@budibase/worker 2.3.17 → 2.3.18-alpha.0

package/__mocks__/node-fetch.ts

@@ -0,0 +1,23 @@
+import fs from "fs"
+module FetchMock {
+  const fetch = jest.requireActual("node-fetch")
+
+  const func = async (url: any, opts: any) => {
+    if (url.includes("http://someconfigurl")) {
+      return {
+        ok: true,
+        json: () => ({
+          issuer: "test",
+          authorization_endpoint: "http://localhost/auth",
+          token_endpoint: "http://localhost/token",
+          userinfo_endpoint: "http://localhost/userinfo",
+        }),
+      }
+    }
+    return fetch(url, opts)
+  }
+
+  func.Headers = fetch.Headers
+
+  module.exports = func
+}

package/jest-testcontainers-config.js

@@ -0,0 +1,8 @@
+const { join } = require("path")
+require("dotenv").config({
+  path: join(__dirname, "..", "..", "hosting", ".env"),
+})
+
+const jestTestcontainersConfigGenerator = require("../../jestTestcontainersConfigGenerator")
+
+module.exports = jestTestcontainersConfigGenerator()

package/jest.config.ts

@@ -1,8 +1,10 @@
 import { Config } from "@jest/types"
 import * as fs from "fs"
+const preset = require("ts-jest/jest-preset")
 
 const config: Config.InitialOptions = {
-  testEnvironment: "node",
+  ...preset,
+  preset: "@trendyol/jest-testcontainers",
   setupFiles: ["./src/tests/jestEnv.ts"],
   setupFilesAfterEnv: ["./src/tests/jestSetup.ts"],
   collectCoverageFrom: ["src/**/*.{js,ts}"],
@@ -18,7 +20,6 @@ if (!process.env.CI) {
     "@budibase/backend-core/(.*)": "<rootDir>/../backend-core/$1",
     "@budibase/backend-core": "<rootDir>/../backend-core/src",
     "@budibase/types": "<rootDir>/../types/src",
-    "^axios.*$": "<rootDir>/node_modules/axios/lib/axios.js",
   }
   // add pro sources if they exist
   if (fs.existsSync("../../../budibase-pro")) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/worker",
   "email": "hi@budibase.com",
-  "version": "2.3.17",
+  "version": "2.3.18-alpha.0",
   "description": "Budibase background service",
   "main": "src/index.ts",
   "repository": {
@@ -36,16 +36,17 @@
   "author": "Budibase",
   "license": "GPL-3.0",
   "dependencies": {
-    "@budibase/backend-core": "^2.3.17",
-    "@budibase/pro": "2.3.16",
-    "@budibase/string-templates": "^2.3.17",
-    "@budibase/types": "^2.3.17",
+    "@budibase/backend-core": "2.3.18-alpha.0",
+    "@budibase/pro": "2.3.17",
+    "@budibase/string-templates": "2.3.18-alpha.0",
+    "@budibase/types": "2.3.18-alpha.0",
     "@koa/router": "8.0.8",
     "@sentry/node": "6.17.7",
     "@techpass/passport-openidconnect": "0.3.2",
     "@types/global-agent": "2.1.1",
     "aws-sdk": "2.1030.0",
     "bcryptjs": "2.4.3",
+    "dd-trace": "3.13.2",
     "dotenv": "8.6.0",
     "elastic-apm-node": "3.38.0",
     "global-agent": "3.0.0",
@@ -72,7 +73,8 @@
   "devDependencies": {
     "@swc/core": "^1.3.25",
     "@swc/jest": "^0.2.24",
-    "@types/jest": "26.0.23",
+    "@trendyol/jest-testcontainers": "^2.1.1",
+    "@types/jest": "28.1.1",
     "@types/jsonwebtoken": "8.5.1",
     "@types/koa": "2.13.4",
     "@types/koa__router": "8.0.8",
@@ -80,6 +82,7 @@
     "@types/node-fetch": "2.6.1",
     "@types/pouchdb": "6.4.0",
     "@types/server-destroy": "1.0.1",
+    "@types/supertest": "2.0.12",
     "@types/uuid": "8.3.4",
     "@typescript-eslint/parser": "5.45.0",
     "copyfiles": "2.4.1",
@@ -97,5 +100,5 @@
     "typescript": "4.7.3",
     "update-dotenv": "1.1.1"
   },
-  "gitHead": "a57c922b91c1df8dc276588a5ad583a0c1aea52c"
+  "gitHead": "f4dd710b75eb0a7a65e6f9d8b8f709d3b76c435b"
 }

