2021-04-19 22:34:07 +12:00
|
|
|
const CouchDB = require("../../../db")
|
2021-06-16 06:39:40 +12:00
|
|
|
const { generateGlobalUserID, getGlobalUserParams, StaticDatabases } =
|
|
|
|
require("@budibase/auth").db
|
2021-04-22 03:42:44 +12:00
|
|
|
const { hash, getGlobalUserByEmail } = require("@budibase/auth").utils
|
2021-05-06 02:17:15 +12:00
|
|
|
const { UserStatus, EmailTemplatePurpose } = require("../../../constants")
|
|
|
|
const { checkInviteCode } = require("../../../utilities/redis")
|
|
|
|
const { sendEmail } = require("../../../utilities/email")
|
2021-07-07 05:10:04 +12:00
|
|
|
const { user: userCache } = require("@budibase/auth/cache")
|
|
|
|
const { invalidateSessions } = require("@budibase/auth/sessions")
|
2021-04-19 22:34:07 +12:00
|
|
|
|
2021-04-19 22:38:54 +12:00
|
|
|
const GLOBAL_DB = StaticDatabases.GLOBAL.name
|
2021-04-19 22:34:07 +12:00
|
|
|
|
2021-06-02 02:58:40 +12:00
|
|
|
async function allUsers() {
|
|
|
|
const db = new CouchDB(GLOBAL_DB)
|
|
|
|
const response = await db.allDocs(
|
|
|
|
getGlobalUserParams(null, {
|
|
|
|
include_docs: true,
|
|
|
|
})
|
|
|
|
)
|
|
|
|
return response.rows.map(row => row.doc)
|
|
|
|
}
|
|
|
|
|
2021-05-04 22:32:22 +12:00
|
|
|
exports.save = async ctx => {
|
2021-04-19 22:38:54 +12:00
|
|
|
const db = new CouchDB(GLOBAL_DB)
|
2021-04-19 22:34:07 +12:00
|
|
|
const { email, password, _id } = ctx.request.body
|
2021-04-21 04:17:44 +12:00
|
|
|
|
|
|
|
// make sure another user isn't using the same email
|
2021-05-20 02:55:00 +12:00
|
|
|
let dbUser
|
|
|
|
if (email) {
|
|
|
|
dbUser = await getGlobalUserByEmail(email)
|
|
|
|
if (dbUser != null && (dbUser._id !== _id || Array.isArray(dbUser))) {
|
|
|
|
ctx.throw(400, "Email address already in use.")
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
dbUser = await db.get(_id)
|
2021-04-21 04:17:44 +12:00
|
|
|
}
|
|
|
|
|
|
|
|
// get the password, make sure one is defined
|
|
|
|
let hashedPassword
|
|
|
|
if (password) {
|
|
|
|
hashedPassword = await hash(password)
|
|
|
|
} else if (dbUser) {
|
|
|
|
hashedPassword = dbUser.password
|
|
|
|
} else {
|
|
|
|
ctx.throw(400, "Password must be specified.")
|
|
|
|
}
|
|
|
|
|
2021-04-19 22:34:07 +12:00
|
|
|
let user = {
|
2021-04-21 04:17:44 +12:00
|
|
|
...dbUser,
|
2021-04-19 22:34:07 +12:00
|
|
|
...ctx.request.body,
|
2021-04-21 04:17:44 +12:00
|
|
|
_id: _id || generateGlobalUserID(),
|
2021-04-19 22:34:07 +12:00
|
|
|
password: hashedPassword,
|
|
|
|
}
|
2021-05-22 01:56:06 +12:00
|
|
|
// make sure the roles object is always present
|
|
|
|
if (!user.roles) {
|
|
|
|
user.roles = {}
|
|
|
|
}
|
2021-04-19 22:34:07 +12:00
|
|
|
// add the active status to a user if its not provided
|
|
|
|
if (user.status == null) {
|
|
|
|
user.status = UserStatus.ACTIVE
|
|
|
|
}
|
|
|
|
try {
|
2021-05-06 02:10:28 +12:00
|
|
|
const response = await db.put({
|
2021-04-21 04:17:44 +12:00
|
|
|
password: hashedPassword,
|
2021-04-19 22:34:07 +12:00
|
|
|
...user,
|
|
|
|
})
|
2021-07-07 05:10:04 +12:00
|
|
|
await userCache.invalidateUser(response.id)
|
2021-04-19 22:34:07 +12:00
|
|
|
ctx.body = {
|
|
|
|
_id: response.id,
|
|
|
|
_rev: response.rev,
|
|
|
|
email,
|
|
|
|
}
|
|
|
|
} catch (err) {
|
|
|
|
if (err.status === 409) {
|
|
|
|
ctx.throw(400, "User exists already")
|
|
|
|
} else {
|
|
|
|
ctx.throw(err.status, err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-05-06 08:56:43 +12:00
|
|
|
exports.adminUser = async ctx => {
|
2021-05-06 09:06:31 +12:00
|
|
|
const db = new CouchDB(GLOBAL_DB)
|
|
|
|
const response = await db.allDocs(
|
|
|
|
getGlobalUserParams(null, {
|
|
|
|
include_docs: true,
|
|
|
|
})
|
|
|
|
)
|
|
|
|
|
|
|
|
if (response.rows.some(row => row.doc.admin)) {
|
|
|
|
ctx.throw(403, "You cannot initialise once an admin user has been created.")
