From 2c91b89f021c742be54b6ed32cda6c8d0a2f37ad Mon Sep 17 00:00:00 2001
From: Andrew Kingston <aptkingston@ssl-mail.com>
Date: Tue, 30 Nov 2021 14:32:18 +0000
Subject: [PATCH 1/4] Prevent data providers from using arbitrary
 context-providing components as sources

---
 .../builder/src/builderStore/dataBinding.js   |  4 ++--
 .../PropertyControls/DataSourceSelect.svelte  | 21 +++++++++++--------
 .../EventsEditor/actions/SaveRow.svelte       |  4 ++--
 3 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/packages/builder/src/builderStore/dataBinding.js b/packages/builder/src/builderStore/dataBinding.js
index 9a41ad2afc..cb09b33970 100644
--- a/packages/builder/src/builderStore/dataBinding.js
+++ b/packages/builder/src/builderStore/dataBinding.js
@@ -61,7 +61,7 @@ export const getComponentBindableProperties = (asset, componentId) => {
 /**
  * Gets all data provider components above a component.
  */
-export const getDataProviderComponents = (asset, componentId) => {
+export const getContextProviderComponents = (asset, componentId) => {
   if (!asset || !componentId) {
     return []
   }
@@ -143,7 +143,7 @@ export const getDatasourceForProvider = (asset, component) => {
  */
 const getContextBindings = (asset, componentId) => {
   // Extract any components which provide data contexts
-  const dataProviders = getDataProviderComponents(asset, componentId)
+  const dataProviders = getContextProviderComponents(asset, componentId)
 
   // Generate bindings for all matching components
   return getProviderContextBindings(asset, dataProviders)
diff --git a/packages/builder/src/components/design/PropertiesPanel/PropertyControls/DataSourceSelect.svelte b/packages/builder/src/components/design/PropertiesPanel/PropertyControls/DataSourceSelect.svelte
index bc15110c09..8f5f7ef807 100644
--- a/packages/builder/src/components/design/PropertiesPanel/PropertyControls/DataSourceSelect.svelte
+++ b/packages/builder/src/components/design/PropertiesPanel/PropertyControls/DataSourceSelect.svelte
@@ -1,5 +1,5 @@
 <script>
-  import { getDataProviderComponents } from "builderStore/dataBinding"
+  import { getContextProviderComponents } from "builderStore/dataBinding"
   import {
     Button,
     Popover,
@@ -58,16 +58,19 @@
       ...query,
       type: "query",
     }))
-  $: dataProviders = getDataProviderComponents(
+  $: contextProviders = getContextProviderComponents(
     $currentAsset,
     $store.selectedComponentId
-  ).map(provider => ({
-    label: provider._instanceName,
-    name: provider._instanceName,
-    providerId: provider._id,
-    value: `{{ literal ${safe(provider._id)} }}`,
-    type: "provider",
-  }))
+  )
+  $: dataProviders = contextProviders
+    .filter(component => component._component?.endsWith("/dataprovider"))
+    .map(provider => ({
+      label: provider._instanceName,
+      name: provider._instanceName,
+      providerId: provider._id,
+      value: `{{ literal ${safe(provider._id)} }}`,
+      type: "provider",
+    }))
   $: links = bindings
     .filter(x => x.fieldSchema?.type === "link")
     .map(binding => {
diff --git a/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/actions/SaveRow.svelte b/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/actions/SaveRow.svelte
index 791380643f..d444f233db 100644
--- a/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/actions/SaveRow.svelte
+++ b/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/actions/SaveRow.svelte
@@ -3,7 +3,7 @@
   import { store, currentAsset } from "builderStore"
   import { tables } from "stores/backend"
   import {
-    getDataProviderComponents,
+    getContextProviderComponents,
     getSchemaForDatasource,
   } from "builderStore/dataBinding"
   import SaveFields from "./SaveFields.svelte"
@@ -11,7 +11,7 @@
   export let parameters
   export let bindings = []
 
-  $: dataProviderComponents = getDataProviderComponents(
+  $: dataProviderComponents = getContextProviderComponents(
     $currentAsset,
     $store.selectedComponentId
   )

From e6741ce3419a6ab3e17c93a65a556e81de697323 Mon Sep 17 00:00:00 2001
From: Andrew Kingston <aptkingston@ssl-mail.com>
Date: Wed, 1 Dec 2021 10:32:55 +0000
Subject: [PATCH 2/4] Ensuire the save row action determines the correct
 runtime bindings and only uses valid context types

