@budibase/worker 2.3.18-alpha.9 → 2.3.18

package/src/api/controllers/global/users.ts

@@ -1,48 +1,31 @@
 import { checkInviteCode } from "../../../utilities/redis"
-import * as userSdk from "../../../sdk/users"
+import sdk from "../../../sdk"
 import env from "../../../environment"
 import {
-  AcceptUserInviteRequest,
-  AcceptUserInviteResponse,
   BulkUserRequest,
   BulkUserResponse,
   CloudAccount,
   CreateAdminUserRequest,
-  CreateAdminUserResponse,
-  Ctx,
   InviteUserRequest,
   InviteUsersRequest,
-  MigrationType,
-  SaveUserResponse,
   SearchUsersRequest,
   User,
-  UserCtx,
 } from "@budibase/types"
 import {
   accounts,
   cache,
   errors,
   events,
-  migrations,
   tenancy,
-  platform,
 } from "@budibase/backend-core"
 import { checkAnyUserExists } from "../../../utilities/users"
 
 const MAX_USERS_UPLOAD_LIMIT = 1000
 
-export const save = async (ctx: UserCtx<User, SaveUserResponse>) => {
+export const save = async (ctx: any) => {
   try {
     const currentUserId = ctx.user._id
-    const requestUser = ctx.request.body
-
-    const user = await userSdk.save(requestUser, { currentUserId })
-
-    ctx.body = {
-      _id: user._id!,
-      _rev: user._rev!,
-      email: user.email,
-    }
+    ctx.body = await sdk.users.save(ctx.request.body, { currentUserId })
   } catch (err: any) {
     ctx.throw(err.status || 400, err)
   }
@@ -52,7 +35,7 @@ const bulkDelete = async (userIds: string[], currentUserId: string) => {
   if (userIds?.indexOf(currentUserId) !== -1) {
     throw new Error("Unable to delete self.")
   }
-  return await userSdk.bulkDelete(userIds)
+  return await sdk.users.bulkDelete(userIds)
 }
 
 const bulkCreate = async (users: User[], groupIds: string[]) => {
@@ -61,7 +44,7 @@ const bulkCreate = async (users: User[], groupIds: string[]) => {
       "Max limit for upload is 1000 users. Please reduce file size and try again."
     )
   }
-  return await userSdk.bulkCreate(users, groupIds)
+  return await sdk.users.bulkCreate(users, groupIds)
 }
 
 export const bulkUpdate = async (ctx: any) => {
@@ -85,30 +68,19 @@ const parseBooleanParam = (param: any) => {
   return !(param && param === "false")
 }
 
-export const adminUser = async (
-  ctx: Ctx<CreateAdminUserRequest, CreateAdminUserResponse>
-) => {
-  const { email, password, tenantId } = ctx.request.body
-
-  if (await platform.tenants.exists(tenantId)) {
-    ctx.throw(403, "Organisation already exists.")
-  }
-
-  if (env.MULTI_TENANCY) {
-    // store the new tenant record in the platform db
-    await platform.tenants.addTenant(tenantId)
-    await migrations.backPopulateMigrations({
-      type: MigrationType.GLOBAL,
-      tenantId,
-    })
-  }
-
+export const adminUser = async (ctx: any) => {
+  const { email, password, tenantId } = ctx.request
+    .body as CreateAdminUserRequest
   await tenancy.doInTenant(tenantId, async () => {
     // account portal sends a pre-hashed password - honour param to prevent double hashing
     const hashPassword = parseBooleanParam(ctx.request.query.hashPassword)
     // account portal sends no password for SSO users
     const requirePassword = parseBooleanParam(ctx.request.query.requirePassword)
 
