@budibase/worker 2.3.17 → 2.3.18-alpha.1

package/src/sdk/auth/auth.ts

@@ -0,0 +1,86 @@
+import {
+  auth as authCore,
+  tenancy,
+  utils as coreUtils,
+  sessions,
+  events,
+  HTTPError,
+} from "@budibase/backend-core"
+import { PlatformLogoutOpts, User } from "@budibase/types"
+import jwt from "jsonwebtoken"
+import env from "../../environment"
+import * as userSdk from "../users"
+import * as emails from "../../utilities/email"
+import * as redis from "../../utilities/redis"
+import { EmailTemplatePurpose } from "../../constants"
+
+// LOGIN / LOGOUT
+
+export async function loginUser(user: User) {
+  const sessionId = coreUtils.newid()
+  const tenantId = tenancy.getTenantId()
+  await sessions.createASession(user._id!, { sessionId, tenantId })
+  const token = jwt.sign(
+    {
+      userId: user._id,
+      sessionId,
+      tenantId,
+    },
+    env.JWT_SECRET!
+  )
+  return token
+}
+
+export async function logout(opts: PlatformLogoutOpts) {
+  // TODO: This should be moved out of core and into worker only
+  // account-portal can call worker endpoint
+  return authCore.platformLogout(opts)
+}
+
+// PASSWORD MANAGEMENT
+
+/**
+ * Reset the user password, used as part of a forgotten password flow.
+ */
+export const reset = async (email: string) => {
+  const configured = await emails.isEmailConfigured()
+  if (!configured) {
+    throw new HTTPError(
+      "Please contact your platform administrator, SMTP is not configured.",
+      400
+    )
+  }
+
+  const user = await userSdk.core.getGlobalUserByEmail(email)
+  // exit if user doesn't exist
+  if (!user) {
+    return
+  }
+
+  // exit if user has sso
+  if (await userSdk.isPreventSSOPasswords(user)) {
+    throw new HTTPError("SSO user cannot reset password", 400)
+  }
+
+  // send password reset
+  await emails.sendEmail(email, EmailTemplatePurpose.PASSWORD_RECOVERY, {
+    user,
+    subject: "{{ company }} platform password reset",
+  })
+  await events.user.passwordResetRequested(user)
+}
+
+/**
+ * Perform the user password update if the provided reset code is valid.
+ */
+export const resetUpdate = async (resetCode: string, password: string) => {
+  const { userId } = await redis.checkResetPasswordCode(resetCode)
+
+  let user = await userSdk.getUser(userId)
+  user.password = password
+  user = await userSdk.save(user)
+
+  // remove password from the user before sending events
+  delete user.password
+  await events.user.passwordReset(user)
+}

package/src/sdk/auth/index.ts

@@ -0,0 +1 @@
+export * from "./auth"

package/src/sdk/tenants/index.ts

@@ -0,0 +1 @@
+export * from "./tenants"