---
 .../builder/src/builderStore/dataBinding.js   | 15 +++++-
 .../EventsEditor/actions/SaveRow.svelte       | 49 +++++++++++++++++--
 2 files changed, 57 insertions(+), 7 deletions(-)

diff --git a/packages/builder/src/builderStore/dataBinding.js b/packages/builder/src/builderStore/dataBinding.js
index cb09b33970..b36613fbc5 100644
--- a/packages/builder/src/builderStore/dataBinding.js
+++ b/packages/builder/src/builderStore/dataBinding.js
@@ -61,7 +61,7 @@ export const getComponentBindableProperties = (asset, componentId) => {
 /**
  * Gets all data provider components above a component.
  */
-export const getContextProviderComponents = (asset, componentId) => {
+export const getContextProviderComponents = (asset, componentId, type) => {
   if (!asset || !componentId) {
     return []
   }
@@ -74,7 +74,18 @@ export const getContextProviderComponents = (asset, componentId) => {
   // Filter by only data provider components
   return path.filter(component => {
     const def = store.actions.components.getDefinition(component._component)
-    return def?.context != null
+    if (!def?.context) {
+      return false
+    }
+
+    // If no type specified, return anything that exposes context
+    if (!type) {
+      return true
+    }
+
+    // Otherwise only match components with the specific context type
+    const contexts = Array.isArray(def.context) ? def.context : [def.context]
+    return contexts.find(context => context.type === type) != null
   })
 }
 
diff --git a/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/actions/SaveRow.svelte b/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/actions/SaveRow.svelte
index d444f233db..55aac87cfd 100644
--- a/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/actions/SaveRow.svelte
+++ b/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/actions/SaveRow.svelte
@@ -11,13 +11,54 @@
   export let parameters
   export let bindings = []
 
-  $: dataProviderComponents = getContextProviderComponents(
+  $: formComponents = getContextProviderComponents(
     $currentAsset,
-    $store.selectedComponentId
+    $store.selectedComponentId,
+    "form"
   )
+  $: schemaComponents = getContextProviderComponents(
+    $currentAsset,
+    $store.selectedComponentId,
+    "schema"
+  )
+  $: providerOptions = getProviderOptions(formComponents, schemaComponents)
   $: schemaFields = getSchemaFields($currentAsset, parameters?.tableId)
   $: tableOptions = $tables.list || []
 
+  // Gets a context definition of a certain type from a component definition
+  const extractComponentContext = (component, contextType) => {
+    const def = store.actions.components.getDefinition(component?._component)
+    if (!def) {
+      return null
+    }
+    const contexts = Array.isArray(def.context) ? def.context : [def.context]
+    return contexts.find(context => context?.type === contextType)
+  }
+
+  // Gets options for valid context keys which provide valid data to submit
+  const getProviderOptions = (formComponents, schemaComponents) => {
+    const formContexts = formComponents.map(component => ({
+      component,
+      context: extractComponentContext(component, "form"),
+    }))
+    const schemaContexts = schemaComponents.map(component => ({
+      component,
+      context: extractComponentContext(component, "schema"),
+    }))
+    const allContexts = formContexts.concat(schemaContexts)
+
+    return allContexts.map(({ component, context }) => {
+      let runtimeBinding = component._id
+      if (context.suffix) {
+        runtimeBinding += `-${context.suffix}`
+      }
+      return {
+        label: component._instanceName,
+        value: runtimeBinding,
+      }
+    })
+  }
+
   const getSchemaFields = (asset, tableId) => {
     const { schema } = getSchemaForDatasource(asset, { type: "table", tableId })
     return Object.values(schema || {})
@@ -39,10 +80,8 @@
     <Label small>Data Source</Label>
     <Select
       bind:value={parameters.providerId}
-      options={dataProviderComponents}
+      options={providerOptions}
       placeholder="None"
-      getOptionLabel={option => option._instanceName}
-      getOptionValue={option => option._id}
     />
 
     <Label small>Table</Label>

From c54489d7ee20cd5e807b00b32461cb31a0913e72 Mon Sep 17 00:00:00 2001
From: Andrew Kingston <aptkingston@ssl-mail.com>
Date: Wed, 1 Dec 2021 10:33:17 +0000
Subject: [PATCH 3/4] Fix button actions directly mutating the real component
 definition

---
 .../EventsEditor/EventPropertyControl.svelte  | 20 +++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/EventPropertyControl.svelte b/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/EventPropertyControl.svelte
index 09a8b491c7..582a7126e7 100644
--- a/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/EventPropertyControl.svelte
+++ b/packages/builder/src/components/design/PropertiesPanel/PropertyControls/EventsEditor/EventPropertyControl.svelte
@@ -4,6 +4,7 @@
   import { notifications } from "@budibase/bbui"
   import EventEditor from "./EventEditor.svelte"
   import { automationStore } from "builderStore"
+  import { cloneDeep } from "lodash/fp"
 
   const dispatch = createEventDispatcher()
 
