@budibase/worker 3.25.4 → 3.26.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/worker",
   "email": "hi@budibase.com",
-  "version": "3.25.4",
+  "version": "3.26.0",
   "description": "Budibase background service",
   "main": "src/index.ts",
   "repository": {
@@ -108,5 +108,5 @@
       }
     }
   },
-  "gitHead": "4a51aa9f4675ffa6555788aeaf6c31b522a952b3"
+  "gitHead": "94f6d3fcbeb2043d8144dc3be0cf560b71dd35dc"
 }

package/src/api/controllers/global/users.ts

@@ -10,7 +10,7 @@ import {
   tenancy,
   users,
 } from "@budibase/backend-core"
-import { features } from "@budibase/pro"
+import { features, groups as proGroups } from "@budibase/pro"
 import { BpmStatusKey, BpmStatusValue, utils } from "@budibase/shared-core"
 import {
   AcceptUserInviteRequest,
@@ -318,6 +318,18 @@ export const search = async (
     }
   }
 
+  const hasWorkspaceId =
+    body && Object.prototype.hasOwnProperty.call(body, "workspaceId")
+
+  if (hasWorkspaceId) {
+    let response = await searchWorkspaceUsers(body)
+    if (!users.hasBuilderPermissions(ctx.user)) {
+      response.data = stripUsers(response.data)
+    }
+    ctx.body = response
+    return
+  }
+
   let response: SearchUsersResponse = { data: [] }
 
   if (body.paginate === false) {
@@ -347,6 +359,111 @@ export const search = async (
   ctx.body = response
 }
 
+const DEFAULT_USER_LIMIT = 8
+
+const searchWorkspaceUsers = async (
+  body: SearchUsersRequest
+): Promise<SearchUsersResponse> => {
+  const workspaceId = body.workspaceId
+  if (!workspaceId) {
+    return { data: [], hasNextPage: false }
+  }
+
+  const limit = body.limit ?? DEFAULT_USER_LIMIT
+  const query = body.query
+  const filtered: User[] = []
+  let cursor = body.bookmark
+  let nextPage: string | undefined
+  const groupAccessCache = new Map<string, boolean>()
+
+  const getBookmarkValue = (user: User) => {
+    if (query?.string?.email && user.email) {
+      return user.email.toLowerCase()
+    }
+    return user._id
+  }
+
+  const hydrateGroupAccess = async (usersToCheck: User[]) => {
+    const missingGroupIds = new Set<string>()
+    for (const user of usersToCheck) {
+      for (const groupId of user.userGroups || []) {
+        if (!groupAccessCache.has(groupId)) {
+          missingGroupIds.add(groupId)
+        }
+      }
+    }
+
+    if (!missingGroupIds.size) {
+      return
+    }
+
+    const groupIdList = [...missingGroupIds]
+    const groups = await proGroups.getBulk(groupIdList, { enriched: false })
+    groups.forEach((group, index) => {
+      const groupId = group?._id || groupIdList[index]
+      const hasAccess = !!group?.roles?.[workspaceId]
+      groupAccessCache.set(groupId, hasAccess)
+    })
+  }
+
+  const hasWorkspaceAccess = (user: User) => {
+    if (users.isAdminOrBuilder(user, workspaceId)) {
+      return true
+    }
+    if (user.roles?.[workspaceId]) {
+      return true
+    }
+    return (user.userGroups || []).some(groupId =>
+      groupAccessCache.get(groupId)
+    )
+  }
+
+  while (filtered.length <= limit) {
+    const page = await userSdk.core.paginatedUsers({
+      bookmark: cursor,
+      query,
+      limit,
+    })
+
+    if (!page.data?.length) {
+      break
+    }
+
+    await hydrateGroupAccess(page.data)
+
+    for (const user of page.data) {
+      if (!hasWorkspaceAccess(user)) {
+        continue
+      }
+      filtered.push(user)
+      if (filtered.length === limit + 1) {
+        nextPage = getBookmarkValue(user)
+        break
+      }
+    }
+
+    if (filtered.length === limit + 1 || !page.hasNextPage) {
+      break
+    }
+    cursor = page.nextPage
+  }
+
+  const hasNextPage = filtered.length > limit
+  const data = hasNextPage ? filtered.slice(0, limit) : filtered
+
+  for (let user of data) {
+    if (user) {
+      delete user.password
+    }
+  }
+
+  return {
+    data,
+    hasNextPage,
+    nextPage: hasNextPage ? nextPage : undefined,
+  }
+}
+
 // called internally by app server user fetch
 export const fetch = async (ctx: UserCtx<void, FetchUsersResponse>) => {
   const all = await userSdk.db.allUsers()

package/src/api/routes/global/tests/users.spec.ts

@@ -868,6 +868,52 @@ describe("/api/global/users", () => {
       expect(response.body.data[0].email).toBe(email)
     })
 
+    it("should filter by workspace access when workspaceId is provided", async () => {
+      const workspaceId = "app_workspace_filter"
+      const email = structures.users.newEmail()
+      await config.createUser({
+        email,
+        roles: { [workspaceId]: "BASIC" },
+      })
+
+      const response = await config.api.users.searchUsers({
+        workspaceId,
+        query: { string: { email } },
+      })
+
+      expect(response.body.data.length).toBe(1)
+      expect(response.body.data[0].email).toBe(email)
+    })
+
+    it("should exclude users without workspace access", async () => {
+      const workspaceId = "app_workspace_filter_exclude"
+      const email = structures.users.newEmail()
+      await config.createUser({
+        email,
+        roles: { app_other: "BASIC" },
+      })
+
+      const response = await config.api.users.searchUsers({
+        workspaceId,
+        query: { string: { email } },
+      })
+
+      expect(response.body.data.length).toBe(0)
+    })
+
+    it("should return no users when workspaceId is empty", async () => {
+      const email = structures.users.newEmail()
+      await config.createUser({ email })
+
+      const response = await config.api.users.searchUsers({
+        workspaceId: "",
+        query: { string: { email } },
+      })
+
+      expect(response.body.data.length).toBe(0)
+      expect(response.body.hasNextPage).toBe(false)
+    })
+
     it("should be able to search by email with numeric prefixing", async () => {
       const user = await config.createUser()
       const response = await config.api.users.searchUsers({

package/src/tests/api/users.ts

@@ -5,7 +5,7 @@ import {
   CreateAdminUserRequest,
   InviteUsersRequest,
   InviteUsersResponse,
-  SearchFilters,
+  SearchUsersRequest,
   User,
 } from "@budibase/types"
 import structures from "../structures"
@@ -151,7 +151,7 @@ export class UserAPI extends TestAPI {
   }
 
   searchUsers = (
-    { query }: { query?: SearchFilters },
+    body: SearchUsersRequest = {},
     opts?: {
       status?: number
       noHeaders?: boolean
@@ -160,7 +160,7 @@ export class UserAPI extends TestAPI {
   ) => {
     const req = this.request
       .post("/api/global/users/search")
-      .send({ query })
+      .send(body)
       .expect("Content-Type", /json/)
       .expect(opts?.status ? opts.status : 200)
     if (opts?.useHeaders) {