CodeMirror/budibase
1
0
Fork 0
mirror of synced 2024-06-29 19:41:03 +12:00
Code Issues Projects Releases Wiki Activity

Merge pull request #368 from mjashanks/instanceid-url-removal

Browse source 
Remove Instance ID from URLS + appRootPath Removal
This commit is contained in:
Michael Shanks 2020-06-21 20:27:36 +01:00 committed by GitHub
parent 597104f4a2 f44f3ec375
commit 62a0bdc057
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
79 changed files with 493 additions and 411 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
packages/builder/src/builderStore/api.js
View file

@ -1,17 +1,13 @@
const apiCall = method => async (url, body) => {
const headers = {
"Content-Type": "application/json",
}
const response = await fetch(url, {
method: method,
headers: {
"Content-Type": "application/json",
"x-user-agent": "Budibase Builder",
},
body: body && JSON.stringify(body),
headers,
})
// if (response.status === 500) {
// throw new Error("Server Error");
// }
return response
}
@ -22,9 +18,9 @@ export const del = apiCall("DELETE")
export const put = apiCall("PUT")
export default {
post,
get,
patch,
delete: del,
put,
post: apiCall("POST"),
get: apiCall("GET"),
patch: apiCall("PATCH"),
delete: apiCall("DELETE"),
put: apiCall("PUT"),
}

4
packages/builder/src/builderStore/store/backend.js
View file

@ -24,8 +24,8 @@ export const getBackendUiStore = () => {
store.actions = {
database: {
select: async db => {
const modelsResponse = await api.get(`/api/${db._id}/models`)
const viewsResponse = await api.get(`/api/${db._id}/views`)
const modelsResponse = await api.get(`/api/models`)
const viewsResponse = await api.get(`/api/views`)
const models = await modelsResponse.json()
const views = await viewsResponse.json()
store.update(state => {

4
packages/builder/src/builderStore/store/index.js
View file

@ -1,5 +1,4 @@
import { values } from "lodash/fp"
import { backendUiStore } from "builderStore"
import * as backendStoreActions from "./backend"
import { writable, get } from "svelte/store"
import api from "../api"
@ -295,13 +294,10 @@ const addChildComponent = store => (componentToAdd, presetName) => {
const presetProps = presetName ? component.presets[presetName] : {}
const instanceId = get(backendUiStore).selectedDatabase._id
const newComponent = createProps(
component,
{
...presetProps,
_instanceId: instanceId,
},
state
)

20
packages/builder/src/builderStore/store/workflow/index.js
View file

@ -3,8 +3,8 @@ import api from "../../api"
import Workflow from "./Workflow"
const workflowActions = store => ({
fetch: async instanceId => {
const WORKFLOWS_URL = `/api/${instanceId}/workflows`
fetch: async () => {
const WORKFLOWS_URL = `/api/workflows`
const workflowResponse = await api.get(WORKFLOWS_URL)
const json = await workflowResponse.json()
store.update(state => {
@ -12,14 +12,14 @@ const workflowActions = store => ({
return state
})
},
create: async ({ instanceId, name }) => {
create: async ({ name }) => {
const workflow = {
name,
definition: {
steps: [],
},
}
const CREATE_WORKFLOW_URL = `/api/${instanceId}/workflows`
const CREATE_WORKFLOW_URL = `/api/workflows`
const response = await api.post(CREATE_WORKFLOW_URL, workflow)
const json = await response.json()
store.update(state => {
@ -28,8 +28,8 @@ const workflowActions = store => ({
return state
})
},
save: async ({ instanceId, workflow }) => {
const UPDATE_WORKFLOW_URL = `/api/${instanceId}/workflows`
save: async ({ workflow }) => {
const UPDATE_WORKFLOW_URL = `/api/workflows`
const response = await api.put(UPDATE_WORKFLOW_URL, workflow)
const json = await response.json()
store.update(state => {
@ -42,8 +42,8 @@ const workflowActions = store => ({
return state
})
},
update: async ({ instanceId, workflow }) => {
const UPDATE_WORKFLOW_URL = `/api/${instanceId}/workflows`
update: async ({ workflow }) => {
const UPDATE_WORKFLOW_URL = `/api/workflows`
const response = await api.put(UPDATE_WORKFLOW_URL, workflow)
const json = await response.json()
store.update(state => {
@ -55,9 +55,9 @@ const workflowActions = store => ({
return state
})
},
delete: async ({ instanceId, workflow }) => {
delete: async ({ workflow }) => {
const { _id, _rev } = workflow
const DELETE_WORKFLOW_URL = `/api/${instanceId}/workflows/${_id}/${_rev}`
const DELETE_WORKFLOW_URL = `/api/workflows/${_id}/${_rev}`
await api.delete(DELETE_WORKFLOW_URL)
store.update(state => {

4
packages/builder/src/components/database/ModelDataTable/ModelDataTable.svelte
View file

@ -53,12 +53,10 @@
let views = []
let currentPage = 0
$: instanceId = $backendUiStore.selectedDatabase._id
$: {
if ($backendUiStore.selectedView) {
api
.fetchDataForView($backendUiStore.selectedView, instanceId)
.fetchDataForView($backendUiStore.selectedView)
.then(records => {
data = records || []
headers = Object.keys($backendUiStore.selectedModel.schema).filter(

16
packages/builder/src/components/database/ModelDataTable/api.js
View file

@ -1,7 +1,7 @@
import api from "builderStore/api"
export async function createUser(user, instanceId) {
const CREATE_USER_URL = `/api/${instanceId}/users`
export async function createUser(user) {
const CREATE_USER_URL = `/api/users`
const response = await api.post(CREATE_USER_URL, user)
return await response.json()
}
@ -14,21 +14,21 @@ export async function createDatabase(appname, instanceName) {
return await response.json()
}
export async function deleteRecord(record, instanceId) {
const DELETE_RECORDS_URL = `/api/${instanceId}/${record._modelId}/records/${record._id}/${record._rev}`
export async function deleteRecord(record) {
const DELETE_RECORDS_URL = `/api/${record._modelId}/records/${record._id}/${record._rev}`
const response = await api.delete(DELETE_RECORDS_URL)
return response
}
export async function saveRecord(record, instanceId, modelId) {
const SAVE_RECORDS_URL = `/api/${instanceId}/${modelId}/records`
export async function saveRecord(record, modelId) {
const SAVE_RECORDS_URL = `/api/${modelId}/records`
const response = await api.post(SAVE_RECORDS_URL, record)
return await response.json()
}
export async function fetchDataForView(viewName, instanceId) {
const FETCH_RECORDS_URL = `/api/${instanceId}/views/${viewName}`
export async function fetchDataForView(viewName) {
const FETCH_RECORDS_URL = `/api/views/${viewName}`
const response = await api.get(FETCH_RECORDS_URL)
return await response.json()

3
packages/builder/src/components/database/ModelDataTable/modals/CreateEditModel/CreateEditModel.svelte
View file

@ -18,7 +18,6 @@
let fieldToEdit
$: modelFields = model.schema ? Object.entries(model.schema) : []
$: instanceId = $backendUiStore.selectedDatabase._id
function editField() {}
@ -27,7 +26,7 @@
function onFinishedFieldEdit() {}
async function saveModel() {
const SAVE_MODEL_URL = `/api/${instanceId}/models`
const SAVE_MODEL_URL = `/api/models`
const response = await api.post(SAVE_MODEL_URL, model)
const newModel = await response.json()
backendUiStore.actions.models.create(newModel)

3
packages/builder/src/components/database/ModelDataTable/modals/CreateEditRecord.svelte
View file

@ -14,8 +14,6 @@
let errors = []
let selectedModel
$: instanceId = $backendUiStore.selectedDatabase._id
$: modelSchema = $backendUiStore.selectedModel
? Object.entries($backendUiStore.selectedModel.schema)
: []
@ -49,7 +47,6 @@
...record,
modelId: $backendUiStore.selectedModel._id,
},
instanceId,
$backendUiStore.selectedModel._id
)
if (recordResponse.errors) {

2
packages/builder/src/components/database/ModelDataTable/modals/CreateEditView.svelte
View file

@ -29,7 +29,7 @@
function deleteView() {}
async function saveView() {
const SAVE_VIEW_URL = `/api/${instanceId}/views`
const SAVE_VIEW_URL = `/api/views`
const response = await api.post(SAVE_VIEW_URL, view)
backendUiStore.update(state => {
state.views = [...state.views, response.view]

3
packages/builder/src/components/database/ModelDataTable/modals/CreateUser.svelte
View file

@ -10,12 +10,11 @@
let accessLevelId
$: valid = username && password && accessLevelId
$: instanceId = $backendUiStore.selectedDatabase._id
$: appId = $store.appId
async function createUser() {
const user = { name: username, username, password, accessLevelId }
const response = await api.createUser(user, instanceId)
const response = await api.createUser(user)
backendUiStore.actions.users.create(response)
onClosed()
}

3
packages/builder/src/components/database/ModelDataTable/modals/DeleteRecord.svelte
View file

@ -6,7 +6,6 @@
export let record
export let onClosed
$: instanceId = $backendUiStore.selectedDatabase._id
</script>
<section>
@ -25,7 +24,7 @@
<ActionButton
alert
on:click={async () => {
await api.deleteRecord(record, instanceId)
await api.deleteRecord(record)
backendUiStore.actions.records.delete(record)
onClosed()
}}>

1
packages/builder/src/components/nav/HierarchyRow.svelte
View file

@ -7,7 +7,6 @@
CreateEditModelModal,
CreateEditViewModal,
} from "components/database/ModelDataTable/modals"
import api from "builderStore/api"
const { open, close } = getContext("simple-modal")

2
packages/builder/src/components/nav/SchemaManagementDrawer.svelte
View file

@ -52,7 +52,7 @@
}
async function deleteModel(modelToDelete) {
const DELETE_MODEL_URL = `/api/${instanceId}/models/${node._id}/${node._rev}`
const DELETE_MODEL_URL = `/api/models/${node._id}/${node._rev}`
const response = await api.delete(DELETE_MODEL_URL)
backendUiStore.update(state => {
state.models = state.models.filter(

3
packages/builder/src/components/nav/UsersList.svelte
View file

@ -12,11 +12,10 @@
$: currentAppInfo = {
appname: $store.appname,
instanceId: $backendUiStore.selectedDatabase._id,
}
async function fetchUsers() {
const FETCH_USERS_URL = `/api/${currentAppInfo.instanceId}/users`
const FETCH_USERS_URL = `/api/users`
const response = await api.get(FETCH_USERS_URL)
const users = await response.json()
backendUiStore.update(state => {

