From dd2a84d58a5aa2805b48b3e6d0bbb4d7022c52a0 Mon Sep 17 00:00:00 2001
From: Martin McKeaveney <martin@shogunsystems.co.uk>
Date: Mon, 12 Oct 2020 11:57:37 +0100
Subject: [PATCH 1/3] support for external webhooks

---
 .../components/settings/tabs/APIKeys.svelte   | 12 ++++++++-
 packages/server/src/middleware/authorized.js  | 25 +++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/packages/builder/src/components/settings/tabs/APIKeys.svelte b/packages/builder/src/components/settings/tabs/APIKeys.svelte
index 8a3c9fc710..8e569596a4 100644
--- a/packages/builder/src/components/settings/tabs/APIKeys.svelte
+++ b/packages/builder/src/components/settings/tabs/APIKeys.svelte
@@ -1,6 +1,7 @@
 <script>
-  import { Input } from "@budibase/bbui"
+  import { Input, Label } from "@budibase/bbui"
   import api from "builderStore/api"
+  import { backendUiStore } from "builderStore"
   import analytics from "analytics"
 
   let keys = { budibase: "" }
@@ -38,6 +39,10 @@
     edit
     value={keys.budibase}
     label="Budibase API Key" />
+  <div>
+    <Label extraSmall grey>Instance ID (Webhooks)</Label>
+    <span>{$backendUiStore.selectedDatabase._id}</span>
+  </div>
 </div>
 
 <style>
@@ -45,4 +50,9 @@
     display: grid;
     grid-gap: var(--spacing-xl);
   }
+
+  span {
+    font-size: var(--font-size-xs);
+    font-weight: 500;
+  }
 </style>
diff --git a/packages/server/src/middleware/authorized.js b/packages/server/src/middleware/authorized.js
index 4cce4c4670..093e9b5bf5 100644
--- a/packages/server/src/middleware/authorized.js
+++ b/packages/server/src/middleware/authorized.js
@@ -5,8 +5,33 @@ const {
   BUILDER_LEVEL_ID,
   BUILDER,
 } = require("../utilities/accessLevels")
+const environment = require("../environment")
+const { apiKeyTable } = require("../db/dynamoClient")
 
 module.exports = (permName, getItemId) => async (ctx, next) => {
+  if (
+    environment.CLOUD &&
+    ctx.headers["x-api-key"] &&
+    ctx.headers["x-instanceid"]
+  ) {
+    // api key header passed by external webhook
+    const apiKeyInfo = await apiKeyTable.get({
+      primary: ctx.headers["x-api-key"],
+    })
+
+    if (apiKeyInfo) {
+      ctx.isAuthenticated = true
+      ctx.externalWebhook = true
+      ctx.apiKey = ctx.headers["x-api-key"]
+      ctx.user = {
+        instanceId: ctx.headers["x-instanceid"],
+      }
+      return next()
+    }
+
+    ctx.throw(403, "API key invalid")
+  }
+
   if (!ctx.isAuthenticated) {
     ctx.throw(403, "Session not authenticated")
   }

From 9a289d2d167bbc22081e7715ab96b40a7a037cc3 Mon Sep 17 00:00:00 2001
From: Joe <49767913+joebudi@users.noreply.github.com>
Date: Mon, 12 Oct 2020 12:50:59 +0100
Subject: [PATCH 2/3] Typography, background, and transition props fix

