diff --git a/packages/backend-core/src/environment.ts b/packages/backend-core/src/environment.ts index 4f2c393785..05fcbffd46 100644 --- a/packages/backend-core/src/environment.ts +++ b/packages/backend-core/src/environment.ts @@ -85,11 +85,11 @@ function getPackageJsonFields(): { } function isWorker() { - return environment.SERVICE_NAME === ServiceType.WORKER + return environment.SERVICE_TYPE === ServiceType.WORKER } function isApps() { - return environment.SERVICE_NAME === ServiceType.APPS + return environment.SERVICE_TYPE === ServiceType.APPS } const environment = { diff --git a/packages/backend-core/src/middleware/builderOnly.ts b/packages/backend-core/src/middleware/builderOnly.ts index 96ee4392ae..8c1c54a44c 100644 --- a/packages/backend-core/src/middleware/builderOnly.ts +++ b/packages/backend-core/src/middleware/builderOnly.ts @@ -13,7 +13,7 @@ export default async (ctx: UserCtx, next: any) => { if (!builderFn) { throw new Error("Service name unknown - middleware inactive.") } - if (!ctx.internal && !isBuilder(ctx.user, appId)) { + if (!ctx.internal && !builderFn(ctx.user, appId)) { ctx.throw(403, "Builder user only endpoint.") } return next() diff --git a/packages/backend-core/src/middleware/tests/builder.spec.ts b/packages/backend-core/src/middleware/tests/builder.spec.ts index 68c72ffe8a..52d2fbae9f 100644 --- a/packages/backend-core/src/middleware/tests/builder.spec.ts +++ b/packages/backend-core/src/middleware/tests/builder.spec.ts @@ -2,8 +2,10 @@ import adminOnly from "../adminOnly" import builderOnly from "../builderOnly" import builderOrAdmin from "../builderOrAdmin" import { structures } from "../../../tests" -import { ContextUser } from "@budibase/types" +import { ContextUser, ServiceType } from "@budibase/types" import { doInAppContext } from "../../context" +import env from "../../environment" +env._set("SERVICE_TYPE", ServiceType.APPS) const appId = "app_aaa" const basicUser = structures.users.user() @@ -139,3 +141,40 @@ describe("builderOrAdmin middleware", () => { threw(ctx.throw) }) }) + +describe("check service difference", () => { + it("should not allow without app ID in apps", () => { + env._set("SERVICE_TYPE", ServiceType.APPS) + const appId = "app_a" + const ctx = buildUserCtx({ + ...basicUser, + builder: { + apps: [appId] + } + }) + const next = jest.fn() + doInAppContext(appId, () => { + builderOnly(ctx, next) + }) + passed(ctx.throw, next) + doInAppContext("app_b", () => { + builderOnly(ctx, next) + }) + threw(ctx.throw) + }) + + it("should allow without app ID in worker", () => { + env._set("SERVICE_TYPE", ServiceType.WORKER) + const ctx = buildUserCtx({ + ...basicUser, + builder: { + apps: ["app_a"] + } + }) + const next = jest.fn() + doInAppContext("app_b", () => { + builderOnly(ctx, next) + }) + passed(ctx.throw, next) + }) +})