+    if (await tenancy.doesTenantExist(tenantId)) {
+      ctx.throw(403, "Organisation already exists.")
+    }
+
     const userExists = await checkAnyUserExists()
     if (userExists) {
       ctx.throw(
@@ -134,7 +106,7 @@ export const adminUser = async (
       // always bust checklist beforehand, if an error occurs but can proceed, don't get
       // stuck in a cycle
       await cache.bustCache(cache.CacheKey.CHECKLIST)
-      const finalUser = await userSdk.save(user, {
+      const finalUser = await sdk.users.save(user, {
         hashPassword,
         requirePassword,
       })
@@ -146,11 +118,7 @@ export const adminUser = async (
       }
       await events.identification.identifyTenantGroup(tenantId, account)
 
-      ctx.body = {
-        _id: finalUser._id!,
-        _rev: finalUser._rev!,
-        email: finalUser.email,
-      }
+      ctx.body = finalUser
     } catch (err: any) {
       ctx.throw(err.status || 400, err)
     }
@@ -160,7 +128,7 @@ export const adminUser = async (
 export const countByApp = async (ctx: any) => {
   const appId = ctx.params.appId
   try {
-    ctx.body = await userSdk.countUsersByApp(appId)
+    ctx.body = await sdk.users.countUsersByApp(appId)
   } catch (err: any) {
     ctx.throw(err.status || 400, err)
   }
@@ -172,7 +140,7 @@ export const destroy = async (ctx: any) => {
     ctx.throw(400, "Unable to delete self.")
   }
 
-  await userSdk.destroy(id, ctx.user)
+  await sdk.users.destroy(id, ctx.user)
 
   ctx.body = {
     message: `User ${id} deleted.`,
@@ -181,7 +149,7 @@ export const destroy = async (ctx: any) => {
 
 export const search = async (ctx: any) => {
   const body = ctx.request.body as SearchUsersRequest
-  const paginated = await userSdk.paginatedUsers(body)
+  const paginated = await sdk.users.paginatedUsers(body)
   // user hashed password shouldn't ever be returned
   for (let user of paginated.data) {
     if (user) {
@@ -193,7 +161,7 @@ export const search = async (ctx: any) => {
 
 // called internally by app server user fetch
 export const fetch = async (ctx: any) => {
-  const all = await userSdk.allUsers()
+  const all = await sdk.users.allUsers()
   // user hashed password shouldn't ever be returned
   for (let user of all) {
     if (user) {
@@ -205,12 +173,12 @@ export const fetch = async (ctx: any) => {
 
 // called internally by app server user find
 export const find = async (ctx: any) => {
-  ctx.body = await userSdk.getUser(ctx.params.id)
+  ctx.body = await sdk.users.getUser(ctx.params.id)
 }
 
 export const tenantUserLookup = async (ctx: any) => {
   const id = ctx.params.id
-  const user = await userSdk.getPlatformUser(id)
+  const user = await sdk.users.getPlatformUser(id)
   if (user) {
     ctx.body = user
   } else {
@@ -220,7 +188,7 @@ export const tenantUserLookup = async (ctx: any) => {
 
 export const invite = async (ctx: any) => {
   const request = ctx.request.body as InviteUserRequest
-  const response = await userSdk.invite([request])
+  const response = await sdk.users.invite([request])
 
   // explicitly throw for single user invite
   if (response.unsuccessful.length) {
@@ -239,7 +207,7 @@ export const invite = async (ctx: any) => {
 
 export const inviteMultiple = async (ctx: any) => {
   const request = ctx.request.body as InviteUsersRequest
-  ctx.body = await userSdk.invite(request)
+  ctx.body = await sdk.users.invite(request)
 }
 
 export const checkInvite = async (ctx: any) => {
@@ -255,15 +223,13 @@ export const checkInvite = async (ctx: any) => {
   }
 }
 
