From 70d91acc4170f89b2c0b8150dec5d1d8cc865dda Mon Sep 17 00:00:00 2001
From: mike12345567 <me@michaeldrury.co.uk>
Date: Wed, 29 Mar 2023 14:19:54 +0100
Subject: [PATCH] Adding a check for the tenant ID - to make sure it is a real
 tenant before forcing the user out of the platform based on it.

---
 .../builder/src/pages/builder/_layout.svelte  |  8 ++++++-
 packages/builder/src/stores/portal/index.js   |  1 +
 packages/builder/src/stores/portal/tenants.js | 24 +++++++++++++++++++
 packages/frontend-core/src/api/index.js       |  2 ++
 packages/frontend-core/src/api/tenants.js     |  8 +++++++
 .../src/api/controllers/system/tenants.ts     |  4 ++++
 .../worker/src/api/routes/system/tenants.ts   |  2 ++
 .../api/routes/system/tests/tenants.spec.ts   | 13 ++++++++++
 packages/worker/src/sdk/tenants/tenants.ts    |  7 ++++++
 packages/worker/src/tests/api/tenants.ts      |  9 +++++++
 10 files changed, 77 insertions(+), 1 deletion(-)
 create mode 100644 packages/builder/src/stores/portal/tenants.js
 create mode 100644 packages/frontend-core/src/api/tenants.js

diff --git a/packages/builder/src/pages/builder/_layout.svelte b/packages/builder/src/pages/builder/_layout.svelte
index 25b25e754c..73e2f2f5f1 100644
--- a/packages/builder/src/pages/builder/_layout.svelte
+++ b/packages/builder/src/pages/builder/_layout.svelte
@@ -1,6 +1,6 @@
 <script>
   import { isActive, redirect, params } from "@roxi/routify"
-  import { admin, auth, licensing } from "stores/portal"
+  import { admin, auth, licensing, tenants } from "stores/portal"
   import { onMount } from "svelte"
   import { CookieUtils, Constants } from "@budibase/frontend-core"
   import { API } from "api"
@@ -41,6 +41,12 @@
         return
       }
 
+      // check if real tenant
+      const info = await tenants.info(urlTenantId)
+      if (!info.exists) {
+        return
+      }
+
       if (urlTenantId && user.tenantId !== urlTenantId) {
         // user should not be here - play it safe and log them out
         try {
diff --git a/packages/builder/src/stores/portal/index.js b/packages/builder/src/stores/portal/index.js
index e8f7853165..1a2914b925 100644
--- a/packages/builder/src/stores/portal/index.js
+++ b/packages/builder/src/stores/portal/index.js
@@ -14,3 +14,4 @@ export { overview } from "./overview"
 export { environment } from "./environment"
 export { menu } from "./menu"
 export { auditLogs } from "./auditLogs"
+export { tenants } from "./tenants"
diff --git a/packages/builder/src/stores/portal/tenants.js b/packages/builder/src/stores/portal/tenants.js
new file mode 100644
index 0000000000..5820d26752
--- /dev/null
+++ b/packages/builder/src/stores/portal/tenants.js
@@ -0,0 +1,24 @@
+import { writable, get } from "svelte/store"
+import { API } from "api"
+
+export function tenantsStore() {
+  const store = writable({ tenantInfo: {} })
+
+  return {
+    info: async tenantId => {
+      const contents = get(store)
+      const found = contents.tenantInfo[tenantId]
+      if (found) {
+        return found
+      }
+      const tenantInfo = await API.getTenantInfo(tenantId)
+      store.update(state => {
+        state.tenantInfo[tenantId] = tenantInfo
+        return state
+      })
+      return tenantInfo
+    },
+  }
+}
+
+export const tenants = tenantsStore()
diff --git a/packages/frontend-core/src/api/index.js b/packages/frontend-core/src/api/index.js
index f8eee45cb8..66af4cd5c5 100644
--- a/packages/frontend-core/src/api/index.js
+++ b/packages/frontend-core/src/api/index.js
@@ -29,6 +29,7 @@ import { buildBackupsEndpoints } from "./backups"
 import { buildEnvironmentVariableEndpoints } from "./environmentVariables"
 import { buildEventEndpoints } from "./events"
 import { buildAuditLogsEndpoints } from "./auditLogs"
+import { buildTenantEndpoints } from "./tenants"
 