package/scripts/dev/manage.js

@@ -29,6 +29,7 @@ async function init() {
       SERVICE: "worker-service",
       DEPLOYMENT_ENVIRONMENT: "development",
       TENANT_FEATURE_FLAGS: "*:LICENSING,*:USER_GROUPS,*:ONBOARDING_TOUR",
+      ENABLE_EMAIL_TEST_MODE: 1,
     }
     let envFile = ""
     Object.keys(envFileJson).forEach(key => {

package/src/api/controllers/global/auth.ts

@@ -1,49 +1,55 @@
 import {
-  auth,
+  auth as authCore,
   constants,
   context,
   db as dbCore,
   events,
   tenancy,
-  users as usersCore,
-  utils,
+  utils as utilsCore,
 } from "@budibase/backend-core"
-import { EmailTemplatePurpose } from "../../../constants"
-import { isEmailConfigured, sendEmail } from "../../../utilities/email"
-import { checkResetPasswordCode } from "../../../utilities/redis"
+import {
+  ConfigType,
+  User,
+  Ctx,
+  LoginRequest,
+  SSOUser,
+  PasswordResetRequest,
+  PasswordResetUpdateRequest,
+} from "@budibase/types"
 import env from "../../../environment"
-import sdk from "../../../sdk"
-import { ConfigType, User } from "@budibase/types"
 
-const { setCookie, getCookie, clearCookie, hash, platformLogout } = utils
-const { Cookie, Header } = constants
-const { passport, ssoCallbackUrl, google, oidc } = auth
+import * as authSdk from "../../../sdk/auth"
+import * as userSdk from "../../../sdk/users"
 
-export async function googleCallbackUrl(config?: { callbackURL?: string }) {
-  return ssoCallbackUrl(tenancy.getGlobalDB(), config, ConfigType.GOOGLE)
-}
+const { Cookie, Header } = constants
+const { passport, ssoCallbackUrl, google, oidc } = authCore
+const { setCookie, getCookie, clearCookie } = utilsCore
 
-export async function oidcCallbackUrl(config?: { callbackURL?: string }) {
-  return ssoCallbackUrl(tenancy.getGlobalDB(), config, ConfigType.OIDC)
-}
+// LOGIN / LOGOUT
 
-async function authInternal(ctx: any, user: any, err: any = null, info = null) {
+async function passportCallback(
+  ctx: Ctx,
+  user: User,
+  err: any = null,
+  info: { message: string } | null = null
+) {
   if (err) {
     console.error("Authentication error")
     console.error(err)
     console.trace(err)
     return ctx.throw(403, info ? info : "Unauthorized")
   }
-
   if (!user) {
     console.error("Authentication error - no user provided")
     return ctx.throw(403, info ? info : "Unauthorized")
   }
 
+  const token = await authSdk.loginUser(user)
+
   // set a cookie for browser access
-  setCookie(ctx, user.token, Cookie.Auth, { sign: false })
+  setCookie(ctx, token, Cookie.Auth, { sign: false })
   // set the token in a header as well for APIs
-  ctx.set(Header.TOKEN, user.token)
+  ctx.set(Header.TOKEN, token)
   // get rid of any app cookies on login
   // have to check test because this breaks cypress
   if (!env.isTest()) {
@@ -51,11 +57,18 @@ async function authInternal(ctx: any, user: any, err: any = null, info = null) {
   }
 }
 
-export const authenticate = async (ctx: any, next: any) => {
+export const login = async (ctx: Ctx<LoginRequest>, next: any) => {
+  const email = ctx.request.body.username
+
+  const user = await userSdk.getUserByEmail(email)
+  if (user && (await userSdk.isPreventSSOPasswords(user))) {
+    ctx.throw(400, "SSO user cannot login using password")
+  }
+
   return passport.authenticate(
     "local",
     async (err: any, user: User, info: any) => {
-      await authInternal(ctx, user, err, info)
+      await passportCallback(ctx, user, err, info)
       await context.identity.doInUserContext(user, async () => {
         await events.auth.login("local")
       })
@@ -64,6 +77,15 @@ export const authenticate = async (ctx: any, next: any) => {
   )(ctx, next)
 }
 
+export const logout = async (ctx: any) => {
+  if (ctx.user && ctx.user._id) {
+    await authSdk.logout({ ctx, userId: ctx.user._id })
+  }
+  ctx.body = { message: "User logged out." }
+}
+
+// INIT
+
 export const setInitInfo = (ctx: any) => {
   const initInfo = ctx.request.body
   setCookie(ctx, initInfo, Cookie.Init)
@@ -79,32 +101,16 @@ export const getInitInfo = (ctx: any) => {
   }
 }
 