-export const inviteAccept = async (
-  ctx: Ctx<AcceptUserInviteRequest, AcceptUserInviteResponse>
-) => {
+export const inviteAccept = async (ctx: any) => {
   const { inviteCode, password, firstName, lastName } = ctx.request.body
   try {
     // info is an extension of the user object that was stored by global
     const { email, info }: any = await checkInviteCode(inviteCode)
-    const user = await tenancy.doInTenant(info.tenantId, async () => {
-      const saved = await userSdk.save({
+    ctx.body = await tenancy.doInTenant(info.tenantId, async () => {
+      const saved = await sdk.users.save({
         firstName,
         lastName,
         password,
@@ -275,12 +241,6 @@ export const inviteAccept = async (
       await events.user.inviteAccepted(user)
       return saved
     })
-
-    ctx.body = {
-      _id: user._id,
-      _rev: user._rev,
-      email: user.email,
-    }
   } catch (err: any) {
     if (err.code === errors.codes.USAGE_LIMIT_EXCEEDED) {
       // explicitly re-throw limit exceeded errors

package/src/api/controllers/system/accounts.ts

@@ -1,23 +1,21 @@
 import { Account, AccountMetadata } from "@budibase/types"
-import * as accounts from "../../../sdk/accounts"
+import sdk from "../../../sdk"
 
 export const save = async (ctx: any) => {
   const account = ctx.request.body as Account
   let metadata: AccountMetadata = {
-    _id: accounts.metadata.formatAccountMetadataId(account.accountId),
+    _id: sdk.accounts.formatAccountMetadataId(account.accountId),
     email: account.email,
   }
 
-  metadata = await accounts.metadata.saveMetadata(metadata)
+  metadata = await sdk.accounts.saveMetadata(metadata)
 
   ctx.body = metadata
   ctx.status = 200
 }
 
 export const destroy = async (ctx: any) => {
-  const accountId = accounts.metadata.formatAccountMetadataId(
-    ctx.params.accountId
-  )
-  await accounts.metadata.destroyMetadata(accountId)
+  const accountId = sdk.accounts.formatAccountMetadataId(ctx.params.accountId)
+  await sdk.accounts.destroyMetadata(accountId)
   ctx.status = 204
 }

package/src/api/controllers/system/tenants.ts

@@ -1,7 +1,8 @@
-import { UserCtx } from "@budibase/types"
-import * as tenantSdk from "../../../sdk/tenants"
+import { BBContext } from "@budibase/types"
+import { deprovisioning } from "@budibase/backend-core"
+import { quotas } from "@budibase/pro"
 
-export async function destroy(ctx: UserCtx) {
+const _delete = async (ctx: BBContext) => {
   const user = ctx.user!
   const tenantId = ctx.params.tenantId
 
@@ -10,10 +11,13 @@ export async function destroy(ctx: UserCtx) {
   }
 
   try {
-    await tenantSdk.deleteTenant(tenantId)
+    await quotas.bustCache()
+    await deprovisioning.deleteTenant(tenantId)
     ctx.status = 204
   } catch (err) {
     ctx.log.error(err)
     throw err
   }
 }
+
+export { _delete as delete }

package/src/api/index.ts

@@ -3,7 +3,8 @@ const compress = require("koa-compress")
 const zlib = require("zlib")
 import { routes } from "./routes"
 import { middleware as pro } from "@budibase/pro"
-import { auth, middleware } from "@budibase/backend-core"
+import { errors, auth, middleware } from "@budibase/backend-core"
+import { APIError } from "@budibase/types"
 
 const PUBLIC_ENDPOINTS = [
   // deprecated single tenant sso callback
@@ -108,9 +109,7 @@ const NO_TENANCY_ENDPOINTS = [
 const NO_CSRF_ENDPOINTS = [...PUBLIC_ENDPOINTS]
 
 const router: Router = new Router()
-
 router
-  .use(middleware.errorHandling)
   .use(
     compress({
       threshold: 2048,
@@ -137,12 +136,29 @@ router
       (!ctx.isAuthenticated || (ctx.user && !ctx.user.budibaseAccess)) &&
       !ctx.internal
     ) {
-      ctx.throw(403, "Unauthorized")
+      ctx.throw(403, "Unauthorized - no public worker access")
     }
     return next()
   })
   .use(middleware.auditLog)
 