3
packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte
View file

@ -91,7 +91,6 @@
? screenPlaceholder
: $store.currentPreviewItem,
],
appRootPath: "",
}
$: selectedComponentType = getComponentTypeName($store.currentComponentInfo)
@ -108,6 +107,8 @@
selectedComponentType,
selectedComponentId,
frontendDefinition,
appId: $store.appId,
instanceId: $backendUiStore.selectedDatabase._id,
})
)
}

15
packages/builder/src/components/userInterface/AppPreview/iframeTemplate.js
View file

@ -20,6 +20,7 @@ export default `<html>
font-weight: bold;
}
</style>
<script src='/assets/budibase-client.js'></script>
<script>
function receiveMessage(event) {
@ -45,11 +46,10 @@ export default `<html>
styles.appendChild(document.createTextNode(data.styles))
window["##BUDIBASE_FRONTEND_DEFINITION##"] = data.frontendDefinition;
if (clientModule) {
clientModule.loadBudibase({ window, localStorage })
if (window.loadBudibase) {
loadBudibase({ window, localStorage })
}
}
let clientModule
let styles
let selectedComponentStyle
@ -59,12 +59,9 @@ export default `<html>
return false;
}, true)
import('/_builder/budibase-client.esm.mjs')
.then(module => {
clientModule = module
window.addEventListener('message', receiveMessage)
window.dispatchEvent(new Event('bb-ready'))
})
window.addEventListener('message', receiveMessage)
window.dispatchEvent(new Event('bb-ready'))
</script>
</head>
<body>

1
packages/builder/src/components/workflow/SetupPanel/DeleteWorkflowModal.svelte
View file

@ -1,7 +1,6 @@
<script>
import { store, backendUiStore, workflowStore } from "builderStore"
import { notifier } from "@beyonk/svelte-notifications"
import api from "builderStore/api"
import ActionButton from "components/common/ActionButton.svelte"
export let onClosed

1
packages/builder/src/components/workflow/SetupPanel/SetupPanel.svelte
View file

@ -3,7 +3,6 @@
import { onMount, getContext } from "svelte"
import { backendUiStore, workflowStore } from "builderStore"
import { notifier } from "@beyonk/svelte-notifications"
import api from "builderStore/api"
import WorkflowBlockSetup from "./WorkflowBlockSetup.svelte"
import DeleteWorkflowModal from "./DeleteWorkflowModal.svelte"

1
packages/builder/src/components/workflow/WorkflowBuilder/WorkflowBuilder.svelte
View file

@ -3,7 +3,6 @@
import { workflowStore, backendUiStore } from "builderStore"
import { notifier } from "@beyonk/svelte-notifications"
import Flowchart from "./flowchart/FlowChart.svelte"
import api from "builderStore/api"
let selectedWorkflow
let uiTree

1
packages/builder/src/components/workflow/WorkflowPanel/BlockList/BlockList.svelte
View file

@ -3,7 +3,6 @@
import { backendUiStore, workflowStore } from "builderStore"
import { WorkflowList } from "../"
import WorkflowBlock from "./WorkflowBlock.svelte"
import api from "builderStore/api"
import blockDefinitions from "../blockDefinitions"
let selectedTab = "TRIGGER"

1
packages/builder/src/components/workflow/WorkflowPanel/WorkflowList/CreateWorkflowModal.svelte
View file

@ -1,7 +1,6 @@
<script>
import { store, backendUiStore, workflowStore } from "builderStore"
import { notifier } from "@beyonk/svelte-notifications"
import api from "builderStore/api"
import ActionButton from "components/common/ActionButton.svelte"
export let onClosed

3
packages/builder/src/components/workflow/WorkflowPanel/WorkflowList/WorkflowList.svelte
View file

@ -3,7 +3,6 @@
import { notifier } from "@beyonk/svelte-notifications"
import { onMount, getContext } from "svelte"
import { backendUiStore, workflowStore } from "builderStore"
import api from "builderStore/api"
import CreateWorkflowModal from "./CreateWorkflowModal.svelte"
const { open, close } = getContext("simple-modal")
@ -23,7 +22,7 @@
}
onMount(() => {
workflowStore.actions.fetch($backendUiStore.selectedDatabase._id)
workflowStore.actions.fetch()
})
</script>

1
packages/builder/src/components/workflow/WorkflowPanel/WorkflowPanel.svelte
View file

@ -2,7 +2,6 @@
import { onMount } from "svelte"
import { backendUiStore, workflowStore } from "builderStore"
import { WorkflowList, BlockList } from "./"
import api from "builderStore/api"
import blockDefinitions from "./blockDefinitions"
let selectedTab = "WORKFLOWS"

1
packages/builder/src/pages/[application]/workflow/[workflow]/_layout.svelte
View file

@ -1,3 +1,4 @@
<script>
import { params } from "@sveltech/routify"
store.setCurrentPage($params.page)
</script>

2
packages/client/package.json
View file

@ -15,7 +15,7 @@
"client": "web"
}
},
"testURL": "http://jest-breaks-if-this-does-not-exist",
"testURL": "http://test.com",
"moduleNameMapper": {
"\\.(jpg|jpeg|png|gif|eot|otf|webp|svg|ttf|woff|woff2|mp4|webm|wav|mp3|m4a|aac|oga)$": "<rootDir>/internals/mocks/fileMock.js",
"\\.(css|less|sass|scss)$": "identity-obj-proxy"

5
packages/client/src/api/index.js
View file

@ -1,9 +1,9 @@
import { authenticate } from "./authenticate"
import { triggerWorkflow } from "./workflow"
export const createApi = ({ rootPath = "", setState, getState }) => {
export const createApi = ({ setState, getState }) => {
const apiCall = method => async ({ url, body }) => {
const response = await fetch(`${rootPath}${url}`, {
const response = await fetch(url, {
method: method,
headers: {
"Content-Type": "application/json",
@ -45,7 +45,6 @@ export const createApi = ({ rootPath = "", setState, getState }) => {
const isSuccess = obj => !obj || !obj[ERROR_MEMBER]
const apiOpts = {
rootPath,
setState,
getState,
isSuccess,

9
packages/client/src/createApp.js
View file

@ -2,6 +2,7 @@ import { attachChildren } from "./render/attachChildren"
import { createTreeNode } from "./render/prepareRenderComponent"
import { screenRouter } from "./render/screenRouter"
import { createStateManager } from "./state/stateManager"
import { getAppId } from "./render/getAppId"
export const createApp = ({
componentLibraries,
@ -15,11 +16,9 @@ export const createApp = ({
const onScreenSlotRendered = screenSlotNode => {
const onScreenSelected = (screen, url) => {
const stateManager = createStateManager({
frontendDefinition,
componentLibraries,
onScreenSlotRendered: () => {},
routeTo,
appRootPath: frontendDefinition.appRootPath,
})
const getAttachChildrenParams = attachChildrenParams(stateManager)
screenSlotNode.props._children = [screen.props]
@ -36,10 +35,10 @@ export const createApp = ({
routeTo = screenRouter({
screens: frontendDefinition.screens,
onScreenSelected,
appRootPath: frontendDefinition.appRootPath,
window,
})
const fallbackPath = window.location.pathname.replace(
frontendDefinition.appRootPath,
getAppId(window.document.cookie),
""
)
routeTo(currentUrl || fallbackPath)
@ -59,10 +58,8 @@ export const createApp = ({
let rootTreeNode
const pageStateManager = createStateManager({
frontendDefinition,
componentLibraries,
onScreenSlotRendered,
appRootPath: frontendDefinition.appRootPath,
// seems weird, but the routeTo variable may not be available at this point
routeTo: url => routeTo(url),
})

11
packages/client/src/index.js
View file

@ -1,5 +1,6 @@
import { createApp } from "./createApp"
import { builtins, builtinLibName } from "./render/builtinComponents"
import { getAppId } from "./render/getAppId"
/**
* create a web application from static budibase definition files.
@ -8,7 +9,7 @@ import { builtins, builtinLibName } from "./render/builtinComponents"
export const loadBudibase = async opts => {
const _window = (opts && opts.window) || window
// const _localStorage = (opts && opts.localStorage) || localStorage
const appId = getAppId(_window.document.cookie)
const frontendDefinition = _window["##BUDIBASE_FRONTEND_DEFINITION##"]
const user = {}
@ -20,9 +21,7 @@ export const loadBudibase = async opts => {
for (let library of libraries) {
// fetch the JavaScript for the component libraries from the server
componentLibraryModules[library] = await import(
`/${frontendDefinition.appId}/componentlibrary?library=${encodeURI(
library
)}`
`/componentlibrary?library=${encodeURI(library)}`
)
}
@ -38,11 +37,11 @@ export const loadBudibase = async opts => {
componentLibraries: componentLibraryModules,
frontendDefinition,
user,
window,
window: _window,
})
const route = _window.location
? _window.location.pathname.replace(frontendDefinition.appRootPath, "")
? _window.location.pathname.replace(`${appId}/`, "").replace(appId, "")
: ""
initialisePage(frontendDefinition.page, _window.document.body, route)

12
packages/client/src/render/getAppId.js Normal file
View file

@ -0,0 +1,12 @@
export const getAppId = docCookie => {
const cookie =
docCookie.split(";").find(c => c.trim().startsWith("budibase:token")) ||
docCookie.split(";").find(c => c.trim().startsWith("builder:token"))
const base64Token = cookie.substring(lengthOfKey)
const user = JSON.parse(atob(base64Token.split(".")[1]))
return user.appId
}
const lengthOfKey = "budibase:token=".length

19
packages/client/src/render/screenRouter.js
View file

@ -1,11 +1,20 @@
import regexparam from "regexparam"
import { routerStore } from "../state/store"
import { getAppId } from "./getAppId"
export const screenRouter = ({ screens, onScreenSelected, appRootPath }) => {
export const screenRouter = ({ screens, onScreenSelected, window }) => {
const makeRootedPath = url => {
if (appRootPath) {
if (url) return `${appRootPath}${url.startsWith("/") ? "" : "/"}${url}`
return appRootPath
if (
window.location &&
(window.location.hostname === "localhost" ||
window.location.hostname === "127.0.0.1")
) {
const appId = getAppId(window.document.cookie)
if (url) {
if (url.startsWith(appId)) return url
return `/${appId}${url.startsWith("/") ? "" : "/"}${url}`
}
return appId
}
return url
}
@ -70,7 +79,7 @@ export const screenRouter = ({ screens, onScreenSelected, appRootPath }) => {
)
return
const target = x.target || "_self"
const target = (x && x.target) || "_self"
if (!y || target !== "_self" || x.host !== location.host) return
e.preventDefault()

