctx, next)
 }
 
+// GOOGLE SSO
+
+export async function googleCallbackUrl(config?: { callbackURL?: string }) {
+  return ssoCallbackUrl(tenancy.getGlobalDB(), config, ConfigType.GOOGLE)
+}
+
 /**
  * The initial call that google authentication makes to take you to the google login screen.
  * On a successful login, you will be redirected to the googleAuth callback route.
@@ -181,7 +182,7 @@ export const googlePreAuth = async (ctx: any, next: any) => {
   const strategy = await google.strategyFactory(
     config,
     callbackUrl,
-    sdk.users.save
+    userSdk.save
   )
 
   return passport.authenticate(strategy, {
@@ -191,7 +192,7 @@ export const googlePreAuth = async (ctx: any, next: any) => {
   })(ctx, next)
 }
 
-export const googleAuth = async (ctx: any, next: any) => {
+export const googleCallback = async (ctx: any, next: any) => {
   const db = tenancy.getGlobalDB()
 
   const config = await dbCore.getScopedConfig(db, {
@@ -202,14 +203,14 @@ export const googleAuth = async (ctx: any, next: any) => {
   const strategy = await google.strategyFactory(
     config,
     callbackUrl,
-    sdk.users.save
+    userSdk.save
   )
 
   return passport.authenticate(
     strategy,
     { successRedirect: "/", failureRedirect: "/error" },
-    async (err: any, user: User, info: any) => {
-      await authInternal(ctx, user, err, info)
+    async (err: any, user: SSOUser, info: any) => {
+      await passportCallback(ctx, user, err, info)
       await context.identity.doInUserContext(user, async () => {
         await events.auth.login("google-internal")
       })
@@ -218,6 +219,12 @@ export const googleAuth = async (ctx: any, next: any) => {
   )(ctx, next)
 }
 
+// OIDC SSO
+
+export async function oidcCallbackUrl(config?: { callbackURL?: string }) {
+  return ssoCallbackUrl(tenancy.getGlobalDB(), config, ConfigType.OIDC)
+}
+
 export const oidcStrategyFactory = async (ctx: any, configId: any) => {
   const db = tenancy.getGlobalDB()
   const config = await dbCore.getScopedConfig(db, {
@@ -233,7 +240,7 @@ export const oidcStrategyFactory = async (ctx: any, configId: any) => {
     chosenConfig,
     callbackUrl
   )
-  return oidc.strategyFactory(enrichedConfig, sdk.users.save)
+  return oidc.strategyFactory(enrichedConfig, userSdk.save)
 }
 
 /**
@@ -265,15 +272,15 @@ export const oidcPreAuth = async (ctx: any, next: any) => {
   })(ctx, next)
 }
 
-export const oidcAuth = async (ctx: any, next: any) => {
+export const oidcCallback = async (ctx: any, next: any) => {
   const configId = getCookie(ctx, Cookie.OIDC_CONFIG)
   const strategy = await oidcStrategyFactory(ctx, configId)
 
   return passport.authenticate(
     strategy,
     { successRedirect: "/", failureRedirect: "/error" },
-    async (err: any, user: any, info: any) => {
-      await authInternal(ctx, user, err, info)
+    async (err: any, user: SSOUser, info: any) => {
+      await passportCallback(ctx, user, err, info)
       await context.identity.doInUserContext(user, async () => {
         await events.auth.login("oidc")
       })

package/src/api/controllers/global/self.ts

@@ -1,18 +1,22 @@
-import sdk from "../../../sdk"
+import * as userSdk from "../../../sdk/users"
 import {
-  events,
   featureFlags,
   tenancy,
   constants,
   db as dbCore,
   utils,
-  cache,
   encryption,
+  auth as authCore,
 } from "@budibase/backend-core"
 import env from "../../../environment"
 import { groups } from "@budibase/pro"
-const { hash, platformLogout, getCookie, clearCookie, newid } = utils
-const { user: userCache } = cache
+import {
+  UpdateSelfRequest,
+  UpdateSelfResponse,
+  UpdateSelf,
+  UserCtx,
+} from "@budibase/types"
+const { getCookie, clearCookie, newid } = utils
 
 function newTestApiKey() {
   return env.ENCRYPTED_TEST_PUBLIC_API_KEY
@@ -93,17 +97,6 @@ const addSessionAttributesToUser = (ctx: any) => {
   ctx.body.csrfToken = ctx.user.csrfToken
 }
 