|
|
|
|
}
|
|
|
|
|
2021-05-06 08:56:43 +12:00
|
|
|
const { email, password } = ctx.request.body
|
2021-04-21 04:17:44 +12:00
|
|
|
ctx.request.body = {
|
2021-05-06 08:56:43 +12:00
|
|
|
email: email,
|
|
|
|
password: password,
|
2021-04-21 04:17:44 +12:00
|
|
|
roles: {},
|
|
|
|
builder: {
|
2021-05-06 08:56:43 +12:00
|
|
|
global: true,
|
|
|
|
},
|
|
|
|
admin: {
|
2021-04-21 04:17:44 +12:00
|
|
|
global: true,
|
|
|
|
},
|
|
|
|
}
|
2021-04-24 05:54:12 +12:00
|
|
|
await exports.save(ctx)
|
2021-04-21 04:17:44 +12:00
|
|
|
}
|
|
|
|
|
2021-05-04 22:32:22 +12:00
|
|
|
exports.destroy = async ctx => {
|
2021-04-19 22:38:54 +12:00
|
|
|
const db = new CouchDB(GLOBAL_DB)
|
2021-04-21 04:17:44 +12:00
|
|
|
const dbUser = await db.get(ctx.params.id)
|
2021-04-19 22:34:07 +12:00
|
|
|
await db.remove(dbUser._id, dbUser._rev)
|
2021-07-07 05:10:04 +12:00
|
|
|
await userCache.invalidateUser(dbUser._id)
|
|
|
|
await invalidateSessions(dbUser._id)
|
2021-04-19 22:34:07 +12:00
|
|
|
ctx.body = {
|
2021-04-21 04:17:44 +12:00
|
|
|
message: `User ${ctx.params.id} deleted.`,
|
2021-04-19 22:34:07 +12:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-06-02 02:58:40 +12:00
|
|
|
exports.removeAppRole = async ctx => {
|
|
|
|
const { appId } = ctx.params
|
|
|
|
const db = new CouchDB(GLOBAL_DB)
|
|
|
|
const users = await allUsers()
|
|
|
|
const bulk = []
|
2021-07-08 10:29:19 +12:00
|
|
|
const cacheInvalidations = []
|
2021-06-02 02:58:40 +12:00
|
|
|
for (let user of users) {
|
|
|
|
if (user.roles[appId]) {
|
2021-07-08 10:29:19 +12:00
|
|
|
cacheInvalidations.push(userCache.invalidateUser(user._id))
|
2021-06-02 02:58:40 +12:00
|
|
|
delete user.roles[appId]
|
|
|
|
bulk.push(user)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
await db.bulkDocs(bulk)
|
2021-07-08 10:29:19 +12:00
|
|
|
await Promise.all(cacheInvalidations)
|
2021-06-02 02:58:40 +12:00
|
|
|
ctx.body = {
|
|
|
|
message: "App role removed from all users",
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-05-20 00:37:59 +12:00
|
|
|
exports.getSelf = async ctx => {
|
2021-06-22 05:37:14 +12:00
|
|
|
if (!ctx.user) {
|
|
|
|
ctx.throw(403, "User not logged in")
|
|
|
|
}
|
2021-05-20 00:37:59 +12:00
|
|
|
ctx.params = {
|
2021-05-20 02:09:57 +12:00
|
|
|
id: ctx.user._id,
|
2021-05-20 00:37:59 +12:00
|
|
|
}
|
|
|
|
// this will set the body
|
|
|
|
await exports.find(ctx)
|
|
|
|
}
|
|
|
|
|
|
|
|
exports.updateSelf = async ctx => {
|
2021-05-20 00:17:50 +12:00
|
|
|
const db = new CouchDB(GLOBAL_DB)
|
|
|
|
const user = await db.get(ctx.user._id)
|
|
|
|
if (ctx.request.body.password) {
|
|
|
|
ctx.request.body.password = await hash(ctx.request.body.password)
|
|
|
|
}
|
2021-05-20 00:30:55 +12:00
|
|
|
// don't allow sending up an ID/Rev, always use the existing one
|
|
|
|
delete ctx.request.body._id
|
|
|
|
delete ctx.request.body._rev
|
2021-05-20 00:17:50 +12:00
|
|
|
const response = await db.put({