21
packages/client/src/state/bbComponentApi.js
View file

@ -6,31 +6,19 @@ export const trimSlash = str => str.replace(/^\/+|\/+$/g, "")
export const bbFactory = ({
store,
frontendDefinition,
componentLibraries,
onScreenSlotRendered,
}) => {
const relativeUrl = url => {
if (!frontendDefinition.appRootPath) return url
if (
url.startsWith("http:") ||
url.startsWith("https:") ||
url.startsWith("./")
)
return url
return frontendDefinition.appRootPath + "/" + trimSlash(url)
}
const apiCall = method => (url, body) =>
fetch(url, {
const apiCall = method => (url, body) => {
return fetch(url, {
method: method,
headers: {
"Content-Type": "application/json",
"x-user-agent": "Budibase Builder",
},
body: body && JSON.stringify(body),
credentials: "same-origin",
})
}
const api = {
post: apiCall("POST"),
@ -63,7 +51,6 @@ export const bbFactory = ({
getContext: getContext(treeNode),
setContext: setContext(treeNode),
store: store,
relativeUrl,
api,
parent,
}

3
packages/client/src/state/eventHandlers.js
View file

@ -6,14 +6,13 @@ import { createApi } from "../api"
export const EVENT_TYPE_MEMBER_NAME = "##eventHandlerType"
export const eventHandlers = (rootPath, routeTo) => {
export const eventHandlers = routeTo => {
const handler = (parameters, execute) => ({
execute,
parameters,
})
const api = createApi({
rootPath,
setState,
getState: (path, fallback) => getState(path, fallback),
})

5
packages/client/src/state/stateManager.js
View file

@ -21,13 +21,11 @@ const isMetaProp = propName =>
propName === "_styles"
export const createStateManager = ({
appRootPath,
frontendDefinition,
componentLibraries,
onScreenSlotRendered,
routeTo,
}) => {
let handlerTypes = eventHandlers(appRootPath, routeTo)
let handlerTypes = eventHandlers(routeTo)
let currentState
const getCurrentState = () => currentState
@ -35,7 +33,6 @@ export const createStateManager = ({
const bb = bbFactory({
store: appStore,
getCurrentState,
frontendDefinition,
componentLibraries,
onScreenSlotRendered,
})

6
packages/client/tests/screenRouting.spec.js
View file

@ -18,7 +18,7 @@ describe("screenRouting", () => {
it("should load correct screen, for initial URL, when appRootPath is something", async () => {
const { page, screens } = pageWith3Screens()
const { dom } = await load(page, screens, "/testApp/screen2", "/testApp")
const { dom } = await load(page, screens, "/TEST_APP_ID/screen2", "127.0.0.1")
const rootDiv = dom.window.document.body.children[0]
expect(rootDiv.children.length).toBe(1)
@ -50,8 +50,8 @@ describe("screenRouting", () => {
const { dom, app } = await load(
page,
screens,
"/testApp/screen2",
"/testApp"
"/TEST_APP_ID/screen2",
"127.0.0.1"
)
app.routeTo()("/screen3")

28
packages/client/tests/testAppDef.js
View file

@ -1,19 +1,33 @@
import { JSDOM } from "jsdom"
import jsdom, { JSDOM } from "jsdom"
import { loadBudibase } from "../src/index"
export const load = async (page, screens, url, appRootPath) => {
export const load = async (page, screens, url, host = "test.com") => {
screens = screens || []
url = url || "/"
appRootPath = appRootPath || ""
const fullUrl = `http://${host}${url}`
const cookieJar = new jsdom.CookieJar()
const cookie = `${btoa("{}")}.${btoa('{"appId":"TEST_APP_ID"}')}.signature`
cookieJar.setCookie(
`budibase:token=${cookie};domain=${host};path=/`,
fullUrl,
{
looseMode: false,
},
() => {}
)
const dom = new JSDOM("<!DOCTYPE html><html><body></body><html>", {
url: `http://test${url}`,
url: fullUrl,
cookieJar,
})
autoAssignIds(page.props)
for (let s of screens) {
autoAssignIds(s.props)
}
setAppDef(dom.window, page, screens)
addWindowGlobals(dom.window, page, screens, appRootPath, {
addWindowGlobals(dom.window, page, screens, {
hierarchy: {},
actions: [],
triggers: [],
@ -27,11 +41,10 @@ export const load = async (page, screens, url, appRootPath) => {
return { dom, app }
}
const addWindowGlobals = (window, page, screens, appRootPath) => {
const addWindowGlobals = (window, page, screens) => {
window["##BUDIBASE_FRONTEND_DEFINITION##"] = {
page,
screens,
appRootPath,
}
}
@ -88,7 +101,6 @@ const setAppDef = (window, page, screens) => {
componentLibraries: [],
page,
screens,
appRootPath: "",
}
}

8
packages/materialdesign-components/src/Test/createApp.js
View file

@ -14,12 +14,6 @@ export default async () => {
componentLibraries["@budibase/standard-components"] = standardcomponents
const appDef = { hierarchy: {}, actions: {} }
const user = { name: "yeo", permissions: [] }
const { initialisePage } = createApp(
componentLibraries,
{ appRootPath: "" },
appDef,
user,
{}
)
const { initialisePage } = createApp(componentLibraries, {}, appDef, user, {})
return initialisePage
}

16
packages/server/src/api/controllers/accesslevel.js
View file

@ -8,7 +8,7 @@ const {
} = require("../../utilities/accessLevels")
exports.fetch = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const body = await db.query("database/by_type", {
include_docs: true,
key: ["accesslevel"],
@ -19,12 +19,12 @@ exports.fetch = async function(ctx) {
{
_id: ADMIN_LEVEL_ID,
name: "Admin",
permissions: await generateAdminPermissions(ctx.params.instanceId),
permissions: await generateAdminPermissions(ctx.user.instanceId),
},
{
_id: POWERUSER_LEVEL_ID,
name: "Power User",
permissions: await generatePowerUserPermissions(ctx.params.instanceId),
permissions: await generatePowerUserPermissions(ctx.user.instanceId),
},
]
@ -32,12 +32,12 @@ exports.fetch = async function(ctx) {
}
exports.find = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
ctx.body = await db.get(ctx.params.levelId)
}
exports.update = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const level = await db.get(ctx.params.levelId)
level.name = ctx.body.name
level.permissions = ctx.request.body.permissions
@ -48,7 +48,7 @@ exports.update = async function(ctx) {
}
exports.patch = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const level = await db.get(ctx.params.levelId)
const { removedPermissions, addedPermissions, _rev } = ctx.request.body
@ -84,7 +84,7 @@ exports.patch = async function(ctx) {
}
exports.create = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const level = {
name: ctx.request.body.name,
@ -101,7 +101,7 @@ exports.create = async function(ctx) {
}
exports.destroy = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
await db.remove(ctx.params.levelId, ctx.params.rev)
ctx.message = `Access Level ${ctx.params.id} deleted successfully`
ctx.status = 200

19
packages/server/src/api/controllers/application.js
View file

@ -9,6 +9,7 @@ const { copy, exists, readFile, writeFile } = require("fs-extra")
const { budibaseAppsDir } = require("../../utilities/budibaseDir")
const { exec } = require("child_process")
const sqrl = require("squirrelly")
const setBuilderToken = require("../../utilities/builder/setBuilderToken")
exports.fetch = async function(ctx) {
const db = new CouchDB(ClientDb.name(getClientId(ctx)))
@ -25,6 +26,14 @@ exports.fetchAppPackage = async function(ctx) {
const db = new CouchDB(ClientDb.name(clientId))
const application = await db.get(ctx.params.applicationId)
ctx.body = await getPackageForBuilder(ctx.config, application)
/*
instance is hardcoded now - this can only change when we move
pages and screens into the database
*/
const devInstance = application.instances.find(
i => i.name === `dev-${clientId}`
)
setBuilderToken(ctx, ctx.params.applicationId, devInstance._id)
}
exports.create = async function(ctx) {
@ -37,10 +46,12 @@ exports.create = async function(ctx) {
const appId = newid()
// insert an appId -> clientId lookup
const masterDb = new CouchDB("clientAppLookup")
await masterDb.put({
_id: appId,
clientId,
})
const db = new CouchDB(ClientDb.name(clientId))
const newApplication = {
@ -56,18 +67,18 @@ exports.create = async function(ctx) {
description: ctx.request.body.description,
}
const { rev } = await db.post(newApplication)
const { rev } = await db.put(newApplication)
newApplication._rev = rev
const createInstCtx = {
params: {
applicationId: newApplication._id,
user: {
appId: newApplication._id,
},
request: {
body: { name: `dev-${clientId}` },
},
}
await instanceController.create(createInstCtx)
newApplication.instances.push(createInstCtx.body)
if (ctx.isDev) {
const newAppFolder = await createEmptyAppPackage(ctx, newApplication)

26
packages/server/src/api/controllers/auth.js
View file

@ -4,25 +4,31 @@ const ClientDb = require("../../db/clientDb")
const bcrypt = require("../../utilities/bcrypt")
exports.authenticate = async ctx => {
if (!ctx.user.appId) ctx.throw(400, "No appId")
const { username, password } = ctx.request.body
if (!username) ctx.throw(400, "Username Required.")
if (!password) ctx.throw(400, "Password Required")
const masterDb = new CouchDB("clientAppLookup")
const { clientId } = await masterDb.get(ctx.params.appId)
const { clientId } = await masterDb.get(ctx.user.appId)
if (!clientId) {
ctx.throw(400, "ClientId not suplied")
}
// find the instance that the user is associated with
const db = new CouchDB(ClientDb.name(clientId))
const appId = ctx.params.appId
const app = await db.get(appId)
const app = await db.get(ctx.user.appId)
const instanceId = app.userInstanceMap[username]
if (!instanceId)
ctx.throw(500, "User is not associated with an instance of app", appId)
ctx.throw(
500,
"User is not associated with an instance of app",
ctx.user.appId
)
// Check the user exists in the instance DB by username
const instanceDb = new CouchDB(instanceId)
@ -41,16 +47,22 @@ exports.authenticate = async ctx => {
const payload = {
userId: dbUser._id,
accessLevelId: dbUser.accessLevelId,
instanceId: instanceId,
appId: ctx.user.appId,
instanceId,
}
const token = jwt.sign(payload, ctx.config.jwtSecret, {
expiresIn: "1 day",
})
const ONE_DAY_FROM_NOW = new Date(Date.now() + 24 * 3600)
const expires = new Date()
expires.setDate(expires.getDate() + 1)
ctx.cookies.set("budibase:token", token, { expires: ONE_DAY_FROM_NOW })
ctx.cookies.set("budibase:token", token, {
expires,
path: "/",
httpOnly: false,
})
ctx.body = {
token,