+// error handling middleware - TODO: This could be moved to backend-core
+router.use(async (ctx, next) => {
+  try {
+    await next()
+  } catch (err: any) {
+    ctx.log.error(err)
+    ctx.status = err.status || err.statusCode || 500
+    const error = errors.getPublicError(err)
+    const body: APIError = {
+      message: err.message,
+      status: ctx.status,
+      error,
+    }
+    ctx.body = body
+  }
+})
+
 router.get("/health", ctx => (ctx.status = 200))
 
 // authenticated routes

package/src/api/routes/global/auth.ts

@@ -33,7 +33,7 @@ router
   .post(
     "/api/global/auth/:tenantId/login",
     buildAuthValidation(),
-    authController.login
+    authController.authenticate
   )
   .post("/api/global/auth/logout", authController.logout)
   .post(
@@ -68,24 +68,21 @@ router
 
   // GOOGLE - MULTI TENANT
   .get("/api/global/auth/:tenantId/google", authController.googlePreAuth)
-  .get(
-    "/api/global/auth/:tenantId/google/callback",
-    authController.googleCallback
-  )
+  .get("/api/global/auth/:tenantId/google/callback", authController.googleAuth)
 
   // GOOGLE - SINGLE TENANT - DEPRECATED
-  .get("/api/global/auth/google/callback", authController.googleCallback)
-  .get("/api/admin/auth/google/callback", authController.googleCallback)
+  .get("/api/global/auth/google/callback", authController.googleAuth)
+  .get("/api/admin/auth/google/callback", authController.googleAuth)
 
   // OIDC - MULTI TENANT
   .get(
     "/api/global/auth/:tenantId/oidc/configs/:configId",
     authController.oidcPreAuth
   )
-  .get("/api/global/auth/:tenantId/oidc/callback", authController.oidcCallback)
+  .get("/api/global/auth/:tenantId/oidc/callback", authController.oidcAuth)
 
   // OIDC - SINGLE TENANT - DEPRECATED
-  .get("/api/global/auth/oidc/callback", authController.oidcCallback)
-  .get("/api/admin/auth/oidc/callback", authController.oidcCallback)
+  .get("/api/global/auth/oidc/callback", authController.oidcAuth)
+  .get("/api/admin/auth/oidc/callback", authController.oidcAuth)
 
 export default router

package/src/api/routes/global/tests/auth.spec.ts

@@ -1,27 +1,12 @@
-import { CloudAccount, SSOUser, User } from "@budibase/types"
-
 jest.mock("nodemailer")
-import {
-  TestConfiguration,
-  mocks,
-  structures,
-  generator,
-} from "../../../../tests"
+import { TestConfiguration, mocks } from "../../../../tests"
 const sendMailMock = mocks.email.mock()
-import { events, constants } from "@budibase/backend-core"
-import { Response } from "superagent"
-
-import * as userSdk from "../../../../sdk/users"
-
-function getAuthCookie(response: Response) {
-  return response.headers["set-cookie"]
-    .find((s: string) => s.startsWith(`${constants.Cookie.Auth}=`))
-    .split("=")[1]
-    .split(";")[0]
-}
+import { events } from "@budibase/backend-core"
 
-const expectSetAuthCookie = (response: Response) => {
-  expect(getAuthCookie(response).length > 1).toBe(true)
+const expectSetAuthCookie = (res: any) => {
+  expect(
+    res.get("Set-Cookie").find((c: string) => c.startsWith("budibase:auth"))
+  ).toBeDefined()
 }
 
 describe("/api/global/auth", () => {
@@ -39,247 +24,53 @@ describe("/api/global/auth", () => {
     jest.clearAllMocks()
   })
 
