@budibase/worker 3.18.14 → 3.19.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/worker",
   "email": "hi@budibase.com",
-  "version": "3.18.14",
+  "version": "3.19.0",
   "description": "Budibase background service",
   "main": "src/index.ts",
   "repository": {
@@ -109,5 +109,5 @@
       }
     }
   },
-  "gitHead": "da28258ca1bcc8260d29f82069545761429eeea7"
+  "gitHead": "72863c719173848d3128cbef9556a0af09708c20"
 }

package/src/api/controllers/global/users.ts

@@ -1,5 +1,17 @@
-import * as userSdk from "../../../sdk/users"
-import env from "../../../environment"
+import {
+  utils as backendCoreUtils,
+  cache,
+  context,
+  db,
+  events,
+  HTTPError,
+  locks,
+  platform,
+  tenancy,
+  users,
+} from "@budibase/backend-core"
+import { features } from "@budibase/pro"
+import { BpmStatusKey, BpmStatusValue, utils } from "@budibase/shared-core"
 import {
   AcceptUserInviteRequest,
   AcceptUserInviteResponse,
@@ -17,6 +29,7 @@ import {
   DeleteInviteUsersRequest,
   DeleteInviteUsersResponse,
   DeleteUserResponse,
+  EditUserPermissionsResponse,
   ErrorCode,
   FetchUsersResponse,
   FindUserResponse,
@@ -36,27 +49,17 @@ import {
   SearchUsersResponse,
   StrippedUser,
   UnsavedUser,
-  UpdateInviteRequest,
   UpdateInviteResponse,
   User,
   UserCtx,
   UserIdentifier,
 } from "@budibase/types"
-import {
-  users,
-  cache,
-  events,
-  platform,
-  tenancy,
-  db,
-  locks,
-  context,
-} from "@budibase/backend-core"
-import { checkAnyUserExists } from "../../../utilities/users"
-import { isEmailConfigured } from "../../../utilities/email"
-import { BpmStatusKey, BpmStatusValue, utils } from "@budibase/shared-core"
-import emailValidator from "email-validator"
 import crypto from "crypto"
+import emailValidator from "email-validator"
+import env from "../../../environment"
+import * as userSdk from "../../../sdk/users"
+import { isEmailConfigured } from "../../../utilities/email"
+import { checkAnyUserExists } from "../../../utilities/users"
 
 const MAX_USERS_UPLOAD_LIMIT = 1000
 
@@ -505,45 +508,50 @@ export const getUserInvites = async (
   }
 }
 
-export const updateInvite = async (
-  ctx: UserCtx<UpdateInviteRequest, UpdateInviteResponse>
+export const addWorkspaceIdToInvite = async (
+  ctx: UserCtx<void, UpdateInviteResponse, { code: string; role: string }>
 ) => {
-  const { code } = ctx.params
-  let updateBody = { ...ctx.request.body }
+  const { code, role } = ctx.params
 
-  delete updateBody.email
+  const workspaceId = await backendCoreUtils.getAppIdFromCtx(ctx)
+  if (!workspaceId) {
+    ctx.throw(400, "Workspace id not set")
+  }
+  const prodWorkspaceId = db.getProdWorkspaceID(workspaceId)
 
-  let invite
   try {
-    invite = await cache.invite.getCode(code)
+    const invite = await cache.invite.getCode(code)
+    invite.info.apps ??= {}
+    invite.info.apps[prodWorkspaceId] = role
+
+    await cache.invite.updateCode(code, invite)
+    ctx.body = { ...invite }
   } catch (e) {
-    ctx.throw(400, "There was a problem with the invite")
+    ctx.throw(400, "Invitation is not valid or has expired.")
   }
+}
 
-  let updated = {
-    ...invite,
-  }
+export const removeWorkspaceIdFromInvite = async (
+  ctx: UserCtx<void, UpdateInviteResponse, { code: string }>
+) => {
+  const { code } = ctx.params
 
-  if (!updateBody?.builder?.apps && updated.info?.builder?.apps) {
-    updated.info.builder.apps = []
-  } else if (updateBody?.builder) {
-    updated.info.builder = updateBody.builder
+  const workspaceId = await backendCoreUtils.getAppIdFromCtx(ctx)
+  if (!workspaceId) {
+    ctx.throw(400, "Workspace id not set")
   }
+  const prodWorkspaceId = db.getProdWorkspaceID(workspaceId)
 