10
packages/server/src/api/controllers/instance.js
View file

@ -4,19 +4,19 @@ const newid = require("../../db/newid")
exports.create = async function(ctx) {
const instanceName = ctx.request.body.name
const appShortId = ctx.params.applicationId.substring(0, 7)
const { appId } = ctx.user
const appShortId = appId.substring(0, 7)
const instanceId = `inst_${appShortId}_${newid()}`
const { applicationId } = ctx.params
const masterDb = new CouchDB("clientAppLookup")
const { clientId } = await masterDb.get(applicationId)
const { clientId } = await masterDb.get(appId)
const db = new CouchDB(instanceId)
await db.put({
_id: "_design/database",
metadata: {
clientId,
applicationId,
applicationId: appId,
},
views: {
by_username: {
@ -46,7 +46,7 @@ exports.create = async function(ctx) {
// Add the new instance under the app clientDB
const clientDb = new CouchDB(client.name(clientId))
const budibaseApp = await clientDb.get(applicationId)
const budibaseApp = await clientDb.get(appId)
const instance = { _id: instanceId, name: instanceName }
budibaseApp.instances.push(instance)
await clientDb.put(budibaseApp)

8
packages/server/src/api/controllers/model.js
View file

@ -2,7 +2,7 @@ const CouchDB = require("../../db")
const newid = require("../../db/newid")
exports.fetch = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const body = await db.query("database/by_type", {
include_docs: true,
key: ["model"],
@ -11,13 +11,13 @@ exports.fetch = async function(ctx) {
}
exports.find = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const model = await db.get(ctx.params.id)
ctx.body = model
}
exports.create = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const newModel = {
type: "model",
...ctx.request.body,
@ -65,7 +65,7 @@ exports.create = async function(ctx) {
exports.update = async function() {}
exports.destroy = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const modelToDelete = await db.get(ctx.params.modelId)

16
packages/server/src/api/controllers/record.js
View file

@ -3,7 +3,7 @@ const validateJs = require("validate.js")
const newid = require("../../db/newid")
exports.save = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const record = ctx.request.body
record.modelId = ctx.params.modelId
@ -46,7 +46,7 @@ exports.save = async function(ctx) {
ctx.eventEmitter &&
ctx.eventEmitter.emit(`record:save`, {
record,
instanceId: ctx.params.instanceId,
instanceId: ctx.user.instanceId,
})
ctx.body = record
ctx.status = 200
@ -54,7 +54,7 @@ exports.save = async function(ctx) {
}
exports.fetchView = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const response = await db.query(`database/${ctx.params.viewName}`, {
include_docs: true,
})
@ -62,7 +62,7 @@ exports.fetchView = async function(ctx) {
}
exports.fetchModelRecords = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const response = await db.query(`database/all_${ctx.params.modelId}`, {
include_docs: true,
})
@ -70,7 +70,7 @@ exports.fetchModelRecords = async function(ctx) {
}
exports.search = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const response = await db.allDocs({
include_docs: true,
...ctx.request.body,
@ -79,7 +79,7 @@ exports.search = async function(ctx) {
}
exports.find = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const record = await db.get(ctx.params.recordId)
if (record.modelId !== ctx.params.modelId) {
ctx.throw(400, "Supplied modelId doe not match the record's modelId")
@ -89,7 +89,7 @@ exports.find = async function(ctx) {
}
exports.destroy = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const record = await db.get(ctx.params.recordId)
if (record.modelId !== ctx.params.modelId) {
ctx.throw(400, "Supplied modelId doe not match the record's modelId")
@ -101,7 +101,7 @@ exports.destroy = async function(ctx) {
exports.validate = async function(ctx) {
const errors = await validate({
instanceId: ctx.params.instanceId,
instanceId: ctx.user.instanceId,
modelId: ctx.params.modelId,
record: ctx.request.body,
})

37
packages/server/src/api/controllers/static.js
View file

@ -4,11 +4,15 @@ const {
budibaseAppsDir,
budibaseTempDir,
} = require("../../utilities/budibaseDir")
const env = require("../../environment")
const setBuilderToken = require("../../utilities/builder/setBuilderToken")
const { ANON_LEVEL_ID } = require("../../utilities/accessLevels")
const jwt = require("jsonwebtoken")
exports.serveBuilder = async function(ctx) {
let builderPath = resolve(__dirname, "../../../builder")
ctx.cookies.set("builder:token", env.ADMIN_SECRET)
if (ctx.file === "index.html") {
setBuilderToken(ctx)
}
await send(ctx, ctx.file, { root: ctx.devPath || builderPath })
}
@ -20,6 +24,33 @@ exports.serveApp = async function(ctx) {
"public",
ctx.isAuthenticated ? "main" : "unauthenticated"
)
// only set the appId cookie for /appId .. we COULD check for valid appIds
// but would like to avoid that DB hit
const looksLikeAppId = /^[0-9a-f]{32}$/.test(ctx.params.appId)
if (looksLikeAppId && !ctx.isAuthenticated) {
const anonUser = {
userId: "ANON",
accessLevelId: ANON_LEVEL_ID,
appId: ctx.params.appId,
}
const anonToken = jwt.sign(anonUser, ctx.config.jwtSecret)
ctx.cookies.set("budibase:token", anonToken, {
path: "/",
httpOnly: false,
})
}
await send(ctx, ctx.file || "index.html", { root: ctx.devPath || appPath })
}
exports.serveAppAsset = async function(ctx) {
// default to homedir
const appPath = resolve(
budibaseAppsDir(),
ctx.user.appId,
"public",
ctx.isAuthenticated ? "main" : "unauthenticated"
)
await send(ctx, ctx.file, { root: ctx.devPath || appPath })
}
@ -28,7 +59,7 @@ exports.serveComponentLibrary = async function(ctx) {
// default to homedir
let componentLibraryPath = resolve(
budibaseAppsDir(),
ctx.params.appId,
ctx.user.appId,
"node_modules",
decodeURI(ctx.query.library),
"dist"

10
packages/server/src/api/controllers/user.js
View file

@ -8,7 +8,7 @@ const {
} = require("../../utilities/accessLevels")
exports.fetch = async function(ctx) {
const database = new CouchDB(ctx.params.instanceId)
const database = new CouchDB(ctx.user.instanceId)
const data = await database.query("database/by_type", {
include_docs: true,
key: ["user"],
@ -18,7 +18,7 @@ exports.fetch = async function(ctx) {
}
exports.create = async function(ctx) {
const database = new CouchDB(ctx.params.instanceId)
const database = new CouchDB(ctx.user.instanceId)
const appId = (await database.get("_design/database")).metadata.applicationId
const { username, password, name, accessLevelId } = ctx.request.body
@ -50,7 +50,7 @@ exports.create = async function(ctx) {
app.userInstanceMap = {
...app.userInstanceMap,
[username]: ctx.params.instanceId,
[username]: ctx.user.instanceId,
}
await db.put(app)
@ -66,14 +66,14 @@ exports.create = async function(ctx) {
exports.update = async function() {}
exports.destroy = async function(ctx) {
const database = new CouchDB(ctx.params.instanceId)
const database = new CouchDB(ctx.user.instanceId)
await database.destroy(getUserId(ctx.params.username))
ctx.message = `User ${ctx.params.username} deleted.`
ctx.status = 200
}
exports.find = async function(ctx) {
const database = new CouchDB(ctx.params.instanceId)
const database = new CouchDB(ctx.user.instanceId)
const user = await database.get(getUserId(ctx.params.username))
ctx.body = {
username: user.username,

6
packages/server/src/api/controllers/view.js
View file

@ -3,7 +3,7 @@ const CouchDB = require("../../db")
const controller = {
query: async () => {},
fetch: async ctx => {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const designDoc = await db.get("_design/database")
const response = []
@ -24,7 +24,7 @@ const controller = {
ctx.body = response
},
create: async ctx => {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const newView = ctx.request.body
const designDoc = await db.get("_design/database")
@ -38,7 +38,7 @@ const controller = {
ctx.message = `View ${newView.name} created successfully.`
},
destroy: async ctx => {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
ctx.body = await db.destroy(ctx.params.userId)
},
}

8
packages/server/src/api/controllers/workflow/index.js
View file

@ -2,7 +2,7 @@ const CouchDB = require("../../../db")
const newid = require("../../../db/newid")
exports.create = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const workflow = ctx.request.body
workflow._id = newid()
@ -22,7 +22,7 @@ exports.create = async function(ctx) {
}
exports.update = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const workflow = ctx.request.body
const response = await db.put(workflow)
@ -40,7 +40,7 @@ exports.update = async function(ctx) {
}
exports.fetch = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
const response = await db.query(`database/by_type`, {
key: ["workflow"],
include_docs: true,
@ -69,6 +69,6 @@ exports.fetchActionScript = async function(ctx) {
}
exports.destroy = async function(ctx) {
const db = new CouchDB(ctx.params.instanceId)
const db = new CouchDB(ctx.user.instanceId)
ctx.body = await db.remove(ctx.params.id, ctx.params.rev)
}

12
packages/server/src/api/routes/accesslevel.js
View file

@ -4,11 +4,11 @@ const controller = require("../controllers/accesslevel")
const router = Router()
router
.post("/api/:instanceId/accesslevels", controller.create)
.put("/api/:instanceId/accesslevels", controller.update)
.get("/api/:instanceId/accesslevels", controller.fetch)
.get("/api/:instanceId/accesslevels/:levelId", controller.find)
.delete("/api/:instanceId/accesslevels/:levelId/:rev", controller.destroy)
.patch("/api/:instanceId/accesslevels/:levelId", controller.patch)
.post("/api/accesslevels", controller.create)
.put("/api/accesslevels", controller.update)
.get("/api/accesslevels", controller.fetch)
.get("/api/accesslevels/:levelId", controller.find)
.delete("/api/accesslevels/:levelId/:rev", controller.destroy)
.patch("/api/accesslevels/:levelId", controller.patch)
module.exports = router

2
packages/server/src/api/routes/auth.js
View file

@ -3,6 +3,6 @@ const controller = require("../controllers/auth")
const router = Router()
router.post("/:appId/api/authenticate", controller.authenticate)
router.post("/api/authenticate", controller.authenticate)
module.exports = router

2
packages/server/src/api/routes/instance.js
View file

@ -6,7 +6,7 @@ const { BUILDER } = require("../../utilities/accessLevels")
const router = Router()
router
.post("/api/:applicationId/instances", authorized(BUILDER), controller.create)
.post("/api/instances", authorized(BUILDER), controller.create)
.delete("/api/instances/:instanceId", authorized(BUILDER), controller.destroy)
module.exports = router

14
packages/server/src/api/routes/model.js
View file

@ -1,17 +1,21 @@
const Router = require("@koa/router")
const modelController = require("../controllers/model")
const authorized = require("../../middleware/authorized")
const { BUILDER } = require("../../utilities/accessLevels")
const { BUILDER, READ_MODEL } = require("../../utilities/accessLevels")
const router = Router()
router
.get("/api/:instanceId/models", authorized(BUILDER), modelController.fetch)
.get("/api/:instanceId/models/:id", authorized(BUILDER), modelController.find)
.post("/api/:instanceId/models", authorized(BUILDER), modelController.create)
.get("/api/models", authorized(BUILDER), modelController.fetch)
.get(
"/api/models/:id",
authorized(READ_MODEL, ctx => ctx.params.id),
modelController.find
)
.post("/api/models", authorized(BUILDER), modelController.create)
// .patch("/api/:instanceId/models", controller.update)
.delete(
"/api/:instanceId/models/:modelId/:revId",
"/api/models/:modelId/:revId",
authorized(BUILDER),
modelController.destroy
)