package/src/sdk/tenants/tenants.ts

@@ -0,0 +1,76 @@
+import { App } from "@budibase/types"
+import { tenancy, db as dbCore, platform } from "@budibase/backend-core"
+import { quotas } from "@budibase/pro"
+
+export async function deleteTenant(tenantId: string) {
+  await quotas.bustCache()
+  await platform.tenants.removeTenant(tenantId)
+  await removeTenantUsers(tenantId)
+  await removeTenantApps(tenantId)
+  await removeGlobalDB(tenantId)
+}
+
+async function removeGlobalDB(tenantId: string) {
+  try {
+    const db = tenancy.getTenantDB(tenantId)
+    await db.destroy()
+  } catch (err) {
+    console.error(`Error removing tenant ${tenantId} users from info db`, err)
+    throw err
+  }
+}
+
+async function removeTenantApps(tenantId: string) {
+  try {
+    const apps = (await dbCore.getAllApps({ all: true })) as App[]
+    const destroyPromises = apps.map(app => {
+      const db = dbCore.getDB(app.appId)
+      return db.destroy()
+    })
+    await Promise.allSettled(destroyPromises)
+  } catch (err) {
+    console.error(`Error removing tenant ${tenantId} apps`, err)
+    throw err
+  }
+}
+
+function getTenantUsers(tenantId: string) {
+  const db = tenancy.getTenantDB(tenantId)
+
+  return db.allDocs(
+    dbCore.getGlobalUserParams(null, {
+      include_docs: true,
+    })
+  )
+}
+
+async function removeTenantUsers(tenantId: string) {
+  try {
+    const allUsers = await getTenantUsers(tenantId)
+    const allEmails = allUsers.rows.map((row: any) => row.doc.email)
+
+    // get the id and email doc ids
+    let keys = allUsers.rows.map((row: any) => row.id)
+    keys = keys.concat(allEmails)
+
+    const platformDb = platform.getPlatformDB()
+
+    // retrieve the docs
+    const userDocs = await platformDb.allDocs({
+      keys,
+      include_docs: true,
+    })
+
+    // delete the docs
+    const toDelete = userDocs.rows.map((row: any) => {
+      return {
+        ...row.doc,
+        _deleted: true,
+      }
+    })
+    await platformDb.bulkDocs(toDelete)
+  } catch (err) {
+    console.error(`Error removing tenant ${tenantId} users from info db`, err)
+    throw err
+  }
+}

package/src/sdk/users/events.ts

@@ -84,6 +84,10 @@ export const handleSaveEvents = async (
     ) {
       await events.user.passwordForceReset(user)
     }
+
+    if (user.password !== existingUser.password) {
+      await events.user.passwordUpdated(user)
+    }
   } else {
     await events.user.created(user)
   }

package/src/sdk/users/index.ts

@@ -1 +1,2 @@
 export * from "./users"
+export { users as core } from "@budibase/backend-core"

package/src/sdk/users/tests/users.spec.ts

@@ -0,0 +1,52 @@
+import { structures } from "../../../tests"
+import * as users from "../users"
+import env from "../../../environment"
+import { mocks } from "@budibase/backend-core/tests"
+import { CloudAccount } from "@budibase/types"
+
+describe("users", () => {
+  describe("isPreventSSOPasswords", () => {
+    it("returns true for sso account user", async () => {
+      const user = structures.users.user()
+      mocks.accounts.getAccount.mockReturnValue(
+        Promise.resolve(structures.accounts.ssoAccount() as CloudAccount)
+      )
+      const result = await users.isPreventSSOPasswords(user)
+      expect(result).toBe(true)
+    })
+
+    it("returns true for sso user", async () => {
+      const user = structures.users.ssoUser()
+      const result = await users.isPreventSSOPasswords(user)
+      expect(result).toBe(true)
+    })
+
+    describe("sso maintenance mode", () => {
+      beforeEach(() => {
+        env._set("ENABLE_SSO_MAINTENANCE_MODE", true)
+      })
+
+      afterEach(() => {
+        env._set("ENABLE_SSO_MAINTENANCE_MODE", false)
+      })
+
+      describe("non-admin user", () => {
+        it("returns true", async () => {
+          const user = structures.users.ssoUser()
+          const result = await users.isPreventSSOPasswords(user)
+          expect(result).toBe(true)
+        })
+      })
+
+      describe("admin user", () => {
+        it("returns false", async () => {
+          const user = structures.users.ssoUser({
+            user: structures.users.adminUser(),
+          })
+          const result = await users.isPreventSSOPasswords(user)
+          expect(result).toBe(false)
+        })
+      })
+    })
+  })
+})