-  if (!updateBody?.apps || !Object.keys(updateBody?.apps).length) {
-    updated.info.apps = []
-  } else {
-    updated.info = {
-      ...invite.info,
-      apps: {
-        ...invite.info.apps,
-        ...updateBody.apps,
-      },
-    }
-  }
+  try {
+    const invite = await cache.invite.getCode(code)
+    invite.info.apps ??= {}
+    delete invite.info.apps[prodWorkspaceId]
 
-  await cache.invite.updateCode(code, updated)
-  ctx.body = { ...invite }
+    await cache.invite.updateCode(code, invite)
+    ctx.body = { ...invite }
+  } catch (e) {
+    ctx.throw(400, "Invitation is not valid or has expired.")
+  }
 }
 
 export const inviteAccept = async (
@@ -614,3 +622,73 @@ export const inviteAccept = async (
     ctx.throw(400, err || "Unable to create new user, invitation invalid.")
   }
 }
+
+export const addUserToWorkspace = async (
+  ctx: UserCtx<
+    EditUserPermissionsResponse,
+    SaveUserResponse,
+    { userId: string; role: string }
+  >
+) => handleUserWorkspacePermission(ctx, ctx.params.userId, ctx.params.role)
+
+export const removeUserFromWorkspace = async (
+  ctx: UserCtx<
+    EditUserPermissionsResponse,
+    SaveUserResponse,
+    { userId: string }
+  >
+) => handleUserWorkspacePermission(ctx, ctx.params.userId, undefined)
+
+async function handleUserWorkspacePermission(
+  ctx: UserCtx<EditUserPermissionsResponse, SaveUserResponse>,
+  userId: string,
+  role: string | undefined
+) {
+  const { _rev } = ctx.request.body
+  if (!_rev) {
+    ctx.throw(400, "rev is required")
+  }
+
+  const currentUserId = ctx.user?._id
+
+  const workspaceId = await backendCoreUtils.getAppIdFromCtx(ctx)
+  if (!workspaceId) {
+    ctx.throw(400, "Workspace id not set")
+  }
+  const prodWorkspaceId = db.getProdWorkspaceID(workspaceId)
+
+  const existingUser = await users.getById(userId)
+  existingUser._rev = ctx.request.body._rev
+  if (role) {
+    existingUser.roles[prodWorkspaceId] = role
+  } else {
+    delete existingUser.roles[prodWorkspaceId]
+  }
+
+  if (role === "CREATOR" && !(await features.isAppBuildersEnabled())) {
+    throw new HTTPError("Feature not enabled, please check license", 400)
+  }
+
+  const appCreator = Object.entries(existingUser.roles)
+    .filter(([_appId, role]) => role === "CREATOR")
+    .map(([appId]) => appId)
+  if (!appCreator.length && existingUser.builder) {
+    delete existingUser.builder.creator
+    delete existingUser.builder.apps
+  } else if (appCreator.length) {
+    existingUser.builder ??= {}
+    existingUser.builder.creator = true
+    existingUser.builder.apps = appCreator
+  }
+
+  const user = await userSdk.db.save(existingUser, {
+    currentUserId,
+    hashPassword: false,
+  })
+
+  ctx.body = {
+    _id: user._id!,
+    _rev: user._rev!,
+    email: user.email,
+  }
+}

package/src/api/routes/global/tests/groups.spec.ts

@@ -1,7 +1,7 @@
 import { events } from "@budibase/backend-core"
 import { generator } from "@budibase/backend-core/tests"
-import { structures, TestConfiguration, mocks } from "../../../../tests"
 import { User, UserGroup } from "@budibase/types"
+import { mocks, structures, TestConfiguration } from "../../../../tests"
 
 mocks.licenses.useGroups()
 