-const sanitiseUserUpdate = (ctx: any) => {
-  const allowed = ["firstName", "lastName", "password", "forceResetPassword"]
-  const resp: { [key: string]: any } = {}
-  for (let [key, value] of Object.entries(ctx.request.body)) {
-    if (allowed.includes(key)) {
-      resp[key] = value
-    }
-  }
-  return resp
-}
-
 export async function getSelf(ctx: any) {
   if (!ctx.user) {
     ctx.throw(403, "User not logged in")
@@ -116,7 +109,7 @@ export async function getSelf(ctx: any) {
   checkCurrentApp(ctx)
 
   // get the main body of the user
-  const user = await sdk.users.getUser(userId)
+  const user = await userSdk.getUser(userId)
   ctx.body = await groups.enrichUserRolesFromGroups(user)
 
   // add the feature flags for this tenant
@@ -126,39 +119,30 @@ export async function getSelf(ctx: any) {
   addSessionAttributesToUser(ctx)
 }
 
-export async function updateSelf(ctx: any) {
-  const db = tenancy.getGlobalDB()
-  const user = await db.get(ctx.user._id)
-  let passwordChange = false
-
-  const userUpdateObj = sanitiseUserUpdate(ctx)
-  if (userUpdateObj.password) {
-    // changing password
-    passwordChange = true
-    userUpdateObj.password = await hash(userUpdateObj.password)
+export async function updateSelf(
+  ctx: UserCtx<UpdateSelfRequest, UpdateSelfResponse>
+) {
+  const body = ctx.request.body
+  const update: UpdateSelf = {
+    firstName: body.firstName,
+    lastName: body.lastName,
+    password: body.password,
+    forceResetPassword: body.forceResetPassword,
+  }
+
+  const user = await userSdk.updateSelf(ctx.user._id!, update)
+
+  if (update.password) {
     // Log all other sessions out apart from the current one
-    await platformLogout({
+    await authCore.platformLogout({
       ctx,
-      userId: ctx.user._id,
+      userId: ctx.user._id!,
       keepActiveSession: true,
     })
   }
 
-  const response = await db.put({
-    ...user,
-    ...userUpdateObj,
-  })
-  await userCache.invalidateUser(user._id)
   ctx.body = {
-    _id: response.id,
-    _rev: response.rev,
-  }
-
-  // remove the old password from the user before sending events
-  user._rev = response.rev
-  delete user.password
-  await events.user.updated(user)
-  if (passwordChange) {
-    await events.user.passwordUpdated(user)
+    _id: user._id!,
+    _rev: user._rev!,
   }
 }

package/src/api/controllers/global/users.ts

@@ -1,31 +1,48 @@
 import { checkInviteCode } from "../../../utilities/redis"
-import sdk from "../../../sdk"
+import * as userSdk from "../../../sdk/users"
 import env from "../../../environment"
 import {
+  AcceptUserInviteRequest,
+  AcceptUserInviteResponse,
   BulkUserRequest,
   BulkUserResponse,
   CloudAccount,
   CreateAdminUserRequest,
+  CreateAdminUserResponse,
+  Ctx,
   InviteUserRequest,
   InviteUsersRequest,
+  MigrationType,
+  SaveUserResponse,
   SearchUsersRequest,
   User,
+  UserCtx,
 } from "@budibase/types"
 import {
   accounts,
   cache,
   errors,
   events,
+  migrations,
   tenancy,
+  platform,
 } from "@budibase/backend-core"
 import { checkAnyUserExists } from "../../../utilities/users"
 