|
|
|
|
...user,
|
|
|
|
...ctx.request.body,
|
|
|
|
})
|
2021-07-08 10:29:19 +12:00
|
|
|
await userCache.invalidateUser(user._id)
|
2021-05-20 00:17:50 +12:00
|
|
|
ctx.body = {
|
|
|
|
_id: response.id,
|
|
|
|
_rev: response.rev,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-04-19 22:34:07 +12:00
|
|
|
// called internally by app server user fetch
|
2021-05-04 22:32:22 +12:00
|
|
|
exports.fetch = async ctx => {
|
2021-06-02 02:58:40 +12:00
|
|
|
const users = await allUsers()
|
2021-04-19 22:34:07 +12:00
|
|
|
// user hashed password shouldn't ever be returned
|
|
|
|
for (let user of users) {
|
|
|
|
if (user) {
|
|
|
|
delete user.password
|
|
|
|
}
|
|
|
|
}
|
|
|
|
ctx.body = users
|
|
|
|
}
|
|
|
|
|
|
|
|
// called internally by app server user find
|
2021-05-04 22:32:22 +12:00
|
|
|
exports.find = async ctx => {
|
2021-04-19 22:38:54 +12:00
|
|
|
const db = new CouchDB(GLOBAL_DB)
|
2021-04-19 22:34:07 +12:00
|
|
|
let user
|
|
|
|
try {
|
2021-04-21 04:17:44 +12:00
|
|
|
user = await db.get(ctx.params.id)
|
2021-04-19 22:34:07 +12:00
|
|
|
} catch (err) {
|
|
|
|
// no user found, just return nothing
|
|
|
|
user = {}
|
|
|
|
}
|
|
|
|
if (user) {
|
|
|
|
delete user.password
|
|
|
|
}
|
|
|
|
ctx.body = user
|
|
|
|
}
|
2021-05-06 02:10:28 +12:00
|
|
|
|
|
|
|
exports.invite = async ctx => {
|
2021-05-25 05:45:43 +12:00
|
|
|
const { email, userInfo } = ctx.request.body
|
2021-05-06 04:49:34 +12:00
|
|
|
const existing = await getGlobalUserByEmail(email)
|
2021-05-06 02:17:15 +12:00
|
|
|
if (existing) {
|
|
|
|
ctx.throw(400, "Email address already in use.")
|
|
|
|
}
|
2021-05-12 02:24:17 +12:00
|
|
|
await sendEmail(email, EmailTemplatePurpose.INVITATION, {
|
|
|
|
subject: "{{ company }} platform invitation",
|
2021-05-25 05:45:43 +12:00
|
|
|
info: userInfo,
|
2021-05-12 02:24:17 +12:00
|
|
|
})
|
2021-05-06 02:17:15 +12:00
|
|
|
ctx.body = {
|
2021-05-06 02:19:44 +12:00
|
|
|
message: "Invitation has been sent.",
|
2021-05-06 02:17:15 +12:00
|
|
|
}
|
2021-05-06 02:10:28 +12:00
|
|
|
}
|
|
|
|
|
|
|
|
exports.inviteAccept = async ctx => {
|
2021-05-20 02:09:57 +12:00
|
|
|
const { inviteCode, password, firstName, lastName } = ctx.request.body
|
2021-05-06 02:17:15 +12:00
|
|
|
try {
|
2021-05-25 05:45:43 +12:00
|
|
|
// info is an extension of the user object that was stored by admin
|
|
|
|
const { email, info } = await checkInviteCode(inviteCode)
|
2021-05-20 02:09:57 +12:00
|
|
|
// only pass through certain props for accepting
|
|
|
|
ctx.request.body = {
|
|
|
|
firstName,
|
|
|
|
lastName,
|
|
|
|
password,
|
|
|
|
email,
|
2021-05-25 05:45:43 +12:00
|
|
|
...info,
|
2021-05-20 02:09:57 +12:00
|
|
|
}
|
2021-05-06 02:17:15 +12:00
|
|
|
// this will flesh out the body response
|
|
|
|
await exports.save(ctx)
|
|
|
|
} catch (err) {
|
|
|
|
ctx.throw(400, "Unable to create new user, invitation invalid.")
|
2021-05-06 02:10:28 +12:00
|
|
|
}
|
|
|
|
}
|