@@ -446,4 +446,92 @@ describe("/api/global/groups", () => {
       })
     })
   })
+
+  describe("creator role functionality", () => {
+    let group: UserGroup
+
+    beforeEach(async () => {
+      mocks.licenses.useAppBuilders()
+      const groupResponse = await config.api.groups.saveGroup(
+        structures.groups.UserGroup()
+      )
+      group = groupResponse.body
+    })
+
+    describe("updateGroupApps with CREATOR role", () => {
+      it("should successfully update group with CREATOR role", async () => {
+        const appId = "app_test123"
+
+        // This should succeed without throwing an error
+        await config.api.groups.updateGroupApps(group._id!, {
+          add: [{ appId, roleId: "CREATOR" }],
+          remove: [],
+        })
+
+        const updatedGroup = await config.api.groups.find(group._id!)
+        expect(updatedGroup.body._id).toBe(group._id)
+        expect(updatedGroup.body.builder.apps).toEqual([appId])
+      })
+
+      it("should fail to assign CREATOR role when feature is not enabled", async () => {
+        mocks.licenses.useCloudFree() // Disable app builders feature
+        const appId = "app_test123"
+
+        await config.api.groups.updateGroupApps(
+          group._id!,
+          {
+            add: [{ appId, roleId: "CREATOR" }],
+            remove: [],
+          },
+          { expect: 400 }
+        )
+      })
+
+      it("should handle multiple CREATOR apps update operation", async () => {
+        const appId1 = "app_test111"
+        const appId2 = "app_test222"
+        const appId3 = "app_test333"
+
+        // This should succeed without throwing an error
+        await config.api.groups.updateGroupApps(group._id!, {
+          add: [
+            { appId: appId1, roleId: "CREATOR" },
+            { appId: appId2, roleId: "CREATOR" },
+            { appId: appId3, roleId: "BASIC" }, // Not a creator role
+          ],
+          remove: [],
+        })
+
+        // Verify the operation completed successfully
+        const updatedGroup = await config.api.groups.find(group._id!)
+        expect(updatedGroup.body._id).toBe(group._id)
+        expect(updatedGroup.body.builder.apps).toEqual([appId1, appId2])
+      })
+
+      it("should handle removing apps from CREATOR group", async () => {
+        const appId1 = "app_test111"
+        const appId2 = "app_test222"
+
+        // First add CREATOR roles
+        await config.api.groups.updateGroupApps(group._id!, {
+          add: [
+            { appId: appId1, roleId: "CREATOR" },
+            { appId: appId2, roleId: "CREATOR" },
+          ],
+          remove: [],
+        })
+
+        // Then remove one app - this should succeed
+        await config.api.groups.updateGroupApps(group._id!, {
+          add: [],
+          remove: [{ appId: appId1 }],
+        })
+
+        // Verify the operation completed successfully
+        const updatedGroup = await config.api.groups.find(group._id!)
+        expect(updatedGroup.body._id).toBe(group._id)
+        expect(updatedGroup.body.builder.apps).toEqual([])
+      })
+    })
+  })
 })

package/src/api/routes/global/tests/users.spec.ts

@@ -1,6 +1,7 @@
 import { InviteUsersResponse, OIDCUser, User } from "@budibase/types"
 
 import { accounts as _accounts, events, tenancy } from "@budibase/backend-core"
+import { mocks as featureMocks } from "@budibase/backend-core/tests"
 import * as userSdk from "../../../../sdk/users"
 import { TestConfiguration, mocks, structures } from "../../../../tests"
 
@@ -20,8 +21,11 @@ describe("/api/global/users", () => {
     await config.afterAll()
   })
 
-  beforeEach(() => {
+  beforeEach(async () => {
     jest.clearAllMocks()
+    featureMocks.licenses.useCloudFree()
+    await mocks.licenses.setUsersQuota(1000)
+    await mocks.licenses.setCreatorsQuota(1000)
   })
 
   async function createBuilderUser() {
@@ -114,6 +118,222 @@ describe("/api/global/users", () => {
     })
   })
 