 const MAX_USERS_UPLOAD_LIMIT = 1000
 
-export const save = async (ctx: any) => {
+export const save = async (ctx: UserCtx<User, SaveUserResponse>) => {
   try {
     const currentUserId = ctx.user._id
-    ctx.body = await sdk.users.save(ctx.request.body, { currentUserId })
+    const requestUser = ctx.request.body
+
+    const user = await userSdk.save(requestUser, { currentUserId })
+
+    ctx.body = {
+      _id: user._id!,
+      _rev: user._rev!,
+      email: user.email,
+    }
   } catch (err: any) {
     ctx.throw(err.status || 400, err)
   }
@@ -35,7 +52,7 @@ const bulkDelete = async (userIds: string[], currentUserId: string) => {
   if (userIds?.indexOf(currentUserId) !== -1) {
     throw new Error("Unable to delete self.")
   }
-  return await sdk.users.bulkDelete(userIds)
+  return await userSdk.bulkDelete(userIds)
 }
 
 const bulkCreate = async (users: User[], groupIds: string[]) => {
@@ -44,7 +61,7 @@ const bulkCreate = async (users: User[], groupIds: string[]) => {
       "Max limit for upload is 1000 users. Please reduce file size and try again."
     )
   }
-  return await sdk.users.bulkCreate(users, groupIds)
+  return await userSdk.bulkCreate(users, groupIds)
 }
 
 export const bulkUpdate = async (ctx: any) => {
@@ -68,19 +85,30 @@ const parseBooleanParam = (param: any) => {
   return !(param && param === "false")
 }
 
-export const adminUser = async (ctx: any) => {
-  const { email, password, tenantId } = ctx.request
-    .body as CreateAdminUserRequest
+export const adminUser = async (
+  ctx: Ctx<CreateAdminUserRequest, CreateAdminUserResponse>
+) => {
+  const { email, password, tenantId } = ctx.request.body
+
+  if (await platform.tenants.exists(tenantId)) {
+    ctx.throw(403, "Organisation already exists.")
+  }
+
+  if (env.MULTI_TENANCY) {
+    // store the new tenant record in the platform db
+    await platform.tenants.addTenant(tenantId)
+    await migrations.backPopulateMigrations({
+      type: MigrationType.GLOBAL,
+      tenantId,
+    })
+  }
+
   await tenancy.doInTenant(tenantId, async () => {
     // account portal sends a pre-hashed password - honour param to prevent double hashing
     const hashPassword = parseBooleanParam(ctx.request.query.hashPassword)
     // account portal sends no password for SSO users
     const requirePassword = parseBooleanParam(ctx.request.query.requirePassword)
 
-    if (await tenancy.doesTenantExist(tenantId)) {
-      ctx.throw(403, "Organisation already exists.")
-    }
-
     const userExists = await checkAnyUserExists()
     if (userExists) {
       ctx.throw(
@@ -106,7 +134,7 @@ export const adminUser = async (ctx: any) => {
       // always bust checklist beforehand, if an error occurs but can proceed, don't get
       // stuck in a cycle
       await cache.bustCache(cache.CacheKey.CHECKLIST)
-      const finalUser = await sdk.users.save(user, {
+      const finalUser = await userSdk.save(user, {
         hashPassword,
         requirePassword,
       })
@@ -118,7 +146,11 @@ export const adminUser = async (ctx: any) => {
       }
       await events.identification.identifyTenantGroup(tenantId, account)
 