-  async function createSSOUser() {
-    return config.doInTenant(async () => {
-      return userSdk.save(structures.users.ssoUser(), {
-        requirePassword: false,
-      })
-    })
-  }
-
   describe("password", () => {
     describe("POST /api/global/auth/:tenantId/login", () => {
-      it("logs in with correct credentials", async () => {
-        const tenantId = config.tenantId!
-        const email = config.user?.email!
-        const password = config.userPassword
-
-        const response = await config.api.auth.login(tenantId, email, password)
-
-        expectSetAuthCookie(response)
-        expect(events.auth.login).toBeCalledTimes(1)
-      })
-
-      it("should return 403 with incorrect credentials", async () => {
-        const tenantId = config.tenantId!
-        const email = config.user?.email!
-        const password = "incorrect"
-
-        const response = await config.api.auth.login(
-          tenantId,
-          email,
-          password,
-          { status: 403 }
-        )
-        expect(response.body).toEqual({
-          message: "Invalid credentials",
-          status: 403,
-        })
-      })
-
-      it("should return 403 when user doesn't exist", async () => {
-        const tenantId = config.tenantId!
-        const email = "invaliduser@test.com"
-        const password = "password"
-
-        const response = await config.api.auth.login(
-          tenantId,
-          email,
-          password,
-          { status: 403 }
-        )
-        expect(response.body).toEqual({
-          message: "Invalid credentials",
-          status: 403,
-        })
-      })
-
-      describe("sso user", () => {
-        let user: User
-
-        async function testSSOUser() {
-          const tenantId = user.tenantId!
-          const email = user.email
-          const password = "test"
-
-          const response = await config.api.auth.login(
-            tenantId,
-            email,
-            password,
-            { status: 400 }
-          )
-
-          expect(response.body).toEqual({
-            message: "SSO user cannot login using password",
-            status: 400,
-          })
-        }
-
-        describe("budibase sso user", () => {
-          it("should prevent user from logging in", async () => {
-            user = await createSSOUser()
-            await testSSOUser()
-          })
-        })
-
-        describe("root account sso user", () => {
-          it("should prevent user from logging in", async () => {
-            user = await config.createUser()
-            const account = structures.accounts.ssoAccount() as CloudAccount
-            mocks.accounts.getAccount.mockReturnValueOnce(
-              Promise.resolve(account)
-            )
-
-            await testSSOUser()
-          })
-        })
-      })
+      it("should login", () => {})
     })
 
     describe("POST /api/global/auth/logout", () => {
       it("should logout", async () => {
-        const response = await config.api.auth.logout()
+        await config.api.auth.logout()
         expect(events.auth.logout).toBeCalledTimes(1)
 
-        const authCookie = getAuthCookie(response)
-        expect(authCookie).toBe("")
+        // TODO: Verify sessions deleted
       })
     })
 
     describe("POST /api/global/auth/:tenantId/reset", () => {
       it("should generate password reset email", async () => {
-        const user = await config.createUser()
-
         const { res, code } = await config.api.auth.requestPasswordReset(
-          sendMailMock,
-          user.email
+          sendMailMock
         )
+        const user = await config.getUser("test@test.com")
 