12
packages/server/src/api/routes/record.js
View file

@ -7,28 +7,28 @@ const router = Router()
router
.get(
"/api/:instanceId/:modelId/records",
"/api/:modelId/records",
authorized(READ_MODEL, ctx => ctx.params.modelId),
recordController.fetchModelRecords
)
.get(
"/api/:instanceId/:modelId/records/:recordId",
"/api/:modelId/records/:recordId",
authorized(READ_MODEL, ctx => ctx.params.modelId),
recordController.find
)
.post("/api/:instanceId/records/search", recordController.search)
.post("/api/records/search", recordController.search)
.post(
"/api/:instanceId/:modelId/records",
"/api/:modelId/records",
authorized(WRITE_MODEL, ctx => ctx.params.modelId),
recordController.save
)
.post(
"/api/:instanceId/:modelId/records/validate",
"/api/:modelId/records/validate",
authorized(WRITE_MODEL, ctx => ctx.params.modelId),
recordController.validate
)
.delete(
"/api/:instanceId/:modelId/records/:recordId/:revId",
"/api/:modelId/records/:recordId/:revId",
authorized(WRITE_MODEL, ctx => ctx.params.modelId),
recordController.destroy
)

10
packages/server/src/api/routes/screen.js
View file

@ -6,12 +6,8 @@ const { BUILDER } = require("../../utilities/accessLevels")
const router = Router()
router
.get("/api/:instanceId/screens", authorized(BUILDER), controller.fetch)
.post("/api/:instanceId/screens", authorized(BUILDER), controller.save)
.delete(
"/api/:instanceId/:screenId/:revId",
authorized(BUILDER),
controller.destroy
)
.get("/api/screens", authorized(BUILDER), controller.fetch)
.post("/api/screens", authorized(BUILDER), controller.save)
.delete("/api/:screenId/:revId", authorized(BUILDER), controller.destroy)
module.exports = router

5
packages/server/src/api/routes/static.js
View file

@ -21,7 +21,8 @@ if (env.NODE_ENV !== "production") {
}
router
.get("/:appId/componentlibrary", controller.serveComponentLibrary)
.get("/:appId/:file*", controller.serveApp)
.get("/componentlibrary", controller.serveComponentLibrary)
.get("/assets/:file*", controller.serveAppAsset)
.get("/:appId/:path*", controller.serveApp)
module.exports = router

52
packages/server/src/api/routes/tests/accesslevel.spec.js
View file

@ -36,17 +36,17 @@ describe("/accesslevels", () => {
beforeEach(async () => {
instanceId = (await createInstance(request, appId))._id
model = await createModel(request, instanceId)
view = await createView(request, instanceId)
model = await createModel(request, appId, instanceId)
view = await createView(request, appId, instanceId)
})
describe("create", () => {
it("returns a success message when level is successfully created", async () => {
const res = await request
.post(`/api/${instanceId}/accesslevels`)
.post(`/api/accesslevels`)
.send({ name: "user" })
.set(defaultHeaders)
.set(defaultHeaders(appId, instanceId))
.expect('Content-Type', /json/)
.expect(200)
@ -62,17 +62,17 @@ describe("/accesslevels", () => {
it("should list custom levels, plus 2 default levels", async () => {
const createRes = await request
.post(`/api/${instanceId}/accesslevels`)
.post(`/api/accesslevels`)
.send({ name: "user", permissions: [ { itemId: model._id, name: READ_MODEL }] })
.set(defaultHeaders)
.set(defaultHeaders(appId, instanceId))
.expect('Content-Type', /json/)
.expect(200)
const customLevel = createRes.body
const res = await request
.get(`/api/${instanceId}/accesslevels`)
.set(defaultHeaders)
.get(`/api/accesslevels`)
.set(defaultHeaders(appId, instanceId))
.expect('Content-Type', /json/)
.expect(200)
@ -95,22 +95,22 @@ describe("/accesslevels", () => {
describe("destroy", () => {
it("should delete custom access level", async () => {
const createRes = await request
.post(`/api/${instanceId}/accesslevels`)
.post(`/api/accesslevels`)
.send({ name: "user", permissions: [ { itemId: model._id, name: READ_MODEL } ] })
.set(defaultHeaders)
.set(defaultHeaders(appId, instanceId))
.expect('Content-Type', /json/)
.expect(200)
const customLevel = createRes.body
await request
.delete(`/api/${instanceId}/accesslevels/${customLevel._id}/${customLevel._rev}`)
.set(defaultHeaders)
.delete(`/api/accesslevels/${customLevel._id}/${customLevel._rev}`)
.set(defaultHeaders(appId, instanceId))
.expect(200)
await request
.get(`/api/${instanceId}/accesslevels/${customLevel._id}`)
.set(defaultHeaders)
.get(`/api/accesslevels/${customLevel._id}`)
.set(defaultHeaders(appId, instanceId))
.expect(404)
})
})
@ -118,27 +118,27 @@ describe("/accesslevels", () => {
describe("patch", () => {
it("should add given permissions", async () => {
const createRes = await request
.post(`/api/${instanceId}/accesslevels`)
.post(`/api/accesslevels`)
.send({ name: "user", permissions: [ { itemId: model._id, name: READ_MODEL }] })
.set(defaultHeaders)
.set(defaultHeaders(appId, instanceId))
.expect('Content-Type', /json/)
.expect(200)
const customLevel = createRes.body
await request
.patch(`/api/${instanceId}/accesslevels/${customLevel._id}`)
.patch(`/api/accesslevels/${customLevel._id}`)
.send({
_rev: customLevel._rev,
addedPermissions: [ { itemId: model._id, name: WRITE_MODEL } ]
})
.set(defaultHeaders)
.set(defaultHeaders(appId, instanceId))
.expect('Content-Type', /json/)
.expect(200)
const finalRes = await request
.get(`/api/${instanceId}/accesslevels/${customLevel._id}`)
.set(defaultHeaders)
.get(`/api/accesslevels/${customLevel._id}`)
.set(defaultHeaders(appId, instanceId))
.expect(200)
expect(finalRes.body.permissions.length).toBe(2)
@ -148,7 +148,7 @@ describe("/accesslevels", () => {
it("should remove given permissions", async () => {
const createRes = await request
.post(`/api/${instanceId}/accesslevels`)
.post(`/api/accesslevels`)
.send({
name: "user",
permissions: [
@ -156,25 +156,25 @@ describe("/accesslevels", () => {
{ itemId: model._id, name: WRITE_MODEL },
]
})
.set(defaultHeaders)
.set(defaultHeaders(appId, instanceId))
.expect('Content-Type', /json/)
.expect(200)
const customLevel = createRes.body
await request
.patch(`/api/${instanceId}/accesslevels/${customLevel._id}`)
.patch(`/api/accesslevels/${customLevel._id}`)
.send({
_rev: customLevel._rev,
removedPermissions: [ { itemId: model._id, name: WRITE_MODEL }]
})
.set(defaultHeaders)
.set(defaultHeaders(appId, instanceId))
.expect('Content-Type', /json/)
.expect(200)
const finalRes = await request
.get(`/api/${instanceId}/accesslevels/${customLevel._id}`)
.set(defaultHeaders)
.get(`/api/accesslevels/${customLevel._id}`)
.set(defaultHeaders(appId, instanceId))
.expect(200)
expect(finalRes.body.permissions.length).toBe(1)

12
packages/server/src/api/routes/tests/application.spec.js
View file

@ -34,7 +34,7 @@ describe("/applications", () => {
const res = await request
.post("/api/applications")
.send({ name: "My App" })
.set(defaultHeaders)
.set(defaultHeaders())
.expect('Content-Type', /json/)
.expect(200)
expect(res.res.statusMessage).toEqual("Application My App created successfully")
@ -49,6 +49,7 @@ describe("/applications", () => {
method: "POST",
url: `/api/applications`,
instanceId: instance._id,
appId: otherApplication._id,
body: { name: "My App" }
})
})
@ -63,7 +64,7 @@ describe("/applications", () => {
const res = await request
.get("/api/applications")
.set(defaultHeaders)
.set(defaultHeaders())
.expect('Content-Type', /json/)
.expect(200)
@ -77,13 +78,13 @@ describe("/applications", () => {
const blah = await request
.post("/api/applications")
.send({ name: "app2", clientId: "new_client"})
.set(defaultHeaders)
.set(defaultHeaders())
.expect('Content-Type', /json/)
//.expect(200)
const client1Res = await request
.get(`/api/applications?clientId=${TEST_CLIENT_ID}`)
.set(defaultHeaders)
.set(defaultHeaders())
.expect('Content-Type', /json/)
.expect(200)
@ -92,7 +93,7 @@ describe("/applications", () => {
const client2Res = await request
.get(`/api/applications?clientId=new_client`)
.set(defaultHeaders)
.set(defaultHeaders())
.expect('Content-Type', /json/)
.expect(200)
@ -109,6 +110,7 @@ describe("/applications", () => {
method: "GET",
url: `/api/applications`,
instanceId: instance._id,
appId: otherApplication._id,
})
})
})