+  describe("POST /api/global/users/invite/:code/:role", () => {
+    it("should be able to add workspace id to invite", async () => {
+      const email = structures.users.newEmail()
+      const { code } = await config.api.users.sendUserInvite(
+        sendMailMock,
+        email
+      )
+      const appId = "app_123456789"
+      const role = "BASIC"
+
+      const res = await config.withApp(appId, () =>
+        config.api.users.addWorkspaceIdToInvite(code, role)
+      )
+
+      expect(res.body.info.apps).toBeDefined()
+      expect(res.body.info.apps[appId]).toBe(role)
+    })
+
+    it("should handle invalid invite code", async () => {
+      const appId = "app_123456789"
+      const role = "BASIC"
+
+      await config.withApp(appId, () =>
+        config.api.users.addWorkspaceIdToInvite("invalid_code", role, 400)
+      )
+    })
+
+    it("should not allow builders to edit invites for apps they don't have access to", async () => {
+      const { code } = await config.api.users.sendUserInvite(
+        sendMailMock,
+        structures.users.newEmail()
+      )
+
+      // Create a builder user with access to another app
+      const builderUser = await config.createUser({
+        ...structures.users.user(),
+        builder: {
+          global: false,
+          apps: ["app_allowed_123"],
+        },
+        admin: { global: false },
+      })
+
+      await config.withUser(builderUser, () =>
+        config.withApp("app_no_access", () =>
+          config.api.users.addWorkspaceIdToInvite(code, "BASIC", 403)
+        )
+      )
+    })
+
+    it("should allow builders to edit invites for apps they have access to", async () => {
+      const { code } = await config.api.users.sendUserInvite(
+        sendMailMock,
+        structures.users.newEmail()
+      )
+      const appId = "app_allowed_123"
+      const role = "BASIC"
+
+      // Create a builder user with access to the specific app
+      const builderUser = await config.createUser({
+        ...structures.users.user(),
+        builder: {
+          global: false,
+          apps: [appId], // Has access to this specific app
+        },
+        admin: { global: false },
+      })
+
+      await config.login(builderUser)
+      const res = await config.withUser(builderUser, () =>
+        config.withApp(appId, () =>
+          config.api.users.addWorkspaceIdToInvite(code, role, 200)
+        )
+      )
+      expect(res.body.info.apps[appId]).toBe(role)
+    })
+
+    it("should allow global builders to edit invites for any app", async () => {
+      const { code } = await config.api.users.sendUserInvite(
+        sendMailMock,
+        structures.users.newEmail()
+      )
+      const appId = "app_any_123"
+      const role = "BASIC"
+
+      // Create a global builder user
+      const builderUser = await config.createUser({
+        ...structures.users.user(),
+        builder: {
+          global: true,
+        },
+        admin: { global: false },
+      })
+
+      await config.login(builderUser)
+      const res = await config.withUser(builderUser, async () =>
+        config.withApp(appId, () =>
+          config.api.users.addWorkspaceIdToInvite(code, role, 200)
+        )
+      )
+      expect(res.body.info.apps[appId]).toBe(role)
+    })
+  })
+
+  describe("DELETE /api/global/users/invite/:code", () => {
+    it("should be able to remove workspace id from invite", async () => {
+      const email = structures.users.newEmail()
+      const { code } = await config.api.users.sendUserInvite(
+        sendMailMock,
+        email
+      )
+      const appId = "app_123456789"
+      const role = "BASIC"
+
+      // First add the workspace
+      await config.withApp(appId, () =>
+        config.api.users.addWorkspaceIdToInvite(code, role)
+      )
+
+      // Then remove it
+      const res = await config.withApp(appId, () =>
+        config.api.users.removeWorkspaceIdFromInvite(code)
+      )
+
+      expect(res.body.info.apps).toBeDefined()
+      expect(res.body.info.apps[appId]).toBeUndefined()
+    })
+
+    it("should handle removing non-existent workspace id", async () => {
+      const email = structures.users.newEmail()
+      const { code } = await config.api.users.sendUserInvite(
+        sendMailMock,
+        email
+      )
+      const appId = "app_nonexistent"
+
+      const res = await config.withApp(appId, () =>
+        config.api.users.removeWorkspaceIdFromInvite(code)
+      )
+
+      expect(res.body.info.apps).toBeDefined()
+      expect(res.body.info.apps[appId]).toBeUndefined()
+    })
+
+    it("should handle invalid invite code", async () => {
+      const appId = "app_123456789"
+
+      await config.withApp(appId, () =>
+        config.api.users.removeWorkspaceIdFromInvite("invalid_code", 400)
+      )
+    })
+
+    it("should not allow builders to delete invites for apps they don't have access to", async () => {
+      const { code } = await config.api.users.sendUserInvite(
+        sendMailMock,
+        structures.users.newEmail()
+      )
+      const appId = "app_no_access"
+      const role = "BASIC"
+
+      // First add the workspace as admin
+      await config.withApp(appId, () =>
+        config.api.users.addWorkspaceIdToInvite(code, role)
+      )
+
+      // Create a builder user with specific app access
+      const builderUser = await config.createUser({
+        ...structures.users.user(),
+        builder: {
+          global: false,
+          apps: ["app_allowed_123"], // Different app than the one being tested
+        },
+        admin: { global: false },
+      })
+
+      await config.login(builderUser)
+      await config.withUser(builderUser, () =>
+        config.withApp(appId, () =>
+          config.api.users.removeWorkspaceIdFromInvite(code, 403)
+        )
+      )
+    })
+
+    it("should allow builders to delete invites for apps they have access to", async () => {
+      const { code } = await config.api.users.sendUserInvite(
+        sendMailMock,
+        structures.users.newEmail()
+      )
+      const appId = "app_allowed_456"
+      const role = "BASIC"
+
+      // First add the workspace as admin
+      await config.withApp(appId, () =>
+        config.api.users.addWorkspaceIdToInvite(code, role)
+      )
+
+      // Create a builder user with access to the specific app
+      const builderUser = await config.createUser({
+        ...structures.users.user(),
+        builder: {
+          global: false,
+          apps: [appId], // Has access to this specific app
+        },
+        admin: { global: false },
+      })
+
+      await config.login(builderUser)
+      const res = await config.withUser(builderUser, () =>
+        config.withApp(appId, () =>
+          config.api.users.removeWorkspaceIdFromInvite(code, 200)
+        )
+      )
+      expect(res.body.info.apps[appId]).toBeUndefined()
+    })
+  })
+
   describe("POST /api/global/users/multi/invite", () => {
     it("should be able to generate an invitation", async () => {
       const newUserInvite = () => ({
@@ -539,15 +759,17 @@ describe("/api/global/users", () => {
       expect(response.body.message).toBe("Email address cannot be changed")
     })
 
