@budibase/worker 3.35.10 → 3.36.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/worker",
   "email": "hi@budibase.com",
-  "version": "3.35.10",
+  "version": "3.36.2",
   "description": "Budibase background service",
   "main": "src/index.ts",
   "repository": {
@@ -79,5 +79,5 @@
     "supertest": "6.3.3",
     "timekeeper": "2.2.0"
   },
-  "gitHead": "e2fa586beb21f730b22350e561d21ec1e2c5c2f0"
+  "gitHead": "af5c4987e639f4c3f801e5baa9570277080cef14"
 }

package/src/api/routes/global/license.ts

@@ -1,7 +1,11 @@
 import * as controller from "../../controllers/global/license"
 import { middleware } from "@budibase/backend-core"
 import Joi from "joi"
-import { loggedInRoutes } from "../endpointGroups"
+import {
+  adminRoutes,
+  builderOrAdminRoutes,
+  loggedInRoutes,
+} from "../endpointGroups"
 
 const activateLicenseKeyValidator = middleware.joiValidator.body(
   Joi.object({
@@ -15,9 +19,12 @@ const activateOfflineLicenseValidator = middleware.joiValidator.body(
   }).required()
 )
 
-loggedInRoutes
+loggedInRoutes.get("/api/global/license/usage", controller.getQuotaUsage)
+
+builderOrAdminRoutes.get("/api/global/license/key", controller.getLicenseKey)
+
+adminRoutes
   .post("/api/global/license/refresh", controller.refresh)
-  .get("/api/global/license/usage", controller.getQuotaUsage)
   .get("/api/global/install", controller.getInstallInfo)
   // LICENSE KEY
   .post(
@@ -25,7 +32,6 @@ loggedInRoutes
     activateLicenseKeyValidator,
     controller.activateLicenseKey
   )
-  .get("/api/global/license/key", controller.getLicenseKey)
   .delete("/api/global/license/key", controller.deleteLicenseKey)
   // OFFLINE LICENSE
   .post(

package/src/api/routes/global/tests/license.spec.ts

@@ -6,6 +6,26 @@ const quotas = mocks.pro.quotas
 describe("/api/global/license", () => {
   const config = new TestConfiguration()
 
+  async function createNonAdminUser() {
+    const user = await config.createUser()
+    await config.login(user)
+    return user
+  }
+
+  async function createBuilderUser() {
+    const user = await config.createUser(structures.users.builderUser())
+    await config.login(user)
+    return user
+  }
+
+  async function createCreatorUser() {
+    const user = await config.createUser(
+      structures.users.user({ builder: { creator: true } })
+    )
+    await config.login(user)
+    return user
+  }
+
   beforeAll(async () => {
     await config.beforeAll()
   })
@@ -14,6 +34,10 @@ describe("/api/global/license", () => {
     await config.afterAll()
   })
 
+  beforeEach(() => {
+    mocks.licenses.useUnlimited()
+  })
+
   afterEach(() => {
     jest.resetAllMocks()
   })
@@ -34,6 +58,19 @@ describe("/api/global/license", () => {
       expect(res.status).toBe(200)
       expect(res.body).toEqual(usage)
     })
+
+    it("allows non-admin access", async () => {
+      const user = await createNonAdminUser()
+      const usage = structures.quotas.usage()
+      quotas.getQuotaUsage.mockResolvedValue(usage)
+
+      const res = await config.withUser(user, () =>
+        config.api.license.getUsage()
+      )
+
+      expect(res.status).toBe(200)
+      expect(res.body).toEqual(usage)
+    })
   })
 
   describe("POST /api/global/license/key", () => {
@@ -53,6 +90,35 @@ describe("/api/global/license", () => {
       const res = await config.api.license.getLicenseKey()
       expect(res.status).toBe(404)
     })
+
+    it("allows builder access", async () => {
+      const user = await createBuilderUser()
+      licensing.keys.getLicenseKey.mockResolvedValue("licenseKey")
+
+      const res = await config.withUser(user, () =>
+        config.api.license.getLicenseKey()
+      )
+
+      expect(res.status).toBe(200)
+      expect(res.body).toEqual({
+        licenseKey: "*",
+      })
+    })
+
+    it("allows creator access", async () => {
+      const user = await createCreatorUser()
+      licensing.keys.getLicenseKey.mockResolvedValue("licenseKey")
+
+      const res = await config.withUser(user, () =>
+        config.api.license.getLicenseKey()
+      )
+
+      expect(res.status).toBe(200)
+      expect(res.body).toEqual({
+        licenseKey: "*",
+      })
+    })
+
     it("returns 200 + license key", async () => {
       licensing.keys.getLicenseKey.mockResolvedValue("licenseKey")
       const res = await config.api.license.getLicenseKey()
@@ -120,4 +186,70 @@ describe("/api/global/license", () => {
       })
     })
   })
+
+  describe("authorisation", () => {
+    it.each([
+      [
+        "GET /api/global/license/key",
+        () => config.api.license.getLicenseKey(),
+        { message: "Admin/Builder user only endpoint.", status: 403 },
+      ],
+      [
+        "POST /api/global/license/refresh",
+        () => config.api.license.refresh(),
+        config.adminOnlyResponse(),
+      ],
+      [
+        "GET /api/global/install",
+        () => config.api.license.getInstallInfo(),
+        config.adminOnlyResponse(),
+      ],
+      [
+        "POST /api/global/license/key",
+        () =>
+          config.api.license.activateLicenseKey({
+            licenseKey: "licenseKey",
+          }),
+        config.adminOnlyResponse(),
+      ],
+      [
+        "DELETE /api/global/license/key",
+        () => config.api.license.deleteLicenseKey(),
+        config.adminOnlyResponse(),
+      ],
+      [
+        "POST /api/global/license/offline",
+        () =>
+          config.api.license.activateOfflineLicense({
+            offlineLicenseToken: "offlineLicenseToken",
+          }),
+        config.adminOnlyResponse(),
+      ],
+      [
+        "GET /api/global/license/offline",
+        () => config.api.license.getOfflineLicense(),
+        config.adminOnlyResponse(),
+      ],
+      [
+        "DELETE /api/global/license/offline",
+        () => config.api.license.deleteOfflineLicense(),
+        config.adminOnlyResponse(),
+      ],
+      [
+        "GET /api/global/license/offline/identifier",
+        () => config.api.license.getOfflineLicenseIdentifier(),
+        config.adminOnlyResponse(),
+      ],
+    ])(
+      "returns 403 for non-admin access to %s",
+      async (_path, request, expectedBody) => {
+        const user = await createNonAdminUser()
+
+        const res = await config.withUser(user, () => request())
+
+        expect(res.status).toBe(403)
+        expect(res.body).toEqual(expectedBody)
+      }
+    )
+  })
 })

package/src/tests/api/license.ts

@@ -10,12 +10,17 @@ export class LicenseAPI extends TestAPI {
       .post("/api/global/license/refresh")
       .set(this.config.defaultHeaders())
   }
-  getUsage = async () => {
+  getUsage = async (status = 200) => {
     return this.request
       .get("/api/global/license/usage")
       .set(this.config.defaultHeaders())
       .expect("Content-Type", /json/)
-      .expect(200)
+      .expect(status)
+  }
+  getInstallInfo = async () => {
+    return this.request
+      .get("/api/global/install")
+      .set(this.config.defaultHeaders())
   }
   activateLicenseKey = async (body: ActivateLicenseKeyRequest) => {
     return this.request