88
packages/server/src/api/routes/tests/couchTestUtils.js
View file

@ -4,8 +4,12 @@ const supertest = require("supertest")
const app = require("../../../app")
const {
POWERUSER_LEVEL_ID,
ANON_LEVEL_ID,
BUILDER_LEVEL_ID,
generateAdminPermissions,
} = require("../../../utilities/accessLevels")
const jwt = require("jsonwebtoken")
const env = require("../../../environment")
const TEST_CLIENT_ID = "test-client-id"
@ -20,13 +24,23 @@ exports.supertest = async () => {
return { request, server }
}
exports.defaultHeaders = {
Accept: "application/json",
Cookie: ["builder:token=test-admin-secret"],
"x-user-agent": "Budibase Builder",
exports.defaultHeaders = (appId, instanceId) => {
const builderUser = {
userId: "BUILDER",
accessLevelId: BUILDER_LEVEL_ID,
appId,
instanceId,
}
const builderToken = jwt.sign(builderUser, env.JWT_SECRET)
return {
Accept: "application/json",
Cookie: [`builder:token=${builderToken}`],
}
}
exports.createModel = async (request, instanceId, model) => {
exports.createModel = async (request, appId, instanceId, model) => {
model = model || {
name: "TestModel",
type: "model",
@ -42,20 +56,20 @@ exports.createModel = async (request, instanceId, model) => {
}
const res = await request
.post(`/api/${instanceId}/models`)
.set(exports.defaultHeaders)
.post(`/api/models`)
.set(exports.defaultHeaders(appId, instanceId))
.send(model)
return res.body
}
exports.createView = async (request, instanceId, view) => {
exports.createView = async (request, appId, instanceId, view) => {
view = view || {
map: "function(doc) { emit(doc[doc.key], doc._id); } ",
}
const res = await request
.post(`/api/${instanceId}/views`)
.set(exports.defaultHeaders)
.post(`/api/views`)
.set(exports.defaultHeaders(appId, instanceId))
.send(view)
return res.body
}
@ -65,10 +79,10 @@ exports.createClientDatabase = async id => await create(id || TEST_CLIENT_ID)
exports.createApplication = async (request, name = "test_application") => {
const res = await request
.post("/api/applications")
.set(exports.defaultHeaders)
.send({
name,
})
.set(exports.defaultHeaders())
return res.body
}
@ -76,23 +90,24 @@ exports.destroyClientDatabase = async () => await destroy(TEST_CLIENT_ID)
exports.createInstance = async (request, appId) => {
const res = await request
.post(`/api/${appId}/instances`)
.set(exports.defaultHeaders)
.post(`/api/instances`)
.send({
name: "test-instance",
name: "test-instance2",
})
.set(exports.defaultHeaders(appId))
return res.body
}
exports.createUser = async (
request,
appId,
instanceId,
username = "babs",
password = "babs_password"
) => {
const res = await request
.post(`/api/${instanceId}/users`)
.set(exports.defaultHeaders)
.post(`/api/users`)
.set(exports.defaultHeaders(appId, instanceId))
.send({
name: "Bill",
username,
@ -104,6 +119,7 @@ exports.createUser = async (
const createUserWithOnePermission = async (
request,
appId,
instanceId,
permName,
itemId
@ -115,17 +131,19 @@ const createUserWithOnePermission = async (
return await createUserWithPermissions(
request,
appId,
instanceId,
permissions,
"onePermOnlyUser"
)
}
const createUserWithAdminPermissions = async (request, instanceId) => {
const createUserWithAdminPermissions = async (request, appId, instanceId) => {
let permissions = await generateAdminPermissions(instanceId)
return await createUserWithPermissions(
request,
appId,
instanceId,
permissions,
"adminUser"
@ -134,6 +152,7 @@ const createUserWithAdminPermissions = async (request, instanceId) => {
const createUserWithAllPermissionExceptOne = async (
request,
appId,
instanceId,
permName,
itemId
@ -145,6 +164,7 @@ const createUserWithAllPermissionExceptOne = async (
return await createUserWithPermissions(
request,
appId,
instanceId,
permissions,
"allPermsExceptOneUser"
@ -153,19 +173,20 @@ const createUserWithAllPermissionExceptOne = async (
const createUserWithPermissions = async (
request,
appId,
instanceId,
permissions,
username
) => {
const accessRes = await request
.post(`/api/${instanceId}/accesslevels`)
.post(`/api/accesslevels`)
.send({ name: "TestLevel", permissions })
.set(exports.defaultHeaders)
.set(exports.defaultHeaders(appId, instanceId))
const password = `password_${username}`
await request
.post(`/api/${instanceId}/users`)
.set(exports.defaultHeaders)
.post(`/api/users`)
.set(exports.defaultHeaders(appId, instanceId))
.send({
name: username,
username,
@ -173,11 +194,20 @@ const createUserWithPermissions = async (
accessLevelId: accessRes.body._id,
})
const db = new CouchDB(instanceId)
const designDoc = await db.get("_design/database")
//const db = new CouchDB(instanceId)
//const designDoc = await db.get("_design/database")
const anonUser = {
userId: "ANON",
accessLevelId: ANON_LEVEL_ID,
appId: appId,
}
const anonToken = jwt.sign(anonUser, env.JWT_SECRET)
const loginResult = await request
.post(`/${designDoc.metadata.applicationId}/api/authenticate`)
.post(`/api/authenticate`)
.set({ Cookie: `budibase:token=${anonToken}` })
.send({ username, password })
// returning necessary request headers
@ -192,12 +222,14 @@ exports.testPermissionsForEndpoint = async ({
method,
url,
body,
appId,
instanceId,
permissionName,
itemId,
}) => {
const headers = await createUserWithOnePermission(
request,
appId,
instanceId,
permissionName,
itemId
@ -209,6 +241,7 @@ exports.testPermissionsForEndpoint = async ({
const noPermsHeaders = await createUserWithAllPermissionExceptOne(
request,
appId,
instanceId,
permissionName,
itemId
@ -224,9 +257,14 @@ exports.builderEndpointShouldBlockNormalUsers = async ({
method,
url,
body,
appId,
instanceId,
}) => {
const headers = await createUserWithAdminPermissions(request, instanceId)
const headers = await createUserWithAdminPermissions(
request,
appId,
instanceId
)
await createRequest(request, method, url, body)
.set(headers)

6
packages/server/src/api/routes/tests/instance.spec.js
View file

@ -24,9 +24,9 @@ describe("/instances", () => {
it("returns a success message when the instance database is successfully created", async () => {
const res = await request
.post(`/api/${TEST_APP_ID}/instances`)
.post(`/api/instances`)
.send({ name: "test-instance" })
.set(defaultHeaders)
.set(defaultHeaders(TEST_APP_ID))
.expect('Content-Type', /json/)
.expect(200)
@ -42,7 +42,7 @@ describe("/instances", () => {
const instance = await createInstance(request, TEST_APP_ID);
const res = await request
.delete(`/api/instances/${instance._id}`)
.set(defaultHeaders)
.set(defaultHeaders(TEST_APP_ID))
.expect(200)
expect(res.res.statusMessage).toEqual(`Instance Database ${instance._id} successfully destroyed.`);

31
packages/server/src/api/routes/tests/model.spec.js
View file

@ -33,7 +33,7 @@ describe("/models", () => {
it("returns a success message when the model is successfully created", done => {
request
.post(`/api/${instance._id}/models`)
.post(`/api/models`)
.send({
name: "TestModel",
key: "name",
@ -41,7 +41,7 @@ describe("/models", () => {
name: { type: "string" }
}
})
.set(defaultHeaders)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)
.end(async (err, res) => {
@ -55,8 +55,9 @@ describe("/models", () => {
await builderEndpointShouldBlockNormalUsers({
request,
method: "POST",
url: `/api/${instance._id}/models`,
url: `/api/models`,
instanceId: instance._id,
appId: app._id,
body: {
name: "TestModel",
key: "name",
@ -73,13 +74,13 @@ describe("/models", () => {
beforeEach(async () => {
instance = await createInstance(request, app._id)
testModel = await createModel(request, instance._id, testModel)
testModel = await createModel(request, app._id, instance._id, testModel)
});
it("returns all the models for that instance in the response body", done => {
request
.get(`/api/${instance._id}/models`)
.set(defaultHeaders)
.get(`/api/models`)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)
.end(async (_, res) => {
@ -94,8 +95,9 @@ describe("/models", () => {
await builderEndpointShouldBlockNormalUsers({
request,
method: "GET",
url: `/api/${instance._id}/models`,
url: `/api/models`,
instanceId: instance._id,
appId: app._id,
})
})
});
@ -105,7 +107,7 @@ describe("/models", () => {
beforeEach(async () => {
instance = await createInstance(request, app._id)
testModel = await createModel(request, instance._id, testModel)
testModel = await createModel(request, app._id, instance._id, testModel)
});
afterEach(() => {
@ -114,8 +116,8 @@ describe("/models", () => {
it("returns a success response when a model is deleted.", async done => {
request
.delete(`/api/${instance._id}/models/${testModel._id}/${testModel._rev}`)
.set(defaultHeaders)
.delete(`/api/models/${testModel._id}/${testModel._rev}`)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)
.end(async (_, res) => {
@ -125,7 +127,7 @@ describe("/models", () => {
})
it("deletes linked references to the model after deletion", async done => {
const linkedModel = await createModel(request, instance._id, {
const linkedModel = await createModel(request, app._id, instance._id, {
name: "LinkedModel",
type: "model",
key: "name",
@ -147,8 +149,8 @@ describe("/models", () => {
})
request
.delete(`/api/${instance._id}/models/${testModel._id}/${testModel._rev}`)
.set(defaultHeaders)
.delete(`/api/models/${testModel._id}/${testModel._rev}`)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)
.end(async (_, res) => {
@ -163,8 +165,9 @@ describe("/models", () => {
await builderEndpointShouldBlockNormalUsers({
request,
method: "DELETE",
url: `/api/${instance._id}/models/${testModel._id}/${testModel._rev}`,
url: `/api/models/${testModel._id}/${testModel._rev}`,
instanceId: instance._id,
appId: app._id,
})
})

34
packages/server/src/api/routes/tests/record.spec.js
View file

@ -27,7 +27,7 @@ describe("/records", () => {
beforeEach(async () => {
instance = await createInstance(request, app._id)
model = await createModel(request, instance._id)
model = await createModel(request, app._id, instance._id)
record = {
name: "Test Contact",
status: "new",
@ -39,9 +39,9 @@ describe("/records", () => {
const createRecord = async r =>
await request
.post(`/api/${instance._id}/${model._id}/records`)
.post(`/api/${model._id}/records`)
.send(r || record)
.set(defaultHeaders)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)
@ -57,14 +57,14 @@ describe("/records", () => {
const existing = rec.body
const res = await request
.post(`/api/${instance._id}/${model._id}/records`)
.post(`/api/${model._id}/records`)
.send({
_id: existing._id,
_rev: existing._rev,
modelId: model._id,
name: "Updated Name",
})
.set(defaultHeaders)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)
@ -77,8 +77,8 @@ describe("/records", () => {
const existing = rec.body
const res = await request
.get(`/api/${instance._id}/${model._id}/records/${existing._id}`)
.set(defaultHeaders)
.get(`/api/${model._id}/records/${existing._id}`)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)
@ -100,8 +100,8 @@ describe("/records", () => {
await createRecord(newRecord)
const res = await request
.get(`/api/${instance._id}/${model._id}/records`)
.set(defaultHeaders)
.get(`/api/${model._id}/records`)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)
@ -122,8 +122,8 @@ describe("/records", () => {
const recordIds = [record.body._id, secondRecord.body._id]
const res = await request
.post(`/api/${instance._id}/records/search`)
.set(defaultHeaders)
.post(`/api/records/search`)
.set(defaultHeaders(app._id, instance._id))
.send({
keys: recordIds
})
@ -137,8 +137,8 @@ describe("/records", () => {
it("load should return 404 when record does not exist", async () => {
await createRecord()
await request
.get(`/api/${instance._id}/${model._id}/records/not-a-valid-id`)
.set(defaultHeaders)
.get(`/api/${model._id}/records/not-a-valid-id`)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(404)
})
@ -147,9 +147,9 @@ describe("/records", () => {
describe("validate", () => {
it("should return no errors on valid record", async () => {
const result = await request
.post(`/api/${instance._id}/${model._id}/records/validate`)
.post(`/api/${model._id}/records/validate`)
.send({ name: "ivan" })
.set(defaultHeaders)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)
@ -159,9 +159,9 @@ describe("/records", () => {
it("should errors on invalid record", async () => {
const result = await request
.post(`/api/${instance._id}/${model._id}/records/validate`)
.post(`/api/${model._id}/records/validate`)
.send({ name: 1 })
.set(defaultHeaders)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)

