@budibase/worker 2.3.17-alpha.4 → 2.3.17-alpha.5

package/src/api/controllers/system/accounts.ts

@@ -1,21 +1,23 @@
 import { Account, AccountMetadata } from "@budibase/types"
-import sdk from "../../../sdk"
+import * as accounts from "../../../sdk/accounts"
 
 export const save = async (ctx: any) => {
   const account = ctx.request.body as Account
   let metadata: AccountMetadata = {
-    _id: sdk.accounts.formatAccountMetadataId(account.accountId),
+    _id: accounts.metadata.formatAccountMetadataId(account.accountId),
     email: account.email,
   }
 
-  metadata = await sdk.accounts.saveMetadata(metadata)
+  metadata = await accounts.metadata.saveMetadata(metadata)
 
   ctx.body = metadata
   ctx.status = 200
 }
 
 export const destroy = async (ctx: any) => {
-  const accountId = sdk.accounts.formatAccountMetadataId(ctx.params.accountId)
-  await sdk.accounts.destroyMetadata(accountId)
+  const accountId = accounts.metadata.formatAccountMetadataId(
+    ctx.params.accountId
+  )
+  await accounts.metadata.destroyMetadata(accountId)
   ctx.status = 204
 }

package/src/api/controllers/system/tenants.ts

@@ -1,8 +1,7 @@
-import { BBContext } from "@budibase/types"
-import { deprovisioning } from "@budibase/backend-core"
-import { quotas } from "@budibase/pro"
+import { UserCtx } from "@budibase/types"
+import * as tenantSdk from "../../../sdk/tenants"
 
-const _delete = async (ctx: BBContext) => {
+export async function destroy(ctx: UserCtx) {
   const user = ctx.user!
   const tenantId = ctx.params.tenantId
 
@@ -11,13 +10,10 @@ const _delete = async (ctx: BBContext) => {
   }
 
   try {
-    await quotas.bustCache()
-    await deprovisioning.deleteTenant(tenantId)
+    await tenantSdk.deleteTenant(tenantId)
     ctx.status = 204
   } catch (err) {
     ctx.log.error(err)
     throw err
   }
 }
-
-export { _delete as delete }

package/src/api/index.ts

@@ -3,8 +3,7 @@ const compress = require("koa-compress")
 const zlib = require("zlib")
 import { routes } from "./routes"
 import { middleware as pro } from "@budibase/pro"
-import { errors, auth, middleware } from "@budibase/backend-core"
-import { APIError } from "@budibase/types"
+import { auth, middleware } from "@budibase/backend-core"
 
 const PUBLIC_ENDPOINTS = [
   // deprecated single tenant sso callback
@@ -109,7 +108,9 @@ const NO_TENANCY_ENDPOINTS = [
 const NO_CSRF_ENDPOINTS = [...PUBLIC_ENDPOINTS]
 
 const router: Router = new Router()
+
 router
+  .use(middleware.errorHandling)
   .use(
     compress({
       threshold: 2048,
@@ -136,29 +137,12 @@ router
       (!ctx.isAuthenticated || (ctx.user && !ctx.user.budibaseAccess)) &&
       !ctx.internal
     ) {
-      ctx.throw(403, "Unauthorized - no public worker access")
+      ctx.throw(403, "Unauthorized")
     }
     return next()
   })
   .use(middleware.auditLog)
 
-// error handling middleware - TODO: This could be moved to backend-core
-router.use(async (ctx, next) => {
-  try {
-    await next()
-  } catch (err: any) {
-    ctx.log.error(err)
-    ctx.status = err.status || err.statusCode || 500
-    const error = errors.getPublicError(err)
-    const body: APIError = {
-      message: err.message,
-      status: ctx.status,
-      error,
-    }
-    ctx.body = body
-  }
-})
-
 router.get("/health", ctx => (ctx.status = 200))
 