-    it("should allow a non-admin user to update an existing user", async () => {
+    it("should not allow a builder users to update an existing user", async () => {
       const existingUser = await config.createUser(structures.users.user())
-      const nonAdmin = await config.createUser(structures.users.builderUser())
-      await config.createSession(nonAdmin)
+      const builderUser = await config.createUser(
+        structures.users.builderUser()
+      )
+      await config.createSession(builderUser)
 
       await config.api.users.saveUser(
         existingUser,
-        200,
-        config.authHeaders(nonAdmin)
+        403,
+        config.authHeaders(builderUser)
       )
     })
 
@@ -763,6 +985,135 @@ describe("/api/global/users", () => {
     })
   })
 
+  describe("POST /api/global/users/:userId/permission/:role", () => {
+    it("should fail to assign CREATOR role when feature is not enabled", async () => {
+      const user = await config.createUser()
+      const workspaceId = "app_123456789"
+
+      const res = await config.withApp(workspaceId, () =>
+        config.api.users.addUserToWorkspace(
+          user._id!,
+          user._rev!,
+          "CREATOR",
+          400
+        )
+      )
+      expect(res.body.message).toBe("Feature not enabled, please check license")
+    })
+
+    it("should assign CREATOR role and set builder properties", async () => {
+      featureMocks.licenses.useAppBuilders()
+
+      const user = await config.createUser()
+      const workspaceId = "app_123456789"
+
+      await config.withApp(workspaceId, () =>
+        config.api.users.addUserToWorkspace(user._id!, user._rev!, "CREATOR")
+      )
+
+      const updatedUser = await config.getUser(user.email)
+      expect(updatedUser.roles[workspaceId]).toBe("CREATOR")
+      expect(updatedUser.builder?.creator).toBe(true)
+      expect(updatedUser.builder?.apps).toEqual([workspaceId])
+    })
+
+    it("should remove CREATOR role and clean up builder properties when no creator apps remain", async () => {
+      mocks.licenses.useAppBuilders()
+      const user = await config.createUser()
+      const workspaceId = "app_123456789"
+
+      // First assign CREATOR role
+      const res = await config.withApp(workspaceId, () =>
+        config.api.users.addUserToWorkspace(user._id!, user._rev!, "CREATOR")
+      )
+      user._rev = res.body._rev
+
+      // Then remove the user from workspace
+      await config.withApp(workspaceId, () =>
+        config.api.users.removeUserFromWorkspace(user._id!, user._rev!)
+      )
+
+      const updatedUser = await config.getUser(user.email)
+      expect(updatedUser.roles[workspaceId]).toBeUndefined()
+      expect(updatedUser.builder?.creator).toBeUndefined()
+      expect(updatedUser.builder?.apps).toBeUndefined()
+    })
+
+    it("should maintain builder properties when user has multiple CREATOR roles", async () => {
+      mocks.licenses.useAppBuilders()
+      const user = await config.createUser()
+      const workspaceId1 = "app_111111111"
+      const workspaceId2 = "app_222222222"
+
+      // Assign CREATOR role to two workspaces
+      let res = await config.withApp(workspaceId1, () =>
+        config.api.users.addUserToWorkspace(user._id!, user._rev!, "CREATOR")
+      )
+      user._rev = res.body._rev
+      res = await config.withApp(workspaceId2, () =>
+        config.api.users.addUserToWorkspace(user._id!, user._rev!, "CREATOR")
+      )
+      user._rev = res.body._rev
+
+      let updatedUser = await config.getUser(user.email)
+      expect(updatedUser.roles[workspaceId1]).toBe("CREATOR")
+      expect(updatedUser.roles[workspaceId2]).toBe("CREATOR")
+      expect(updatedUser.builder?.creator).toBe(true)
+      expect(updatedUser.builder?.apps).toEqual(
+        expect.arrayContaining([workspaceId1, workspaceId2])
+      )
+
+      // Remove from one workspace
+      await config.withApp(workspaceId1, () =>
+        config.api.users.removeUserFromWorkspace(user._id!, user._rev!)
+      )
+
+      updatedUser = await config.getUser(user.email)
+      expect(updatedUser.roles[workspaceId1]).toBeUndefined()
+      expect(updatedUser.roles[workspaceId2]).toBe("CREATOR")
+      expect(updatedUser.builder?.creator).toBe(true)
+      expect(updatedUser.builder?.apps).toEqual([workspaceId2])
+    })
+
+    it("should handle non-CREATOR role assignments without affecting builder properties", async () => {
+      const user = await config.createUser()
+      const workspaceId = "app_123456789"
+
+      const res = await config.withApp(workspaceId, () =>
+        config.api.users.addUserToWorkspace(user._id!, user._rev!, "BASIC")
+      )
+
+      expect(res.body._id).toBe(user._id)
+
+      const updatedUser = await config.getUser(user.email)
+      expect(updatedUser.roles[workspaceId]).toBe("BASIC")
+      expect(updatedUser.builder?.creator).toBeUndefined()
+      expect(updatedUser.builder?.apps).toBeUndefined()
+    })
+
+    it("should not allow non-admin users to modify workspace permissions", async () => {
+      const regularUser = await config.createUser()
+      const targetUser = await config.createUser()
+      const workspaceId = "app_123456789"
+
+      await config.login(regularUser)
+
+      const res = await config.withUser(regularUser, () =>
+        config.withApp(workspaceId, () =>
+          config.api.users.addUserToWorkspace(
+            targetUser._id!,
+            targetUser._rev!,
+            "CREATOR",
+            403
+          )
+        )
+      )
+      expect(res.body.message).toBe(
+        "Workspace Admin/Builder user only endpoint."
+      )
+    })
+  })
+
   describe("DELETE /api/global/users/:userId", () => {
     it("should be able to destroy a basic user", async () => {
       const user = await config.createUser()