20
packages/server/src/api/routes/tests/user.spec.js
View file

@ -36,11 +36,11 @@ describe("/users", () => {
describe("fetch", () => {
it("returns a list of users from an instance db", async () => {
await createUser(request, instance._id, "brenda", "brendas_password")
await createUser(request, instance._id, "pam", "pam_password")
await createUser(request, app._id, instance._id, "brenda", "brendas_password")
await createUser(request, app._id, instance._id, "pam", "pam_password")
const res = await request
.get(`/api/${instance._id}/users`)
.set(defaultHeaders)
.get(`/api/users`)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)
@ -50,12 +50,13 @@ describe("/users", () => {
})
it("should apply authorization to endpoint", async () => {
await createUser(request, instance._id, "brenda", "brendas_password")
await createUser(request, app._id, instance._id, "brenda", "brendas_password")
await testPermissionsForEndpoint({
request,
method: "GET",
url: `/api/${instance._id}/users`,
url: `/api/users`,
instanceId: instance._id,
appId: app._id,
permissionName: LIST_USERS,
})
})
@ -66,8 +67,8 @@ describe("/users", () => {
it("returns a success message when a user is successfully created", async () => {
const res = await request
.post(`/api/${instance._id}/users`)
.set(defaultHeaders)
.post(`/api/users`)
.set(defaultHeaders(app._id, instance._id))
.send({ name: "Bill", username: "bill", password: "bills_password", accessLevelId: POWERUSER_LEVEL_ID })
.expect(200)
.expect('Content-Type', /json/)
@ -81,8 +82,9 @@ describe("/users", () => {
request,
method: "POST",
body: { name: "brandNewUser", username: "brandNewUser", password: "yeeooo", accessLevelId: POWERUSER_LEVEL_ID },
url: `/api/${instance._id}/users`,
url: `/api/users`,
instanceId: instance._id,
appId: app._id,
permissionName: USER_MANAGEMENT,
})
})

10
packages/server/src/api/routes/tests/view.spec.js
View file

@ -30,7 +30,7 @@ describe("/views", () => {
const createView = async () =>
await request
.post(`/api/${instance._id}/views`)
.post(`/api/views`)
.send({
name: "TestView",
map: `function(doc) {
@ -40,7 +40,7 @@ describe("/views", () => {
}`,
reduce: `function(keys, values) { }`
})
.set(defaultHeaders)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)
@ -56,14 +56,14 @@ describe("/views", () => {
describe("fetch", () => {
beforeEach(async () => {
model = await createModel(request, instance._id);
model = await createModel(request, app._id, instance._id);
});
it("should only return custom views", async () => {
const view = await createView()
const res = await request
.get(`/api/${instance._id}/views`)
.set(defaultHeaders)
.get(`/api/views`)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)
expect(res.body.length).toBe(1)

25
packages/server/src/api/routes/tests/workflow.spec.js
View file

@ -63,8 +63,8 @@ describe("/workflows", () => {
describe("create", () => {
it("returns a success message when the workflow is successfully created", async () => {
const res = await request
.post(`/api/${instance._id}/workflows`)
.set(defaultHeaders)
.post(`/api/workflows`)
.set(defaultHeaders(app._id, instance._id))
.send(TEST_WORKFLOW)
.expect('Content-Type', /json/)
.expect(200)
@ -77,8 +77,9 @@ describe("/workflows", () => {
await builderEndpointShouldBlockNormalUsers({
request,
method: "POST",
url: `/api/${instance._id}/workflows`,
url: `/api/workflows`,
instanceId: instance._id,
appId: app._id,
body: TEST_WORKFLOW
})
})
@ -92,8 +93,8 @@ describe("/workflows", () => {
workflow.name = "Updated Name";
const res = await request
.put(`/api/${instance._id}/workflows`)
.set(defaultHeaders)
.put(`/api/workflows`)
.set(defaultHeaders(app._id, instance._id))
.send(workflow)
.expect('Content-Type', /json/)
.expect(200)
@ -107,8 +108,8 @@ describe("/workflows", () => {
it("return all the workflows for an instance", async () => {
await createWorkflow();
const res = await request
.get(`/api/${instance._id}/workflows`)
.set(defaultHeaders)
.get(`/api/workflows`)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)
@ -119,8 +120,9 @@ describe("/workflows", () => {
await builderEndpointShouldBlockNormalUsers({
request,
method: "GET",
url: `/api/${instance._id}/workflows`,
url: `/api/workflows`,
instanceId: instance._id,
appId: app._id,
})
})
})
@ -129,8 +131,8 @@ describe("/workflows", () => {
it("deletes a workflow by its ID", async () => {
await createWorkflow();
const res = await request
.delete(`/api/${instance._id}/workflows/${workflow.id}/${workflow.rev}`)
.set(defaultHeaders)
.delete(`/api/workflows/${workflow.id}/${workflow.rev}`)
.set(defaultHeaders(app._id, instance._id))
.expect('Content-Type', /json/)
.expect(200)
@ -142,8 +144,9 @@ describe("/workflows", () => {
await builderEndpointShouldBlockNormalUsers({
request,
method: "DELETE",
url: `/api/${instance._id}/workflows/${workflow.id}/${workflow._rev}`,
url: `/api/workflows/${workflow.id}/${workflow._rev}`,
instanceId: instance._id,
appId: app._id,
})
})
})

16
packages/server/src/api/routes/user.js
View file

@ -6,19 +6,11 @@ const { USER_MANAGEMENT, LIST_USERS } = require("../../utilities/accessLevels")
const router = Router()
router
.get("/api/:instanceId/users", authorized(LIST_USERS), controller.fetch)
.get(
"/api/:instanceId/users/:username",
authorized(USER_MANAGEMENT),
controller.find
)
.post(
"/api/:instanceId/users",
authorized(USER_MANAGEMENT),
controller.create
)
.get("/api/users", authorized(LIST_USERS), controller.fetch)
.get("/api/users/:username", authorized(USER_MANAGEMENT), controller.find)
.post("/api/users", authorized(USER_MANAGEMENT), controller.create)
.delete(
"/api/:instanceId/users/:username",
"/api/users/:username",
authorized(USER_MANAGEMENT),
controller.destroy
)

6
packages/server/src/api/routes/view.js
View file

@ -8,13 +8,13 @@ const router = Router()
router
.get(
"/api/:instanceId/views/:viewName",
"/api/views/:viewName",
authorized(READ_VIEW, ctx => ctx.params.viewName),
recordController.fetchView
)
.get("/api/:instanceId/views", authorized(BUILDER), viewController.fetch)
.get("/api/views", authorized(BUILDER), viewController.fetch)
// .patch("/api/:databaseId/views", controller.update);
// .delete("/api/:instanceId/views/:viewId/:revId", controller.destroy);
.post("/api/:instanceId/views", authorized(BUILDER), viewController.create)
.post("/api/views", authorized(BUILDER), viewController.create)
module.exports = router

14
packages/server/src/api/routes/workflow.js
View file

@ -6,20 +6,16 @@ const { BUILDER } = require("../../utilities/accessLevels")
const router = Router()
router
.get("/api/:instanceId/workflows", authorized(BUILDER), controller.fetch)
.get("/api/workflows", authorized(BUILDER), controller.fetch)
.get("/api/workflows/:id", authorized(BUILDER), controller.find)
.get(
"/api/:instanceId/workflows/:id/:action",
"/api/workflows/:id/:action",
authorized(BUILDER),
controller.fetchActionScript
)
.put("/api/:instanceId/workflows", authorized(BUILDER), controller.update)
.post("/api/:instanceId/workflows", authorized(BUILDER), controller.create)
.put("/api/workflows", authorized(BUILDER), controller.update)
.post("/api/workflows", authorized(BUILDER), controller.create)
.post("/api/workflows/action", controller.executeAction)
.delete(
"/api/:instanceId/workflows/:id/:rev",
authorized(BUILDER),
controller.destroy
)
.delete("/api/workflows/:id/:rev", authorized(BUILDER), controller.destroy)
module.exports = router

34
packages/server/src/middleware/authenticated.js
View file

@ -1,10 +1,11 @@
const jwt = require("jsonwebtoken")
const STATUS_CODES = require("../utilities/statusCodes")
const env = require("../environment")
const accessLevelController = require("../api/controllers/accesslevel")
const {
ADMIN_LEVEL_ID,
POWERUSER_LEVEL_ID,
BUILDER_LEVEL_ID,
ANON_LEVEL_ID,
} = require("../utilities/accessLevels")
module.exports = async (ctx, next) => {
@ -15,16 +16,21 @@ module.exports = async (ctx, next) => {
const appToken = ctx.cookies.get("budibase:token")
const builderToken = ctx.cookies.get("builder:token")
const isBuilderAgent = ctx.headers["x-user-agent"] === "Budibase Builder"
// all admin api access should auth with buildertoken and 'Budibase Builder user agent
const shouldAuthAsBuilder = isBuilderAgent && builderToken
if (shouldAuthAsBuilder) {
const builderTokenValid = builderToken === env.ADMIN_SECRET
ctx.isAuthenticated = builderTokenValid
ctx.isBuilder = builderTokenValid
if (builderToken) {
try {
const jwtPayload = jwt.verify(builderToken, ctx.config.jwtSecret)
ctx.isAuthenticated = jwtPayload.accessLevelId === BUILDER_LEVEL_ID
ctx.user = {
...jwtPayload,
accessLevel: await getAccessLevel(
jwtPayload.instanceId,
jwtPayload.accessLevelId
),
}
} catch (_) {
// empty: do nothing
}
await next()
return
@ -46,7 +52,7 @@ module.exports = async (ctx, next) => {
jwtPayload.accessLevelId
),
}
ctx.isAuthenticated = true
ctx.isAuthenticated = ctx.user.accessLevelId !== ANON_LEVEL_ID
} catch (err) {
ctx.throw(err.status || STATUS_CODES.FORBIDDEN, err.text)
}
@ -57,7 +63,9 @@ module.exports = async (ctx, next) => {
const getAccessLevel = async (instanceId, accessLevelId) => {
if (
accessLevelId === POWERUSER_LEVEL_ID ||
accessLevelId === ADMIN_LEVEL_ID
accessLevelId === ADMIN_LEVEL_ID ||
accessLevelId === BUILDER_LEVEL_ID ||
accessLevelId === ANON_LEVEL_ID
) {
return {
_id: accessLevelId,
@ -69,6 +77,8 @@ const getAccessLevel = async (instanceId, accessLevelId) => {
const findAccessContext = {
params: {
levelId: accessLevelId,
},
user: {
instanceId,
},
}