+// PASSWORD MANAGEMENT
+
 /**
  * Reset the user password, used as part of a forgotten password flow.
  */
-export const reset = async (ctx: any) => {
+export const reset = async (ctx: Ctx<PasswordResetRequest>) => {
   const { email } = ctx.request.body
-  const configured = await isEmailConfigured()
-  if (!configured) {
-    ctx.throw(
-      400,
-      "Please contact your platform administrator, SMTP is not configured."
-    )
-  }
-  try {
-    const user = (await usersCore.getGlobalUserByEmail(email)) as User
-    // only if user exists, don't error though if they don't
-    if (user) {
-      await sendEmail(email, EmailTemplatePurpose.PASSWORD_RECOVERY, {
-        user,
-        subject: "{{ company }} platform password reset",
-      })
-      await events.user.passwordResetRequested(user)
-    }
-  } catch (err) {
-    console.log(err)
-    // don't throw any kind of error to the user, this might give away something
-  }
+
+  await authSdk.reset(email)
+
   ctx.body = {
     message: "Please check your email for a reset link.",
   }
@@ -113,32 +119,21 @@ export const reset = async (ctx: any) => {
 /**
  * Perform the user password update if the provided reset code is valid.
  */
-export const resetUpdate = async (ctx: any) => {
+export const resetUpdate = async (ctx: Ctx<PasswordResetUpdateRequest>) => {
   const { resetCode, password } = ctx.request.body
   try {
-    const { userId } = await checkResetPasswordCode(resetCode)
-    const db = tenancy.getGlobalDB()
-    const user = await db.get(userId)
-    user.password = await hash(password)
-    await db.put(user)
+    await authSdk.resetUpdate(resetCode, password)
     ctx.body = {
       message: "password reset successfully.",
     }
-    // remove password from the user before sending events
-    delete user.password
-    await events.user.passwordReset(user)
   } catch (err) {
-    console.error(err)
+    console.warn(err)
+    // hide any details of the error for security
     ctx.throw(400, "Cannot reset password.")
   }
 }
 
-export const logout = async (ctx: any) => {
-  if (ctx.user && ctx.user._id) {
-    await platformLogout({ ctx, userId: ctx.user._id })
-  }
-  ctx.body = { message: "User logged out." }
-}
+// DATASOURCE
 
 export const datasourcePreAuth = async (ctx: any, next: any) => {
   const provider = ctx.params.provider
@@ -166,6 +161,12 @@ export const datasourceAuth = async (ctx: any, next: any) => {
   return handler.postAuth(passport, ctx, next)
 }
 
+// GOOGLE SSO
+
+export async function googleCallbackUrl(config?: { callbackURL?: string }) {
+  return ssoCallbackUrl(tenancy.getGlobalDB(), config, ConfigType.GOOGLE)
+}
+
 /**
  * The initial call that google authentication makes to take you to the google login screen.
  * On a successful login, you will be redirected to the googleAuth callback route.
@@ -181,7 +182,7 @@ export const googlePreAuth = async (ctx: any, next: any) => {
   const strategy = await google.strategyFactory(
     config,
     callbackUrl,
-    sdk.users.save
+    userSdk.save
   )
 
   return passport.authenticate(strategy, {
@@ -191,7 +192,7 @@ export const googlePreAuth = async (ctx: any, next: any) => {
   })(ctx, next)
 }
 
-export const googleAuth = async (ctx: any, next: any) => {
+export const googleCallback = async (ctx: any, next: any) => {
   const db = tenancy.getGlobalDB()
 
   const config = await dbCore.getScopedConfig(db, {
@@ -202,14 +203,14 @@ export const googleAuth = async (ctx: any, next: any) => {
   const strategy = await google.strategyFactory(
     config,
     callbackUrl,
-    sdk.users.save
+    userSdk.save
   )
 
   return passport.authenticate(
     strategy,
     { successRedirect: "/", failureRedirect: "/error" },
-    async (err: any, user: User, info: any) => {
-      await authInternal(ctx, user, err, info)
+    async (err: any, user: SSOUser, info: any) => {
+      await passportCallback(ctx, user, err, info)
       await context.identity.doInUserContext(user, async () => {
         await events.auth.login("google-internal")
       })
@@ -218,6 +219,12 @@ export const googleAuth = async (ctx: any, next: any) => {
   )(ctx, next)
 }
 
+// OIDC SSO
+
+export async function oidcCallbackUrl(config?: { callbackURL?: string }) {
+  return ssoCallbackUrl(tenancy.getGlobalDB(), config, ConfigType.OIDC)
+}
+
 export const oidcStrategyFactory = async (ctx: any, configId: any) => {
   const db = tenancy.getGlobalDB()
   const config = await dbCore.getScopedConfig(db, {
@@ -233,7 +240,7 @@ export const oidcStrategyFactory = async (ctx: any, configId: any) => {
     chosenConfig,
     callbackUrl
   )
-  return oidc.strategyFactory(enrichedConfig, sdk.users.save)
+  return oidc.strategyFactory(enrichedConfig, userSdk.save)
 }
 