package/src/api/routes/global/users.ts

@@ -44,14 +44,6 @@ function buildInviteMultipleValidation() {
   ))
 }
 
-const createUserAdminOnly = (ctx: any, next: any) => {
-  if (!ctx.request.body._id) {
-    return auth.adminOnly(ctx, next)
-  } else {
-    return auth.builderOrAdmin(ctx, next)
-  }
-}
-
 function buildInviteAcceptValidation() {
   // prettier-ignore
   return auth.joiValidator.body(Joi.object({
@@ -102,14 +94,30 @@ builderOrAdminRoutes
   .get("/api/global/users/count/:appId", controller.countByApp)
   .get("/api/global/users/invites", controller.getUserInvites)
   .get("/api/global/users/:id", controller.find)
-
-adminRoutes
-  .post("/api/global/users/invite", buildInviteValidation(), controller.invite)
+  .post(
+    "/api/global/users/invite/:code/:role",
+    controller.addWorkspaceIdToInvite
+  )
+  .delete(
+    "/api/global/users/invite/:code",
+    controller.removeWorkspaceIdFromInvite
+  )
   .post(
     "/api/global/users/onboard",
     buildInviteMultipleValidation(),
     controller.onboardUsers
   )
+  .post(
+    "/api/global/users/:userId/permission/:role",
+    controller.addUserToWorkspace
+  )
+  .delete(
+    "/api/global/users/:userId/permission",
+    controller.removeUserFromWorkspace
+  )
+
+adminRoutes
+  .post("/api/global/users/invite", buildInviteValidation(), controller.invite)
   .post(
     "/api/global/users/multi/invite",
     buildInviteMultipleValidation(),
@@ -119,17 +127,11 @@ adminRoutes
     "/api/global/users/multi/invite/delete",
     controller.removeMultipleInvites
   )
-  .post("/api/global/users/invite/update/:code", controller.updateInvite)
+  .post("/api/global/users", users.buildUserSaveValidation(), controller.save)
 
 loggedInRoutes
   // search can be used by any user now, to retrieve users for user column
   .post("/api/global/users/search", controller.search)
-  .post(
-    "/api/global/users",
-    createUserAdminOnly,
-    users.buildUserSaveValidation(),
-    controller.save
-  )
   // non-global endpoints
   .get("/api/global/users/invite/:code", controller.checkInvite)
   .post(

package/src/api/routes/index.ts

@@ -1,23 +1,23 @@
-import Router from "@koa/router"
 import { api as pro } from "@budibase/pro"
+import Router from "@koa/router"
 import { endpointGroupList } from "./endpointGroups"
 