11
packages/server/src/middleware/authorized.js
View file

@ -2,6 +2,7 @@ const {
adminPermissions,
ADMIN_LEVEL_ID,
POWERUSER_LEVEL_ID,
BUILDER_LEVEL_ID,
BUILDER,
} = require("../utilities/accessLevels")
@ -10,7 +11,11 @@ module.exports = (permName, getItemId) => async (ctx, next) => {
ctx.throw(403, "Session not authenticated")
}
if (ctx.isBuilder) {
if (!ctx.user) {
ctx.throw(403, "User not found")
}
if (ctx.user.accessLevel._id === BUILDER_LEVEL_ID) {
await next()
return
}
@ -20,10 +25,6 @@ module.exports = (permName, getItemId) => async (ctx, next) => {
return
}
if (!ctx.user) {
ctx.throw(403, "User not found")
}
const permissionId = ({ name, itemId }) => name + (itemId ? `-${itemId}` : "")
if (ctx.user.accessLevel._id === ADMIN_LEVEL_ID) {

11
packages/server/src/utilities/accessLevels.js
View file

@ -5,6 +5,8 @@ const workflowController = require("../api/controllers/workflow")
// Access Level IDs
const ADMIN_LEVEL_ID = "ADMIN"
const POWERUSER_LEVEL_ID = "POWER_USER"
const BUILDER_LEVEL_ID = "BUILDER"
const ANON_LEVEL_ID = "ANON"
// Permissions
const READ_MODEL = "read-model"
@ -28,7 +30,7 @@ const generateAdminPermissions = async instanceId => [
const generatePowerUserPermissions = async instanceId => {
const fetchModelsCtx = {
params: {
user: {
instanceId,
},
}
@ -36,7 +38,7 @@ const generatePowerUserPermissions = async instanceId => {
const models = fetchModelsCtx.body
const fetchViewsCtx = {
params: {
user: {
instanceId,
},
}
@ -44,7 +46,7 @@ const generatePowerUserPermissions = async instanceId => {
const views = fetchViewsCtx.body
const fetchWorkflowsCtx = {
params: {
user: {
instanceId,
},
}
@ -83,6 +85,8 @@ const generatePowerUserPermissions = async instanceId => {
module.exports = {
ADMIN_LEVEL_ID,
POWERUSER_LEVEL_ID,
BUILDER_LEVEL_ID,
ANON_LEVEL_ID,
READ_MODEL,
WRITE_MODEL,
READ_VIEW,
@ -90,6 +94,7 @@ module.exports = {
USER_MANAGEMENT,
BUILDER,
LIST_USERS,
adminPermissions,
generateAdminPermissions,
generatePowerUserPermissions,
}

6
packages/server/src/utilities/builder/buildPage.js
View file

@ -45,18 +45,16 @@ const copyClientLib = async (appPath, pageName) => {
const buildIndexHtml = async (config, appId, pageName, appPath, pkg) => {
const appPublicPath = publicPath(appPath, pageName)
const appRootPath = rootPath(config, appId)
const stylesheetUrl = s =>
s.startsWith("http") ? s : `/${rootPath(config, appId)}/${s}`
const templateObj = {
title: pkg.page.title || "Budibase App",
favicon: `${appRootPath}/${pkg.page.favicon || "/_shared/favicon.png"}`,
favicon: `${pkg.page.favicon || "/_shared/favicon.png"}`,
stylesheets: (pkg.page.stylesheets || []).map(stylesheetUrl),
screenStyles: pkg.screens.filter(s => s._css).map(s => s._css),
pageStyle: pkg.page._css,
appRootPath,
}
const indexHtmlTemplate = await readFile(
@ -74,7 +72,6 @@ const buildIndexHtml = async (config, appId, pageName, appPath, pkg) => {
const buildFrontendAppDefinition = async (config, appId, pageName, pkg) => {
const appPath = appPackageFolder(config, appId)
const appPublicPath = publicPath(appPath, pageName)
const appRootPath = rootPath(config, appId)
const filename = join(appPublicPath, "clientFrontendDefinition.js")
@ -89,7 +86,6 @@ const buildFrontendAppDefinition = async (config, appId, pageName, pkg) => {
}
const clientUiDefinition = JSON.stringify({
appRootPath: appRootPath,
page: pkg.page,
screens: pkg.screens,
libraries: [

8
packages/server/src/utilities/builder/index.template.html
View file

@ -24,15 +24,15 @@
{{ /each }}
{{ each(options.screenStyles) }}
<link rel='stylesheet' href='{{ appRootPath }}{{ @this }}'>
<link rel='stylesheet' href='/assets{{ @this }}'>
{{ /each }}
{{ if(options.pageStyle) }}
<link rel='stylesheet' href='{{ appRootPath }}{{ pageStyle }}'>
<link rel='stylesheet' href='/assets{{ pageStyle }}'>
{{ /if }}
<script src='{{ appRootPath }}/clientFrontendDefinition.js'></script>
<script src='{{ appRootPath }}/budibase-client.js'></script>
<script src='/assets/clientFrontendDefinition.js'></script>
<script src='/assets/budibase-client.js'></script>
</head>

19
packages/server/src/utilities/builder/setBuilderToken.js Normal file
View file

@ -0,0 +1,19 @@
const { BUILDER_LEVEL_ID } = require("../accessLevels")
const jwt = require("jsonwebtoken")
module.exports = (ctx, appId, instanceId) => {
const builderUser = {
userId: "BUILDER",
accessLevelId: BUILDER_LEVEL_ID,
instanceId,
appId,
}
const token = jwt.sign(builderUser, ctx.config.jwtSecret, {
expiresIn: "30 days",
})
var expiry = new Date()
expiry.setDate(expiry.getDate() + 30)
ctx.cookies.set("builder:token", token, { expires: expiry, httpOnly: false })
}

1
packages/standard-components/public/clientAppDefinition.js
View file

@ -98,6 +98,5 @@ window["##BUDIBASE_APPDEFINITION##"] = {
nodeId: 0,
},
componentLibraries: ["budibase-standard-components"],
appRootPath: "/testApp2",
props: {},
}

3
packages/standard-components/src/DataChart.svelte
View file

@ -8,7 +8,6 @@
fcRoot(FusionCharts, Charts, FusionTheme)
export let _bb
export let _instanceId
export let model
export let type = "column2d"
@ -25,7 +24,7 @@
}
async function fetchData() {
const FETCH_RECORDS_URL = `/api/${_instanceId}/views/all_${model}`
const FETCH_RECORDS_URL = `/api/views/all_${model}`
const response = await _bb.api.get(FETCH_RECORDS_URL)
if (response.status === 200) {
const json = await response.json()

7
packages/standard-components/src/DataForm.svelte
View file

@ -2,7 +2,6 @@
import { onMount } from "svelte"
export let _bb
export let _instanceId
export let model
let username
@ -21,19 +20,19 @@
$: fields = Object.keys(schema)
async function fetchModel() {
const FETCH_MODEL_URL = `/api/${_instanceId}/models/${model}`
const FETCH_MODEL_URL = `/api/models/${model}`
const response = await _bb.api.get(FETCH_MODEL_URL)
modelDef = await response.json()
schema = modelDef.schema
}
async function save() {
const SAVE_RECORD_URL = `/api/${_instanceId}/${model}/records`
const SAVE_RECORD_URL = `/api/${model}/records`
const response = await _bb.api.post(SAVE_RECORD_URL, newModel)
const json = await response.json()
store.update(state => {
state[model._id] = [...state[model], json]
state[model] = state[model] ? [...state[model], json] : [json]
return state
})
}

3
packages/standard-components/src/DataList.svelte
View file

@ -2,7 +2,6 @@
import { onMount } from "svelte"
export let _bb
export let _instanceId
export let model
export let layout = "list"
@ -12,7 +11,7 @@
async function fetchData() {
if (!model || !model.length) return
const FETCH_RECORDS_URL = `/api/${_instanceId}/views/all_${model}`
const FETCH_RECORDS_URL = `/api/views/all_${model}`
const response = await _bb.api.get(FETCH_RECORDS_URL)
if (response.status === 200) {
const json = await response.json()

3
packages/standard-components/src/DataTable.svelte
View file

@ -3,14 +3,13 @@
export let _bb
export let onLoad
export let _instanceId
export let model
let headers = []
let store = _bb.store
async function fetchData() {
const FETCH_RECORDS_URL = `/api/${_instanceId}/views/all_${model}`
const FETCH_RECORDS_URL = `/api/views/all_${model}`
const response = await _bb.api.get(FETCH_RECORDS_URL)
if (response.status === 200) {

3
packages/standard-components/src/List.svelte
View file

@ -2,7 +2,6 @@
import { onMount } from "svelte"
export let _bb
export let _instanceId
export let model
export let layout = "list"
@ -13,7 +12,7 @@
async function fetchData() {
if (!model || !model.length) return
const FETCH_RECORDS_URL = `/api/${_instanceId}/views/all_${model}`
const FETCH_RECORDS_URL = `/api/views/all_${model}`
const response = await _bb.api.get(FETCH_RECORDS_URL)
if (response.status === 200) {
const json = await response.json()

19
packages/standard-components/src/Login.svelte
View file

@ -13,30 +13,17 @@
let password = ""
let loading = false
let error = false
let _logo = ""
let _buttonClass = ""
let _inputClass = ""
$: {
_logo = _bb.relativeUrl(logo)
_buttonClass = buttonClass || "default-button"
_inputClass = inputClass || "default-input"
}
const login = async () => {
loading = true
const response = await fetch(_bb.relativeUrl("/api/authenticate"), {
body: JSON.stringify({
username,
password,
}),
headers: {
"Content-Type": "application/json",
"x-user-agent": "Budibase Builder",
},
method: "POST",
})
const response = await _bb.api.post("/api/authenticate", { username, password })
if (response.status === 200) {
const json = await response.json()
localStorage.setItem("budibase:token", json.token)
@ -51,9 +38,9 @@
<div class="root">
<div class="content">
{#if _logo}
{#if logo}
<div class="logo-container">
<img src={_logo} alt="logo" />
<img src={logo} alt="logo" />
</div>
{/if}

2
packages/standard-components/src/Test/createApp.js
View file

@ -15,7 +15,7 @@ export default async () => {
const { initialisePage } = createApp(
window.document,
componentLibraries,
{ appRootPath: "" },
{},
appDef,
user,
{},