@budibase/worker 2.4.19 → 2.4.21

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/worker",
   "email": "hi@budibase.com",
-  "version": "2.4.19",
+  "version": "2.4.21",
   "description": "Budibase background service",
   "main": "src/index.ts",
   "repository": {
@@ -36,10 +36,10 @@
   "author": "Budibase",
   "license": "GPL-3.0",
   "dependencies": {
-    "@budibase/backend-core": "^2.4.19",
-    "@budibase/pro": "2.4.18",
-    "@budibase/string-templates": "^2.4.19",
-    "@budibase/types": "^2.4.19",
+    "@budibase/backend-core": "^2.4.21",
+    "@budibase/pro": "2.4.20",
+    "@budibase/string-templates": "^2.4.21",
+    "@budibase/types": "^2.4.21",
     "@koa/router": "8.0.8",
     "@sentry/node": "6.17.7",
     "@techpass/passport-openidconnect": "0.3.2",
@@ -101,5 +101,5 @@
     "typescript": "4.7.3",
     "update-dotenv": "1.1.1"
   },
-  "gitHead": "fa438f99d138fd265394d68a9d1cd164852b96bb"
+  "gitHead": "212c6f1a6d232fd074c11d677ebeb996e4c5c2e6"
 }

package/src/environment.ts

@@ -30,10 +30,8 @@ const environment = {
   // auth
   MINIO_ACCESS_KEY: process.env.MINIO_ACCESS_KEY,
   MINIO_SECRET_KEY: process.env.MINIO_SECRET_KEY,
-  JWT_SECRET: process.env.JWT_SECRET,
   SALT_ROUNDS: process.env.SALT_ROUNDS,
   REDIS_PASSWORD: process.env.REDIS_PASSWORD,
-  INTERNAL_API_KEY: process.env.INTERNAL_API_KEY,
   COOKIE_DOMAIN: process.env.COOKIE_DOMAIN,
   // urls
   MINIO_URL: process.env.MINIO_URL,

package/src/middleware/cloudRestricted.ts

@@ -1,5 +1,5 @@
 import env from "../environment"
-import { constants } from "@budibase/backend-core"
+import { constants, utils } from "@budibase/backend-core"
 import { BBContext } from "@budibase/types"
 
 /**
@@ -9,7 +9,15 @@ import { BBContext } from "@budibase/types"
 export default async (ctx: BBContext, next: any) => {
   if (!env.SELF_HOSTED && !env.DISABLE_ACCOUNT_PORTAL) {
     const apiKey = ctx.request.headers[constants.Header.API_KEY]
-    if (apiKey !== env.INTERNAL_API_KEY) {
+    if (!apiKey) {
+      ctx.throw(403, "Unauthorized")
+    }
+
+    if (Array.isArray(apiKey)) {
+      ctx.throw(403, "Unauthorized")
+    }
+
+    if (!utils.isValidInternalAPIKey(apiKey)) {
       ctx.throw(403, "Unauthorized")
     }
   }

package/src/sdk/auth/auth.ts

@@ -5,10 +5,10 @@ import {
   sessions,
   events,
   HTTPError,
+  env as coreEnv,
 } from "@budibase/backend-core"
 import { PlatformLogoutOpts, User } from "@budibase/types"
 import jwt from "jsonwebtoken"
-import env from "../../environment"
 import * as userSdk from "../users"
 import * as emails from "../../utilities/email"
 import * as redis from "../../utilities/redis"
@@ -26,7 +26,7 @@ export async function loginUser(user: User) {
       sessionId,
       tenantId,
     },
-    env.JWT_SECRET!
+    coreEnv.JWT_SECRET!
   )
   return token
 }

package/src/tests/TestConfiguration.ts

@@ -74,7 +74,6 @@ class TestConfiguration {
     const request: any = {}
     // fake cookies, we don't need them
     request.cookies = { set: () => {}, get: () => {} }
-    request.config = { jwtSecret: env.JWT_SECRET }
     request.user = { tenantId: this.getTenantId() }
     request.query = {}
     request.request = {
@@ -180,7 +179,7 @@ class TestConfiguration {
       sessionId: "sessionid",
       tenantId: user.tenantId,
     }
-    const authCookie = auth.jwt.sign(authToken, env.JWT_SECRET)
+    const authCookie = auth.jwt.sign(authToken, coreEnv.JWT_SECRET)
     return {
       Accept: "application/json",
       ...this.cookieHeader([`${constants.Cookie.Auth}=${authCookie}`]),
@@ -197,7 +196,7 @@ class TestConfiguration {
   }
 
   internalAPIHeaders() {
-    return { [constants.Header.API_KEY]: env.INTERNAL_API_KEY }
+    return { [constants.Header.API_KEY]: coreEnv.INTERNAL_API_KEY }
   }
 
   adminOnlyResponse = () => {
@@ -277,7 +276,7 @@ class TestConfiguration {
   // CONFIGS - OIDC
 
   getOIDConfigCookie(configId: string) {
-    const token = auth.jwt.sign(configId, env.JWT_SECRET)
+    const token = auth.jwt.sign(configId, coreEnv.JWT_SECRET)
     return this.cookieHeader([[`${constants.Cookie.OIDC_CONFIG}=${token}`]])
   }
 

package/src/utilities/appService.ts

@@ -1,5 +1,10 @@
 import fetch from "node-fetch"
-import { constants, tenancy, logging } from "@budibase/backend-core"
+import {
+  constants,
+  tenancy,
+  logging,
+  env as coreEnv,
+} from "@budibase/backend-core"
 import { checkSlashesInUrl } from "../utilities"
 import env from "../environment"
 import { SyncUserRequest, User } from "@budibase/types"
@@ -9,7 +14,7 @@ async function makeAppRequest(url: string, method: string, body: any) {
     return
   }
   const request: any = { headers: {} }
-  request.headers[constants.Header.API_KEY] = env.INTERNAL_API_KEY
+  request.headers[constants.Header.API_KEY] = coreEnv.INTERNAL_API_KEY
   if (tenancy.isTenantIdSet()) {
     request.headers[constants.Header.TENANT_ID] = tenancy.getTenantId()
   }