 // import to register the routes with the endpoint groups
 import "./global/auth"
-import "./global/users"
 import "./global/configs"
-import "./global/templates"
 import "./global/email"
-import "./global/roles"
 import "./global/events"
-import "./system/environment"
-import "./system/tenants"
-import "./system/status"
-import "./global/self"
 import "./global/license"
+import "./global/roles"
+import "./global/self"
+import "./global/templates"
+import "./global/users"
 import "./system/accounts"
-import "./system/restore"
+import "./system/environment"
 import "./system/logs"
+import "./system/restore"
+import "./system/status"
+import "./system/tenants"
 
 const endpointGroupsRouter = new Router()
 for (let endpoint of endpointGroupList.listAllEndpoints()) {
@@ -26,7 +26,6 @@ for (let endpoint of endpointGroupList.listAllEndpoints()) {
 
 export const routes: Router[] = [
   endpointGroupsRouter,
-  pro.users,
   pro.groups,
   pro.auditLogs,
   pro.scim,

package/src/index.ts

@@ -3,31 +3,31 @@ if (process.env.DD_APM_ENABLED) {
 }
 
 // need to load environment first
-import env from "./environment"
-import Application, { Middleware } from "koa"
-import { bootstrap } from "global-agent"
-import * as db from "./db"
-import { sdk as proSdk } from "@budibase/pro"
 import {
   auth,
-  logging,
+  cache,
+  env as coreEnv,
   events,
+  features,
+  logging,
   middleware,
   queue,
-  env as coreEnv,
-  timers,
   redis,
-  cache,
-  features,
+  timers,
 } from "@budibase/backend-core"
+import { sdk as proSdk } from "@budibase/pro"
+import { bootstrap } from "global-agent"
+import http from "http"
+import gracefulShutdown from "http-graceful-shutdown"
+import Application, { Middleware } from "koa"
+import koaBody from "koa-body"
 import RedisStore from "koa-redis"
+import api from "./api"
 import { loadTemplateConfig } from "./constants/templates"
+import * as db from "./db"
+import env from "./environment"
 
 db.init()
-import koaBody from "koa-body"
-import http from "http"
-import api from "./api"
-import gracefulShutdown from "http-graceful-shutdown"
 
 const koaSession = require("koa-session")
 
@@ -52,7 +52,12 @@ app.proxy = true
 
 // set up top level koa middleware
 app.use(handleScimBody)
-app.use(koaBody({ multipart: true }))
+app.use(
+  koaBody({
+    multipart: true,
+    parsedMethods: ["POST", "PUT", "PATCH", "DELETE"],
+  })
+)
 
 let store: any
 

package/src/tests/TestConfiguration.ts

@@ -51,6 +51,7 @@ class TestConfiguration {
   apiKey?: string
   userPassword = "password123!"
   sessions: string[] = []
+  appId?: string
 
   constructor(opts: { openServer: boolean } = { openServer: true }) {
     // default to cloud hosting
@@ -233,6 +234,16 @@ class TestConfiguration {
     }
   }
 
+  async withApp<T>(appId: string, f: () => Promise<T>): Promise<T> {
+    const oldAppId = this.appId
+    this.appId = appId
+    try {
+      return await f()
+    } finally {
+      this.appId = oldAppId
+    }
+  }
+
   async login(user: User) {
     await this.createSession(user)
     return this.authHeaders(user)
@@ -245,11 +256,15 @@ class TestConfiguration {
       tenantId: user.tenantId,
     }
     const authCookie = jwt.sign(authToken, coreEnv.JWT_SECRET as Secret)
-    return {
+    const headers: Record<string, string> = {
       Accept: "application/json",
       ...this.cookieHeader([`${constants.Cookie.Auth}=${authCookie}`]),
       [constants.Header.CSRF_TOKEN]: CSRF_TOKEN,
     }
+    if (this.appId) {
+      headers[constants.Header.APP_ID] = this.appId
+    }
+    return headers
   }
 
   defaultHeaders() {

package/src/tests/api/users.ts

@@ -1,14 +1,14 @@
+import { generator } from "@budibase/backend-core/tests"
 import {
-  BulkUserResponse,
   BulkUserRequest,
-  InviteUsersRequest,
-  User,
+  BulkUserResponse,
   CreateAdminUserRequest,
-  SearchFilters,
+  InviteUsersRequest,
   InviteUsersResponse,
+  SearchFilters,
+  User,
 } from "@budibase/types"
 import structures from "../structures"
-import { generator } from "@budibase/backend-core/tests"
 import { TestAPI, TestAPIOpts } from "./base"
 
 export class UserAPI extends TestAPI {
@@ -179,22 +179,6 @@ export class UserAPI extends TestAPI {
       .expect(opts?.status ? opts.status : 200)
   }
 