 /**
@@ -265,15 +272,15 @@ export const oidcPreAuth = async (ctx: any, next: any) => {
   })(ctx, next)
 }
 
-export const oidcAuth = async (ctx: any, next: any) => {
+export const oidcCallback = async (ctx: any, next: any) => {
   const configId = getCookie(ctx, Cookie.OIDC_CONFIG)
   const strategy = await oidcStrategyFactory(ctx, configId)
 
   return passport.authenticate(
     strategy,
     { successRedirect: "/", failureRedirect: "/error" },
-    async (err: any, user: any, info: any) => {
-      await authInternal(ctx, user, err, info)
+    async (err: any, user: SSOUser, info: any) => {
+      await passportCallback(ctx, user, err, info)
       await context.identity.doInUserContext(user, async () => {
         await events.auth.login("oidc")
       })

package/src/api/controllers/global/self.ts

@@ -1,18 +1,22 @@
-import sdk from "../../../sdk"
+import * as userSdk from "../../../sdk/users"
 import {
-  events,
   featureFlags,
   tenancy,
   constants,
   db as dbCore,
   utils,
-  cache,
   encryption,
+  auth as authCore,
 } from "@budibase/backend-core"
 import env from "../../../environment"
 import { groups } from "@budibase/pro"
-const { hash, platformLogout, getCookie, clearCookie, newid } = utils
-const { user: userCache } = cache
+import {
+  UpdateSelfRequest,
+  UpdateSelfResponse,
+  UpdateSelf,
+  UserCtx,
+} from "@budibase/types"
+const { getCookie, clearCookie, newid } = utils
 
 function newTestApiKey() {
   return env.ENCRYPTED_TEST_PUBLIC_API_KEY
@@ -93,17 +97,6 @@ const addSessionAttributesToUser = (ctx: any) => {
   ctx.body.csrfToken = ctx.user.csrfToken
 }
 
-const sanitiseUserUpdate = (ctx: any) => {
-  const allowed = ["firstName", "lastName", "password", "forceResetPassword"]
-  const resp: { [key: string]: any } = {}
-  for (let [key, value] of Object.entries(ctx.request.body)) {
-    if (allowed.includes(key)) {
-      resp[key] = value
-    }
-  }
-  return resp
-}
-
 export async function getSelf(ctx: any) {
   if (!ctx.user) {
     ctx.throw(403, "User not logged in")
@@ -116,7 +109,7 @@ export async function getSelf(ctx: any) {
   checkCurrentApp(ctx)
 
   // get the main body of the user
-  const user = await sdk.users.getUser(userId)
+  const user = await userSdk.getUser(userId)
   ctx.body = await groups.enrichUserRolesFromGroups(user)
 
   // add the feature flags for this tenant
@@ -126,39 +119,30 @@ export async function getSelf(ctx: any) {
   addSessionAttributesToUser(ctx)
 }
 
-export async function updateSelf(ctx: any) {
-  const db = tenancy.getGlobalDB()
-  const user = await db.get(ctx.user._id)
-  let passwordChange = false
-
-  const userUpdateObj = sanitiseUserUpdate(ctx)
-  if (userUpdateObj.password) {
-    // changing password
-    passwordChange = true
-    userUpdateObj.password = await hash(userUpdateObj.password)
+export async function updateSelf(
+  ctx: UserCtx<UpdateSelfRequest, UpdateSelfResponse>
+) {
+  const body = ctx.request.body
+  const update: UpdateSelf = {
+    firstName: body.firstName,
+    lastName: body.lastName,
+    password: body.password,
+    forceResetPassword: body.forceResetPassword,
+  }
+
+  const user = await userSdk.updateSelf(ctx.user._id!, update)
+
+  if (update.password) {
     // Log all other sessions out apart from the current one
-    await platformLogout({
+    await authCore.platformLogout({
       ctx,
-      userId: ctx.user._id,
+      userId: ctx.user._id!,
       keepActiveSession: true,
     })
   }
 
-  const response = await db.put({
-    ...user,
-    ...userUpdateObj,
-  })
-  await userCache.invalidateUser(user._id)
   ctx.body = {
-    _id: response.id,
-    _rev: response.rev,
-  }
-
-  // remove the old password from the user before sending events
-  user._rev = response.rev
-  delete user.password
-  await events.user.updated(user)
-  if (passwordChange) {
-    await events.user.passwordUpdated(user)
+    _id: user._id!,
+    _rev: user._rev!,
   }
 }