-      ctx.body = finalUser
+      ctx.body = {
+        _id: finalUser._id!,
+        _rev: finalUser._rev!,
+        email: finalUser.email,
+      }
     } catch (err: any) {
       ctx.throw(err.status || 400, err)
     }
@@ -128,7 +160,7 @@ export const adminUser = async (ctx: any) => {
 export const countByApp = async (ctx: any) => {
   const appId = ctx.params.appId
   try {
-    ctx.body = await sdk.users.countUsersByApp(appId)
+    ctx.body = await userSdk.countUsersByApp(appId)
   } catch (err: any) {
     ctx.throw(err.status || 400, err)
   }
@@ -140,7 +172,7 @@ export const destroy = async (ctx: any) => {
     ctx.throw(400, "Unable to delete self.")
   }
 
-  await sdk.users.destroy(id, ctx.user)
+  await userSdk.destroy(id, ctx.user)
 
   ctx.body = {
     message: `User ${id} deleted.`,
@@ -149,7 +181,7 @@ export const destroy = async (ctx: any) => {
 
 export const search = async (ctx: any) => {
   const body = ctx.request.body as SearchUsersRequest
-  const paginated = await sdk.users.paginatedUsers(body)
+  const paginated = await userSdk.paginatedUsers(body)
   // user hashed password shouldn't ever be returned
   for (let user of paginated.data) {
     if (user) {
@@ -161,7 +193,7 @@ export const search = async (ctx: any) => {
 
 // called internally by app server user fetch
 export const fetch = async (ctx: any) => {
-  const all = await sdk.users.allUsers()
+  const all = await userSdk.allUsers()
   // user hashed password shouldn't ever be returned
   for (let user of all) {
     if (user) {
@@ -173,12 +205,12 @@ export const fetch = async (ctx: any) => {
 
 // called internally by app server user find
 export const find = async (ctx: any) => {
-  ctx.body = await sdk.users.getUser(ctx.params.id)
+  ctx.body = await userSdk.getUser(ctx.params.id)
 }
 
 export const tenantUserLookup = async (ctx: any) => {
   const id = ctx.params.id
-  const user = await sdk.users.getPlatformUser(id)
+  const user = await userSdk.getPlatformUser(id)
   if (user) {
     ctx.body = user
   } else {
@@ -188,7 +220,7 @@ export const tenantUserLookup = async (ctx: any) => {
 
 export const invite = async (ctx: any) => {
   const request = ctx.request.body as InviteUserRequest
-  const response = await sdk.users.invite([request])
+  const response = await userSdk.invite([request])
 
   // explicitly throw for single user invite
   if (response.unsuccessful.length) {
@@ -207,7 +239,7 @@ export const invite = async (ctx: any) => {
 
 export const inviteMultiple = async (ctx: any) => {
   const request = ctx.request.body as InviteUsersRequest
-  ctx.body = await sdk.users.invite(request)
+  ctx.body = await userSdk.invite(request)
 }
 
 export const checkInvite = async (ctx: any) => {
@@ -223,13 +255,15 @@ export const checkInvite = async (ctx: any) => {
   }
 }
 
-export const inviteAccept = async (ctx: any) => {
+export const inviteAccept = async (
+  ctx: Ctx<AcceptUserInviteRequest, AcceptUserInviteResponse>
+) => {
   const { inviteCode, password, firstName, lastName } = ctx.request.body
   try {
     // info is an extension of the user object that was stored by global
     const { email, info }: any = await checkInviteCode(inviteCode)
-    ctx.body = await tenancy.doInTenant(info.tenantId, async () => {
-      const saved = await sdk.users.save({
+    const user = await tenancy.doInTenant(info.tenantId, async () => {
+      const saved = await userSdk.save({
         firstName,
         lastName,
         password,
@@ -241,6 +275,12 @@ export const inviteAccept = async (ctx: any) => {
       await events.user.inviteAccepted(user)
       return saved
     })
+
+    ctx.body = {
+      _id: user._id,
+      _rev: user._rev,
+      email: user.email,
+    }
   } catch (err: any) {
     if (err.code === errors.codes.USAGE_LIMIT_EXCEEDED) {
       // explicitly re-throw limit exceeded errors