         expect(res.body).toEqual({
           message: "Please check your email for a reset link.",
         })
         expect(sendMailMock).toHaveBeenCalled()
+
         expect(code).toBeDefined()
         expect(events.user.passwordResetRequested).toBeCalledTimes(1)
         expect(events.user.passwordResetRequested).toBeCalledWith(user)
       })
-
-      describe("sso user", () => {
-        let user: User
-
-        async function testSSOUser() {
-          const { res } = await config.api.auth.requestPasswordReset(
-            sendMailMock,
-            user.email,
-            { status: 400 }
-          )
-
-          expect(res.body).toEqual({
-            message: "SSO user cannot reset password",
-            status: 400,
-            error: {
-              code: "http",
-              type: "generic",
-            },
-          })
-          expect(sendMailMock).not.toHaveBeenCalled()
-        }
-
-        describe("budibase sso user", () => {
-          it("should prevent user from generating password reset email", async () => {
-            user = await createSSOUser()
-            await testSSOUser()
-          })
-        })
-
-        describe("root account sso user", () => {
-          it("should prevent user from generating password reset email", async () => {
-            user = await config.createUser(structures.users.user())
-            const account = structures.accounts.ssoAccount() as CloudAccount
-            mocks.accounts.getAccount.mockReturnValueOnce(
-              Promise.resolve(account)
-            )
-
-            await testSSOUser()
-          })
-        })
-      })
     })
 
     describe("POST /api/global/auth/:tenantId/reset/update", () => {
       it("should reset password", async () => {
-        let user = await config.createUser()
         const { code } = await config.api.auth.requestPasswordReset(
-          sendMailMock,
-          user.email
+          sendMailMock
         )
+        const user = await config.getUser("test@test.com")
         delete user.password
 
-        const newPassword = "newpassword"
-        const res = await config.api.auth.updatePassword(code!, newPassword)
-
-        user = await config.getUser(user.email)
-        delete user.password
+        const res = await config.api.auth.updatePassword(code)
 
         expect(res.body).toEqual({ message: "password reset successfully." })
         expect(events.user.passwordReset).toBeCalledTimes(1)
         expect(events.user.passwordReset).toBeCalledWith(user)
 
-        // login using new password
-        await config.api.auth.login(user.tenantId, user.email, newPassword)
-      })
-
-      describe("sso user", () => {
-        let user: User | SSOUser
-
-        async function testSSOUser(code: string) {
-          const res = await config.api.auth.updatePassword(
-            code!,
-            generator.string(),
-            { status: 400 }
-          )
-
-          expect(res.body).toEqual({
-            message: "Cannot reset password.",
-            status: 400,
-          })
-        }
-
-        describe("budibase sso user", () => {
-          it("should prevent user from generating password reset email", async () => {
-            user = await config.createUser()
-            const { code } = await config.api.auth.requestPasswordReset(
-              sendMailMock,
-              user.email
-            )
-
-            // convert to sso now that password reset has been requested
-            const ssoUser = user as SSOUser
-            ssoUser.providerType = structures.sso.providerType()
-            delete ssoUser.password
-            await config.doInTenant(() => userSdk.save(ssoUser))
-
-            await testSSOUser(code!)
-          })
-        })
-
-        describe("root account sso user", () => {
-          it("should prevent user from generating password reset email", async () => {
-            user = await config.createUser()
-            const { code } = await config.api.auth.requestPasswordReset(
-              sendMailMock,
-              user.email
-            )
-
-            // convert to account owner now that password has been requested
-            const account = structures.accounts.ssoAccount() as CloudAccount
-            mocks.accounts.getAccount.mockReturnValueOnce(
-              Promise.resolve(account)
-            )
-
-            await testSSOUser(code!)
-          })
-        })
+        // TODO: Login using new password
       })
     })
   })
@@ -354,7 +145,7 @@ describe("/api/global/auth", () => {
         const location: string = res.get("location")
         expect(
           location.startsWith(
-            `http://localhost/auth?response_type=code&client_id=clientId&redirect_uri=http%3A%2F%2Flocalhost%3A10000%2Fapi%2Fglobal%2Fauth%2F${config.tenantId}%2Foidc%2Fcallback&scope=openid%20profile%20email%20offline_access`
+            "http://localhost/auth?response_type=code&client_id=clientId&redirect_uri=http%3A%2F%2Flocalhost%3A10000%2Fapi%2Fglobal%2Fauth%2Fdefault%2Foidc%2Fcallback&scope=openid%20profile%20email%20offline_access"
           )
         ).toBe(true)
       })