 // authenticated routes

package/src/api/routes/global/auth.ts

@@ -33,7 +33,7 @@ router
   .post(
     "/api/global/auth/:tenantId/login",
     buildAuthValidation(),
-    authController.authenticate
+    authController.login
   )
   .post("/api/global/auth/logout", authController.logout)
   .post(
@@ -68,21 +68,24 @@ router
 
   // GOOGLE - MULTI TENANT
   .get("/api/global/auth/:tenantId/google", authController.googlePreAuth)
-  .get("/api/global/auth/:tenantId/google/callback", authController.googleAuth)
+  .get(
+    "/api/global/auth/:tenantId/google/callback",
+    authController.googleCallback
+  )
 
   // GOOGLE - SINGLE TENANT - DEPRECATED
-  .get("/api/global/auth/google/callback", authController.googleAuth)
-  .get("/api/admin/auth/google/callback", authController.googleAuth)
+  .get("/api/global/auth/google/callback", authController.googleCallback)
+  .get("/api/admin/auth/google/callback", authController.googleCallback)
 
   // OIDC - MULTI TENANT
   .get(
     "/api/global/auth/:tenantId/oidc/configs/:configId",
     authController.oidcPreAuth
   )
-  .get("/api/global/auth/:tenantId/oidc/callback", authController.oidcAuth)
+  .get("/api/global/auth/:tenantId/oidc/callback", authController.oidcCallback)
 
   // OIDC - SINGLE TENANT - DEPRECATED
-  .get("/api/global/auth/oidc/callback", authController.oidcAuth)
-  .get("/api/admin/auth/oidc/callback", authController.oidcAuth)
+  .get("/api/global/auth/oidc/callback", authController.oidcCallback)
+  .get("/api/admin/auth/oidc/callback", authController.oidcCallback)
 
 export default router

package/src/api/routes/global/tests/auth.spec.ts

@@ -1,13 +1,27 @@
+import { CloudAccount, SSOUser, User } from "@budibase/types"
+
 jest.mock("nodemailer")
-import { TestConfiguration, mocks } from "../../../../tests"
+import {
+  TestConfiguration,
+  mocks,
+  structures,
+  generator,
+} from "../../../../tests"
 const sendMailMock = mocks.email.mock()
-import { events, tenancy } from "@budibase/backend-core"
-import { structures } from "@budibase/backend-core/tests"
+import { events, constants } from "@budibase/backend-core"
+import { Response } from "superagent"
+
+import * as userSdk from "../../../../sdk/users"
+
+function getAuthCookie(response: Response) {
+  return response.headers["set-cookie"]
+    .find((s: string) => s.startsWith(`${constants.Cookie.Auth}=`))
+    .split("=")[1]
+    .split(";")[0]
+}
 
-const expectSetAuthCookie = (res: any) => {
-  expect(
-    res.get("Set-Cookie").find((c: string) => c.startsWith("budibase:auth"))
-  ).toBeDefined()
+const expectSetAuthCookie = (response: Response) => {
+  expect(getAuthCookie(response).length > 1).toBe(true)
 }
 
 describe("/api/global/auth", () => {
@@ -25,60 +39,247 @@ describe("/api/global/auth", () => {
     jest.clearAllMocks()
   })
 