Broken fonts removed
Minor tidy-ups around background props
Fixed transition duration prop
---
 .../userInterface/propertyCategories.js           | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/packages/builder/src/components/userInterface/propertyCategories.js b/packages/builder/src/components/userInterface/propertyCategories.js
index 9c622a383a..bae44df7f5 100644
--- a/packages/builder/src/components/userInterface/propertyCategories.js
+++ b/packages/builder/src/components/userInterface/propertyCategories.js
@@ -361,19 +361,18 @@ export const typography = [
     label: "Font",
     key: "font-family",
     control: OptionSelect,
-    defaultValue: "initial",
+    defaultValue: "Arial",
     options: [
-      "initial",
       "Arial",
       "Arial Black",
       "Cursive",
       "Courier",
       "Comic Sans MS",
       "Helvetica",
+      "Helvetica Neue",
       "Impact",
       "Inter",
       "Lucida Sans Unicode",
-      "Open Sans",
       "Roboto",
       "Roboto Mono",
       "Times New Roman",
@@ -467,9 +466,9 @@ export const background = [
     label: "Gradient",
     key: "background-image",
     control: OptionSelect,
-    defaultValue: "None",
+    defaultValue: "",
     options: [
-      { label: "None", value: "None" },
+      { label: "Select option", value: "" },
       {
         label: "Warm Flame",
         value: "linear-gradient(45deg, #ff9a9e 0%, #fad0c4 99%, #fad0c4 100%);",
@@ -518,9 +517,9 @@ export const background = [
   },
   {
     label: "Image",
-    key: "background-image",
+    key: "background",
     control: Input,
-    placeholder: "Src",
+    placeholder: "url",
   },
 ]
 
@@ -665,7 +664,7 @@ export const transitions = [
     control: OptionSelect,
     textAlign: "center",
     placeholder: "sec",
-    options: ["0.2ms", "0.4ms", "0.8ms", "1s", "2s", "4s"],
+    options: ["0.4s", "0.6s", "0.8s", "1s", "2s", "4s"],
   },
   {
     label: "Ease",

From 7f7594895b1ed277caa4ecb4e7e87f3e2f2627e8 Mon Sep 17 00:00:00 2001
From: Martin McKeaveney <martin@shogunsystems.co.uk>
Date: Mon, 12 Oct 2020 13:32:52 +0100
Subject: [PATCH 3/3] adding auth object to context rather than separate
 booleans

---
 packages/server/src/api/controllers/static.js   |  6 +++---
 packages/server/src/app.js                      |  1 +
 packages/server/src/middleware/authenticated.js | 14 +++++++++-----
 packages/server/src/middleware/authorized.js    | 10 ++++++----
 packages/server/src/middleware/usageQuota.js    |  2 +-
 5 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/packages/server/src/api/controllers/static.js b/packages/server/src/api/controllers/static.js
index f14b794210..5aaa9ab125 100644
--- a/packages/server/src/api/controllers/static.js
+++ b/packages/server/src/api/controllers/static.js
@@ -136,7 +136,7 @@ exports.performLocalFileProcessing = async function(ctx) {
 }
 
 exports.serveApp = async function(ctx) {
-  const mainOrAuth = ctx.isAuthenticated ? "main" : "unauthenticated"
+  const mainOrAuth = ctx.auth.authenticated ? "main" : "unauthenticated"
 
   // default to homedir
   const appPath = resolve(
@@ -154,7 +154,7 @@ exports.serveApp = async function(ctx) {
   // only set the appId cookie for /appId .. we COULD check for valid appIds
   // but would like to avoid that DB hit
   const looksLikeAppId = /^(app_)?[0-9a-f]{32}$/.test(appId)
-  if (looksLikeAppId && !ctx.isAuthenticated) {
+  if (looksLikeAppId && !ctx.auth.authenticated) {
     const anonUser = {
       userId: "ANON",
       accessLevelId: ANON_LEVEL_ID,
@@ -200,7 +200,7 @@ exports.serveAttachment = async function(ctx) {
 
 exports.serveAppAsset = async function(ctx) {
   // default to homedir
-  const mainOrAuth = ctx.isAuthenticated ? "main" : "unauthenticated"
+  const mainOrAuth = ctx.auth.authenticated ? "main" : "unauthenticated"
 
   const appPath = resolve(
     budibaseAppsDir(),
diff --git a/packages/server/src/app.js b/packages/server/src/app.js
index 7560c9cfa4..4157534365 100644
--- a/packages/server/src/app.js
+++ b/packages/server/src/app.js
@@ -24,6 +24,7 @@ app.use(
 )
 