-  grantBuilderToApp = (userId: string, appId: string, statusCode = 200) => {
-    return this.request
-      .post(`/api/global/users/${userId}/app/${appId}/builder`)
-      .set(this.config.defaultHeaders())
-      .expect("Content-Type", /json/)
-      .expect(statusCode)
-  }
-
-  revokeBuilderFromApp = (userId: string, appId: string) => {
-    return this.request
-      .delete(`/api/global/users/${userId}/app/${appId}/builder`)
-      .set(this.config.defaultHeaders())
-      .expect("Content-Type", /json/)
-      .expect(200)
-  }
-
   onboardUser = async (
     req: InviteUsersRequest
   ): Promise<InviteUsersResponse> => {
@@ -227,4 +211,43 @@ export class UserAPI extends TestAPI {
       .set(this.config.internalAPIHeaders())
       .expect(status)
   }
+
+  addWorkspaceIdToInvite = (code: string, role: string, status = 200) => {
+    return this.request
+      .post(`/api/global/users/invite/${code}/${role}`)
+      .set(this.config.defaultHeaders())
+      .expect("Content-Type", /json/)
+      .expect(status)
+  }
+
+  removeWorkspaceIdFromInvite = (code: string, status = 200) => {
+    return this.request
+      .delete(`/api/global/users/invite/${code}`)
+      .set(this.config.defaultHeaders())
+      .expect("Content-Type", /json/)
+      .expect(status)
+  }
+
+  addUserToWorkspace = (
+    userId: string,
+    _rev: string,
+    role: string,
+    status = 200
+  ) => {
+    return this.request
+      .post(`/api/global/users/${userId}/permission/${role}`)
+      .send({ _rev })
+      .set(this.config.defaultHeaders())
+      .expect("Content-Type", /json/)
+      .expect(status)
+  }
+
+  removeUserFromWorkspace = (userId: string, _rev: string, status = 200) => {
+    return this.request
+      .delete(`/api/global/users/${userId}/permission`)
+      .send({ _rev })
+      .set(this.config.defaultHeaders())
+      .expect("Content-Type", /json/)
+      .expect(status)
+  }
 }

package/src/api/routes/global/tests/appBuilder.spec.ts

@@ -1,64 +0,0 @@
-import { TestConfiguration, structures } from "../../../../tests"
-import { mocks } from "@budibase/backend-core/tests"
-import { User } from "@budibase/types"
-
-const MOCK_APP_ID = "app_a"
-
-describe("/api/global/users/:userId/app/builder", () => {
-  const config = new TestConfiguration()
-
-  beforeAll(async () => {
-    await config.beforeAll()
-  })
-
-  afterAll(async () => {
-    await config.afterAll()
-  })
-
-  async function newUser() {
-    const base = structures.users.user()
-    return await config.createUser(base)
-  }
-
-  async function getUser(userId: string) {
-    const response = await config.api.users.getUser(userId)
-    return response.body as User
-  }
-
-  describe("Confirm pro license", () => {
-    it("should 400 with licensing", async () => {
-      const user = await newUser()
-      const resp = await config.api.users.grantBuilderToApp(
-        user._id!,
-        MOCK_APP_ID,
-        400
-      )
-      expect(resp.body.message).toContain(
-        "appBuilders are not currently enabled"
-      )
-    })
-  })
-
-  describe("PATCH /api/global/users/:userId/app/:appId/builder", () => {
-    it("should be able to grant a user access to a particular app", async () => {
-      mocks.licenses.useAppBuilders()
-      const user = await newUser()
-      await config.api.users.grantBuilderToApp(user._id!, MOCK_APP_ID)
-      const updated = await getUser(user._id!)
-      expect(updated.builder?.apps![0]).toBe(MOCK_APP_ID)
-    })
-  })
-
-  describe("DELETE /api/global/users/:userId/app/:appId/builder", () => {
-    it("should allow revoking access", async () => {
-      mocks.licenses.useAppBuilders()
-      const user = await newUser()
-      await config.api.users.grantBuilderToApp(user._id!, MOCK_APP_ID)
-      let updated = await getUser(user._id!)
-      expect(updated.builder?.apps![0]).toBe(MOCK_APP_ID)
-      await config.api.users.revokeBuilderFromApp(user._id!, MOCK_APP_ID)
-      updated = await getUser(user._id!)
-      expect(updated.builder?.apps!.length).toBe(0)
-    })
-  })
-})