package/src/sdk/users/users.ts

@@ -6,12 +6,11 @@ import {
   cache,
   constants,
   db as dbUtils,
-  deprovisioning,
   events,
   HTTPError,
-  migrations,
   sessions,
   tenancy,
+  platform,
   users as usersCore,
   utils,
   ViewName,
@@ -21,21 +20,22 @@ import {
   AllDocsResponse,
   BulkUserResponse,
   CloudAccount,
-  CreateUserResponse,
   InviteUsersRequest,
   InviteUsersResponse,
-  MigrationType,
+  isSSOAccount,
+  isSSOUser,
   PlatformUser,
   PlatformUserByEmail,
   RowResponse,
   SearchUsersRequest,
+  UpdateSelf,
   User,
-  ThirdPartyUser,
-  isUser,
+  SaveUserOpts,
 } from "@budibase/types"
 import { sendEmail } from "../../utilities/email"
 import { EmailTemplatePurpose } from "../../constants"
 import { groups as groupsSdk } from "@budibase/pro"
+import * as accountSdk from "../accounts"
 
 const PAGE_LIMIT = 8
 
@@ -94,26 +94,23 @@ export const paginatedUsers = async ({
   })
 }
 
+export async function getUserByEmail(email: string) {
+  return usersCore.getGlobalUserByEmail(email)
+}
+
 /**
  * Gets a user by ID from the global database, based on the current tenancy.
  */
 export const getUser = async (userId: string) => {
-  const db = tenancy.getGlobalDB()
-  let user = await db.get(userId)
+  const user = await usersCore.getById(userId)
   if (user) {
     delete user.password
   }
   return user
 }
 
-export interface SaveUserOpts {
-  hashPassword?: boolean
-  requirePassword?: boolean
-  currentUserId?: string
-}
-
 const buildUser = async (
-  user: User | ThirdPartyUser,
+  user: User,
   opts: SaveUserOpts = {
     hashPassword: true,
     requirePassword: true,
@@ -121,11 +118,13 @@ const buildUser = async (
   tenantId: string,
   dbUser?: any
 ): Promise<User> => {
-  let fullUser = user as User
-  let { password, _id } = fullUser
+  let { password, _id } = user
 
   let hashedPassword
   if (password) {
+    if (await isPreventSSOPasswords(user)) {
+      throw new HTTPError("SSO user cannot set password", 400)
+    }
     hashedPassword = opts.hashPassword ? await utils.hash(password) : password
   } else if (dbUser) {
     hashedPassword = dbUser.password
@@ -135,10 +134,10 @@ const buildUser = async (
 
   _id = _id || dbUtils.generateGlobalUserID()
 
-  fullUser = {
+  const fullUser = {
     createdAt: Date.now(),
     ...dbUser,
-    ...fullUser,
+    ...user,
     _id,
     password: hashedPassword,
     tenantId,
@@ -189,10 +188,36 @@ const validateUniqueUser = async (email: string, tenantId: string) => {
   }
 }
 
+export async function isPreventSSOPasswords(user: User) {
+  // when in maintenance mode we allow sso users with the admin role
+  // to perform any password action - this prevents lockout
+  if (env.ENABLE_SSO_MAINTENANCE_MODE && user.admin?.global) {
+    return false
+  }
+
+  // Check local sso
+  if (isSSOUser(user)) {
+    return true
+  }
+
+  // Check account sso
+  const account = await accountSdk.api.getAccount(user.email)
+  return !!(account && isSSOAccount(account))
+}
+
+export async function updateSelf(id: string, data: UpdateSelf) {
+  let user = await getUser(id)
+  user = {
+    ...user,
+    ...data,
+  }
+  return save(user)
+}
+
 export const save = async (
-  user: User | ThirdPartyUser,
+  user: User,
   opts: SaveUserOpts = {}
-): Promise<CreateUserResponse> => {
+): Promise<User> => {
   // default booleans to true
   if (opts.hashPassword == null) {
     opts.hashPassword = true
@@ -264,7 +289,7 @@ export const save = async (
     builtUser._rev = response.rev
 
     await eventHelpers.handleSaveEvents(builtUser, dbUser)
-    await addTenant(tenantId, _id, email)
+    await platform.users.addUser(tenantId, builtUser._id!, builtUser.email)
     await cache.user.invalidateUser(response.id)
 
     // let server know to sync user
@@ -272,11 +297,8 @@ export const save = async (
 
     await Promise.all(groupPromises)
 