+  async function createSSOUser() {
+    return config.doInTenant(async () => {
+      return userSdk.save(structures.users.ssoUser(), {
+        requirePassword: false,
+      })
+    })
+  }
+
   describe("password", () => {
     describe("POST /api/global/auth/:tenantId/login", () => {
-      it("should login", () => {})
+      it("logs in with correct credentials", async () => {
+        const tenantId = config.tenantId!
+        const email = config.user?.email!
+        const password = config.userPassword
+
+        const response = await config.api.auth.login(tenantId, email, password)
+
+        expectSetAuthCookie(response)
+        expect(events.auth.login).toBeCalledTimes(1)
+      })
+
+      it("should return 403 with incorrect credentials", async () => {
+        const tenantId = config.tenantId!
+        const email = config.user?.email!
+        const password = "incorrect"
+
+        const response = await config.api.auth.login(
+          tenantId,
+          email,
+          password,
+          { status: 403 }
+        )
+        expect(response.body).toEqual({
+          message: "Invalid credentials",
+          status: 403,
+        })
+      })
+
+      it("should return 403 when user doesn't exist", async () => {
+        const tenantId = config.tenantId!
+        const email = "invaliduser@test.com"
+        const password = "password"
+
+        const response = await config.api.auth.login(
+          tenantId,
+          email,
+          password,
+          { status: 403 }
+        )
+        expect(response.body).toEqual({
+          message: "Invalid credentials",
+          status: 403,
+        })
+      })
+
+      describe("sso user", () => {
+        let user: User
+
+        async function testSSOUser() {
+          const tenantId = user.tenantId!
+          const email = user.email
+          const password = "test"
+
+          const response = await config.api.auth.login(
+            tenantId,
+            email,
+            password,
+            { status: 400 }
+          )
+
+          expect(response.body).toEqual({
+            message: "SSO user cannot login using password",
+            status: 400,
+          })
+        }
+
+        describe("budibase sso user", () => {
+          it("should prevent user from logging in", async () => {
+            user = await createSSOUser()
+            await testSSOUser()
+          })
+        })
+
+        describe("root account sso user", () => {
+          it("should prevent user from logging in", async () => {
+            user = await config.createUser()
+            const account = structures.accounts.ssoAccount() as CloudAccount
+            mocks.accounts.getAccount.mockReturnValueOnce(
+              Promise.resolve(account)
+            )
+
+            await testSSOUser()
+          })
+        })
+      })
     })
 
     describe("POST /api/global/auth/logout", () => {
       it("should logout", async () => {
-        await config.api.auth.logout()
+        const response = await config.api.auth.logout()
         expect(events.auth.logout).toBeCalledTimes(1)
 
-        // TODO: Verify sessions deleted
+        const authCookie = getAuthCookie(response)
+        expect(authCookie).toBe("")
       })
     })
 
     describe("POST /api/global/auth/:tenantId/reset", () => {
       it("should generate password reset email", async () => {
-        await tenancy.doInTenant(config.tenant1User!.tenantId, async () => {
-          const userEmail = structures.email()
-          const { res, code } = await config.api.auth.requestPasswordReset(
+        const user = await config.createUser()
+
+        const { res, code } = await config.api.auth.requestPasswordReset(
+          sendMailMock,
+          user.email
+        )
+
+        expect(res.body).toEqual({
+          message: "Please check your email for a reset link.",
+        })
+        expect(sendMailMock).toHaveBeenCalled()
+        expect(code).toBeDefined()
+        expect(events.user.passwordResetRequested).toBeCalledTimes(1)
+        expect(events.user.passwordResetRequested).toBeCalledWith(user)
+      })
+
+      describe("sso user", () => {
+        let user: User
+
+        async function testSSOUser() {
+          const { res } = await config.api.auth.requestPasswordReset(
             sendMailMock,
-            userEmail
+            user.email,
+            { status: 400 }
           )
-          const user = await config.getUser(userEmail)
 
           expect(res.body).toEqual({
-            message: "Please check your email for a reset link.",
+            message: "SSO user cannot reset password",
+            status: 400,
+            error: {
+              code: "http",
+              type: "generic",
+            },
           })
-          expect(sendMailMock).toHaveBeenCalled()
+          expect(sendMailMock).not.toHaveBeenCalled()
+        }
 