 app.context.eventEmitter = eventEmitter
+app.context.auth = {}
 
 // api routes
 app.use(api.routes())
diff --git a/packages/server/src/middleware/authenticated.js b/packages/server/src/middleware/authenticated.js
index 93ee66b6d4..1203ea0033 100644
--- a/packages/server/src/middleware/authenticated.js
+++ b/packages/server/src/middleware/authenticated.js
@@ -20,8 +20,10 @@ module.exports = async (ctx, next) => {
   if (builderToken) {
     try {
       const jwtPayload = jwt.verify(builderToken, ctx.config.jwtSecret)
-      ctx.apiKey = jwtPayload.apiKey
-      ctx.isAuthenticated = jwtPayload.accessLevelId === BUILDER_LEVEL_ID
+      ctx.auth = {
+        apiKey: jwtPayload.apiKey,
+        authenticated: jwtPayload.accessLevelId === BUILDER_LEVEL_ID,
+      }
       ctx.user = {
         ...jwtPayload,
         accessLevel: await getAccessLevel(
@@ -38,14 +40,13 @@ module.exports = async (ctx, next) => {
   }
 
   if (!appToken) {
-    ctx.isAuthenticated = false
+    ctx.auth.authenticated = false
     await next()
     return
   }
 
   try {
     const jwtPayload = jwt.verify(appToken, ctx.config.jwtSecret)
-    ctx.apiKey = jwtPayload.apiKey
     ctx.user = {
       ...jwtPayload,
       accessLevel: await getAccessLevel(
@@ -53,7 +54,10 @@ module.exports = async (ctx, next) => {
         jwtPayload.accessLevelId
       ),
     }
-    ctx.isAuthenticated = ctx.user.accessLevelId !== ANON_LEVEL_ID
+    ctx.auth = {
+      authenticated: ctx.user.accessLevelId !== ANON_LEVEL_ID,
+      apiKey: jwtPayload.apiKey,
+    }
   } catch (err) {
     ctx.throw(err.status || STATUS_CODES.FORBIDDEN, err.text)
   }
diff --git a/packages/server/src/middleware/authorized.js b/packages/server/src/middleware/authorized.js
index 093e9b5bf5..bd09029471 100644
--- a/packages/server/src/middleware/authorized.js
+++ b/packages/server/src/middleware/authorized.js
@@ -20,9 +20,11 @@ module.exports = (permName, getItemId) => async (ctx, next) => {
     })
 
     if (apiKeyInfo) {
-      ctx.isAuthenticated = true
-      ctx.externalWebhook = true
-      ctx.apiKey = ctx.headers["x-api-key"]
+      ctx.auth = {
+        authenticated: true,
+        external: true,
+        apiKey: ctx.headers["x-api-key"],
+      }
       ctx.user = {
         instanceId: ctx.headers["x-instanceid"],
       }
@@ -32,7 +34,7 @@ module.exports = (permName, getItemId) => async (ctx, next) => {
     ctx.throw(403, "API key invalid")
   }
 
-  if (!ctx.isAuthenticated) {
+  if (!ctx.auth.authenticated) {
     ctx.throw(403, "Session not authenticated")
   }
 
diff --git a/packages/server/src/middleware/usageQuota.js b/packages/server/src/middleware/usageQuota.js
index e82305dc12..778f51f9d8 100644
--- a/packages/server/src/middleware/usageQuota.js
+++ b/packages/server/src/middleware/usageQuota.js
@@ -55,7 +55,7 @@ module.exports = async (ctx, next) => {
     return next()
   }
   try {
-    await usageQuota.update(ctx.apiKey, property, usage)
+    await usageQuota.update(ctx.auth.apiKey, property, usage)
     return next()
   } catch (err) {
     ctx.throw(403, err)