 const defaultAPIClientConfig = {
   /**
@@ -253,5 +254,6 @@ export const createAPIClient = config => {
     ...buildEnvironmentVariableEndpoints(API),
     ...buildEventEndpoints(API),
     ...buildAuditLogsEndpoints(API),
+    ...buildTenantEndpoints(API),
   }
 }
diff --git a/packages/frontend-core/src/api/tenants.js b/packages/frontend-core/src/api/tenants.js
new file mode 100644
index 0000000000..7a5095e94a
--- /dev/null
+++ b/packages/frontend-core/src/api/tenants.js
@@ -0,0 +1,8 @@
+export const buildTenantEndpoints = API => ({
+  /**
+   * Get information about a tenant
+   */
+  getTenantInfo: async tenantId => {
+    return await API.get({ url: `/api/system/tenants/${tenantId}/info` })
+  },
+})
diff --git a/packages/worker/src/api/controllers/system/tenants.ts b/packages/worker/src/api/controllers/system/tenants.ts
index 151507358f..45abdf5866 100644
--- a/packages/worker/src/api/controllers/system/tenants.ts
+++ b/packages/worker/src/api/controllers/system/tenants.ts
@@ -17,3 +17,7 @@ export async function destroy(ctx: UserCtx) {
     throw err
   }
 }
+
+export async function info(ctx: UserCtx) {
+  ctx.body = await tenantSdk.tenantInfo(ctx.params.tenantId)
+}
diff --git a/packages/worker/src/api/routes/system/tenants.ts b/packages/worker/src/api/routes/system/tenants.ts
index 234459cfdc..2d126b7f62 100644
--- a/packages/worker/src/api/routes/system/tenants.ts
+++ b/packages/worker/src/api/routes/system/tenants.ts
@@ -10,4 +10,6 @@ router.delete(
   controller.destroy
 )
 
+router.get("/api/system/tenants/:tenantId/info", controller.info)
+
 export default router
diff --git a/packages/worker/src/api/routes/system/tests/tenants.spec.ts b/packages/worker/src/api/routes/system/tests/tenants.spec.ts
index af509b402e..9b229201d4 100644
--- a/packages/worker/src/api/routes/system/tests/tenants.spec.ts
+++ b/packages/worker/src/api/routes/system/tests/tenants.spec.ts
@@ -58,4 +58,17 @@ describe("/api/global/tenants", () => {
       expect(res.body).toEqual(config.adminOnlyResponse())
     })
   })
+
+  describe("GET /api/system/tenants/:tenantId/info", () => {
+    it("allows retrieving information about the tenant", async () => {
+      const user1 = await config.createTenant()
+      const res = await config.api.tenants.info(user1.tenantId)
+      expect(res.body.exists).toEqual(true)
+    })
+
+    it("check a tenant that doesn't exist", async () => {
+      const res = await config.api.tenants.info("cannot-exist-tenantid")
+      expect(res.body.exists).toEqual(false)
+    })
+  })
 })
diff --git a/packages/worker/src/sdk/tenants/tenants.ts b/packages/worker/src/sdk/tenants/tenants.ts
index 829b144c75..4f580402f7 100644
--- a/packages/worker/src/sdk/tenants/tenants.ts
+++ b/packages/worker/src/sdk/tenants/tenants.ts
@@ -74,3 +74,10 @@ async function removeTenantUsers(tenantId: string) {
     throw err
   }
 }
+
+export async function tenantInfo(tenantId: string) {
+  const globalDbName = tenancy.getGlobalDBName(tenantId)
+  return {
+    exists: await dbCore.dbExists(globalDbName),
+  }
+}
diff --git a/packages/worker/src/tests/api/tenants.ts b/packages/worker/src/tests/api/tenants.ts
index b28b55697f..937982a527 100644
--- a/packages/worker/src/tests/api/tenants.ts
+++ b/packages/worker/src/tests/api/tenants.ts
@@ -2,8 +2,10 @@ import TestConfiguration from "../TestConfiguration"
 import { TestAPI, TestAPIOpts } from "./base"
 
 export class TenantAPI extends TestAPI {
+  config: TestConfiguration
   constructor(config: TestConfiguration) {
     super(config)
+    this.config = config
   }
 
   delete = (tenantId: string, opts?: TestAPIOpts) => {
@@ -12,4 +14,11 @@ export class TenantAPI extends TestAPI {
       .set(opts?.headers)
       .expect(opts?.status ? opts.status : 204)
   }
+
+  info = (tenantId: string) => {
+    return this.request
+      .get(`/api/system/tenants/${tenantId}/info`)
+      .set(this.config.defaultHeaders())
+      .expect(200)
+  }
 }