-    return {
-      _id: response.id,
-      _rev: response.rev,
-      email,
-    }
+    // finally returned the saved user from the db
+    return db.get(builtUser._id!)
   } catch (err: any) {
     if (err.status === 409) {
       throw "User exists already"
@@ -286,21 +308,6 @@ export const save = async (
   }
 }
 
-export const addTenant = async (
-  tenantId: string,
-  _id: string,
-  email: string
-) => {
-  if (env.MULTI_TENANCY) {
-    const afterCreateTenant = () =>
-      migrations.backPopulateMigrations({
-        type: MigrationType.GLOBAL,
-        tenantId,
-      })
-    await tenancy.tryAddTenant(tenantId, _id, email, afterCreateTenant)
-  }
-}
-
 const getExistingTenantUsers = async (emails: string[]): Promise<User[]> => {
   const lcEmails = emails.map(email => email.toLowerCase())
   const params = {
@@ -432,7 +439,7 @@ export const bulkCreate = async (
   for (const user of usersToBulkSave) {
     // TODO: Refactor to bulk insert users into the info db
     // instead of relying on looping tenant creation
-    await addTenant(tenantId, user._id, user.email)
+    await platform.users.addUser(tenantId, user._id, user.email)
     await eventHelpers.handleSaveEvents(user, undefined)
     await apps.syncUserInApps(user._id)
   }
@@ -550,7 +557,7 @@ export const bulkDelete = async (
 
 export const destroy = async (id: string, currentUser: any) => {
   const db = tenancy.getGlobalDB()
-  const dbUser = await db.get(id)
+  const dbUser = (await db.get(id)) as User
   const userId = dbUser._id as string
 
   if (!env.SELF_HOSTED && !env.DISABLE_ACCOUNT_PORTAL) {
@@ -566,7 +573,7 @@ export const destroy = async (id: string, currentUser: any) => {
     }
   }
 
-  await deprovisioning.removeUserFromInfoDB(dbUser)
+  await platform.users.removeUser(dbUser)
 
   await db.remove(userId, dbUser._rev)
 
@@ -579,7 +586,7 @@ export const destroy = async (id: string, currentUser: any) => {
 
 const bulkDeleteProcessing = async (dbUser: User) => {
   const userId = dbUser._id as string
-  await deprovisioning.removeUserFromInfoDB(dbUser)
+  await platform.users.removeUser(dbUser)
   await eventHelpers.handleDeleteEvents(dbUser)
   await cache.user.invalidateUser(userId)
   await sessions.invalidateSessions(userId, { reason: "bulk-deletion" })

package/src/tests/TestConfiguration.ts

@@ -15,39 +15,29 @@ const supertest = require("supertest")
 import { Config } from "../constants"
 import {
   users,
-  tenancy,
+  context,
   sessions,
   auth,
   constants,
   env as coreEnv,
 } from "@budibase/backend-core"
-import structures, { TENANT_ID, TENANT_1, CSRF_TOKEN } from "./structures"
-import { CreateUserResponse, User, AuthToken } from "@budibase/types"
+import structures, { CSRF_TOKEN } from "./structures"
+import { SaveUserResponse, User, AuthToken } from "@budibase/types"
 import API from "./api"
 
-enum Mode {
-  CLOUD = "cloud",
-  SELF = "self",
-}
-
 class TestConfiguration {
   server: any
   request: any
   api: API
-  defaultUser?: User
-  tenant1User?: User
+  tenantId: string
+  user?: User
+  userPassword = "test"
 
-  constructor(
-    opts: { openServer: boolean; mode: Mode } = {
-      openServer: true,
-      mode: Mode.CLOUD,
-    }
-  ) {
-    if (opts.mode === Mode.CLOUD) {
-      this.modeCloud()
-    } else if (opts.mode === Mode.SELF) {
-      this.modeSelf()
-    }
+  constructor(opts: { openServer: boolean } = { openServer: true }) {
+    // default to cloud hosting
+    this.cloudHosted()
+
+    this.tenantId = structures.tenant.id()
 
     if (opts.openServer) {
       env.PORT = "0" // random port
@@ -63,26 +53,19 @@ class TestConfiguration {
     return this.request
   }
 