-          expect(code).toBeDefined()
-          expect(events.user.passwordResetRequested).toBeCalledTimes(1)
-          expect(events.user.passwordResetRequested).toBeCalledWith(user)
+        describe("budibase sso user", () => {
+          it("should prevent user from generating password reset email", async () => {
+            user = await createSSOUser()
+            await testSSOUser()
+          })
+        })
+
+        describe("root account sso user", () => {
+          it("should prevent user from generating password reset email", async () => {
+            user = await config.createUser(structures.users.user())
+            const account = structures.accounts.ssoAccount() as CloudAccount
+            mocks.accounts.getAccount.mockReturnValueOnce(
+              Promise.resolve(account)
+            )
+
+            await testSSOUser()
+          })
         })
       })
     })
 
     describe("POST /api/global/auth/:tenantId/reset/update", () => {
       it("should reset password", async () => {
-        await tenancy.doInTenant(config.tenant1User!.tenantId, async () => {
-          const userEmail = structures.email()
-          const { code } = await config.api.auth.requestPasswordReset(
-            sendMailMock,
-            userEmail
+        let user = await config.createUser()
+        const { code } = await config.api.auth.requestPasswordReset(
+          sendMailMock,
+          user.email
+        )
+        delete user.password
+
+        const newPassword = "newpassword"
+        const res = await config.api.auth.updatePassword(code!, newPassword)
+
+        user = await config.getUser(user.email)
+        delete user.password
+
+        expect(res.body).toEqual({ message: "password reset successfully." })
+        expect(events.user.passwordReset).toBeCalledTimes(1)
+        expect(events.user.passwordReset).toBeCalledWith(user)
+
+        // login using new password
+        await config.api.auth.login(user.tenantId, user.email, newPassword)
+      })
+
+      describe("sso user", () => {
+        let user: User | SSOUser
+
+        async function testSSOUser(code: string) {
+          const res = await config.api.auth.updatePassword(
+            code!,
+            generator.string(),
+            { status: 400 }
           )
-          const user = await config.getUser(userEmail)
-          delete user.password
 
-          const res = await config.api.auth.updatePassword(code)
+          expect(res.body).toEqual({
+            message: "Cannot reset password.",
+            status: 400,
+          })
+        }
+
+        describe("budibase sso user", () => {
+          it("should prevent user from generating password reset email", async () => {
+            user = await config.createUser()
+            const { code } = await config.api.auth.requestPasswordReset(
+              sendMailMock,
+              user.email
+            )
+
+            // convert to sso now that password reset has been requested
+            const ssoUser = user as SSOUser
+            ssoUser.providerType = structures.sso.providerType()
+            delete ssoUser.password
+            await config.doInTenant(() => userSdk.save(ssoUser))
+
+            await testSSOUser(code!)
+          })
+        })
 
-          expect(res.body).toEqual({ message: "password reset successfully." })
-          expect(events.user.passwordReset).toBeCalledTimes(1)
-          expect(events.user.passwordReset).toBeCalledWith(user)
+        describe("root account sso user", () => {
+          it("should prevent user from generating password reset email", async () => {
+            user = await config.createUser()
+            const { code } = await config.api.auth.requestPasswordReset(
+              sendMailMock,
+              user.email
+            )
+
+            // convert to account owner now that password has been requested
+            const account = structures.accounts.ssoAccount() as CloudAccount
+            mocks.accounts.getAccount.mockReturnValueOnce(
+              Promise.resolve(account)
+            )
+
+            await testSSOUser(code!)
+          })
         })
-        // TODO: Login using new password
       })
     })
   })
@@ -153,7 +354,7 @@ describe("/api/global/auth", () => {
         const location: string = res.get("location")
         expect(
           location.startsWith(
-            "http://localhost/auth?response_type=code&client_id=clientId&redirect_uri=http%3A%2F%2Flocalhost%3A10000%2Fapi%2Fglobal%2Fauth%2Fdefault%2Foidc%2Fcallback&scope=openid%20profile%20email%20offline_access"
+            `http://localhost/auth?response_type=code&client_id=clientId&redirect_uri=http%3A%2F%2Flocalhost%3A10000%2Fapi%2Fglobal%2Fauth%2F${config.tenantId}%2Foidc%2Fcallback&scope=openid%20profile%20email%20offline_access`
           )
         ).toBe(true)
       })