-  // MODES
-
-  setMultiTenancy = (value: boolean) => {
-    env._set("MULTI_TENANCY", value)
-    coreEnv._set("MULTI_TENANCY", value)
-  }
+  // HOSTING
 
   setSelfHosted = (value: boolean) => {
     env._set("SELF_HOSTED", value)
     coreEnv._set("SELF_HOSTED", value)
   }
 
-  modeCloud = () => {
+  cloudHosted = () => {
     this.setSelfHosted(false)
-    this.setMultiTenancy(true)
   }
 
-  modeSelf = () => {
+  selfHosted = () => {
     this.setSelfHosted(true)
-    this.setMultiTenancy(false)
   }
 
   // UTILS
@@ -103,7 +86,7 @@ class TestConfiguration {
     if (params) {
       request.params = params
     }
-    await tenancy.doInTenant(this.getTenantId(), () => {
+    await context.doInTenant(this.getTenantId(), () => {
       return controlFunc(request)
     })
     return request.body
@@ -112,13 +95,13 @@ class TestConfiguration {
   // SETUP / TEARDOWN
 
   async beforeAll() {
-    await this.createDefaultUser()
-    await this.createSession(this.defaultUser!)
-
-    await tenancy.doInTenant(TENANT_1, async () => {
-      await this.createTenant1User()
-      await this.createSession(this.tenant1User!)
-    })
+    try {
+      await this.createDefaultUser()
+      await this.createSession(this.user!)
+    } catch (e: any) {
+      console.error(e)
+      throw new Error(e.message)
+    }
   }
 
   async afterAll() {
@@ -129,6 +112,12 @@ class TestConfiguration {
 
   // TENANCY
 
+  doInTenant(task: any) {
+    return context.doInTenant(this.tenantId, () => {
+      return task()
+    })
+  }
+
   createTenant = async (): Promise<User> => {
     // create user / new tenant
     const res = await this.api.users.createAdminUser()
@@ -150,9 +139,9 @@ class TestConfiguration {
 
   getTenantId() {
     try {
-      return tenancy.getTenantId()
-    } catch (e: any) {
-      return TENANT_ID
+      return context.getTenantId()
+    } catch (e) {
+      return this.tenantId!
     }
   }
 
@@ -200,14 +189,11 @@ class TestConfiguration {
   }
 
   defaultHeaders() {
-    const tenantId = this.getTenantId()
-    if (tenantId === TENANT_ID) {
-      return this.authHeaders(this.defaultUser!)
-    } else if (tenantId === TENANT_1) {
-      return this.authHeaders(this.tenant1User!)
-    } else {
-      throw new Error("could not determine auth headers to use")
-    }
+    return this.authHeaders(this.user!)
+  }
+
+  tenantIdHeaders() {
+    return { [constants.Header.TENANT_ID]: this.tenantId }
   }
 
   internalAPIHeaders() {
@@ -222,22 +208,15 @@ class TestConfiguration {
 
   async createDefaultUser() {
     const user = structures.users.adminUser({
-      email: "test@test.com",
-      password: "test",
+      password: this.userPassword,
     })
-    this.defaultUser = await this.createUser(user)
-  }
-
-  async createTenant1User() {
-    const user = structures.users.adminUser({
-      email: "tenant1@test.com",
-      password: "test",
+    await context.doInTenant(this.tenantId!, async () => {
+      this.user = await this.createUser(user)
     })
-    this.tenant1User = await this.createUser(user)
   }
 
   async getUser(email: string): Promise<User> {
-    return tenancy.doInTenant(this.getTenantId(), () => {
+    return context.doInTenant(this.getTenantId(), () => {
       return users.getGlobalUserByEmail(email)
     })
   }
@@ -247,7 +226,7 @@ class TestConfiguration {
       user = structures.users.user()
     }
     const response = await this._req(user, null, controllers.users.save)
-    const body = response as CreateUserResponse
+    const body = response as SaveUserResponse
     return this.getUser(body.email)
   }