@@ -12,17 +13,23 @@
   export let bindings
 
   let drawer
+  let tmpValue
+
+  const openDrawer = () => {
+    tmpValue = cloneDeep(value)
+    drawer.show()
+  }
 
   const saveEventData = async () => {
     // any automations that need created from event triggers
-    const automationsToCreate = value.filter(
+    const automationsToCreate = tmpValue.filter(
       action => action["##eventHandlerType"] === "Trigger Automation"
     )
     for (let action of automationsToCreate) {
       await createAutomation(action.parameters)
     }
 
-    dispatch("change", value)
+    dispatch("change", tmpValue)
     notifications.success("Component actions saved.")
     drawer.hide()
   }
@@ -54,11 +61,16 @@
   }
 </script>
 
-<ActionButton on:click={drawer.show}>Define actions</ActionButton>
+<ActionButton on:click={openDrawer}>Define actions</ActionButton>
 <Drawer bind:this={drawer} title={"Actions"}>
   <svelte:fragment slot="description">
     Define what actions to run.
   </svelte:fragment>
   <Button cta slot="buttons" on:click={saveEventData}>Save</Button>
-  <EventEditor slot="body" bind:actions={value} eventType={name} {bindings} />
+  <EventEditor
+    slot="body"
+    bind:actions={tmpValue}
+    eventType={name}
+    {bindings}
+  />
 </Drawer>

From 7824fe3163af82a56bf6adf423588d2a27ca931d Mon Sep 17 00:00:00 2001
From: Budibase Release Bot <>
Date: Wed, 1 Dec 2021 10:57:38 +0000
Subject: [PATCH 4/4] v1.0.3

---
 lerna.json                             | 2 +-
 packages/auth/package.json             | 2 +-
 packages/bbui/package.json             | 2 +-
 packages/builder/package.json          | 8 ++++----
 packages/cli/package.json              | 2 +-
 packages/client/package.json           | 6 +++---
 packages/server/package.json           | 8 ++++----
 packages/string-templates/package.json | 2 +-
 packages/worker/package.json           | 6 +++---
 9 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/lerna.json b/lerna.json
index ecdba97c2d..294808f4b9 100644
--- a/lerna.json
+++ b/lerna.json
@@ -1,5 +1,5 @@
 {
-  "version": "1.0.2",
+  "version": "1.0.3",
   "npmClient": "yarn",
   "packages": [
     "packages/*"
diff --git a/packages/auth/package.json b/packages/auth/package.json
index 36cf59d8c8..0be71ae7ff 100644
--- a/packages/auth/package.json
+++ b/packages/auth/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@budibase/auth",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Authentication middlewares for budibase builder and apps",
   "main": "src/index.js",
   "author": "Budibase",
diff --git a/packages/bbui/package.json b/packages/bbui/package.json
index d2c7244cd7..edf08413fb 100644
--- a/packages/bbui/package.json
+++ b/packages/bbui/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@budibase/bbui",
   "description": "A UI solution used in the different Budibase projects.",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "license": "MPL-2.0",
   "svelte": "src/index.js",
   "module": "dist/bbui.es.js",
diff --git a/packages/builder/package.json b/packages/builder/package.json
index 3761e3ae54..d846e1fac5 100644
--- a/packages/builder/package.json
+++ b/packages/builder/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@budibase/builder",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "license": "GPL-3.0",
   "private": true,
   "scripts": {
@@ -65,10 +65,10 @@
     }
   },
   "dependencies": {
-    "@budibase/bbui": "^1.0.2",
-    "@budibase/client": "^1.0.2",
+    "@budibase/bbui": "^1.0.3",
+    "@budibase/client": "^1.0.3",
     "@budibase/colorpicker": "1.1.2",
-    "@budibase/string-templates": "^1.0.2",
+    "@budibase/string-templates": "^1.0.3",
     "@sentry/browser": "5.19.1",
     "@spectrum-css/page": "^3.0.1",
     "@spectrum-css/vars": "^3.0.1",
diff --git a/packages/cli/package.json b/packages/cli/package.json
index d3c09d5be9..e7da79beb7 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@budibase/cli",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Budibase CLI, for developers, self hosting and migrations.",
   "main": "src/index.js",
   "bin": {
diff --git a/packages/client/package.json b/packages/client/package.json
index 97835597a3..8b04e5a5e3 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@budibase/client",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "license": "MPL-2.0",
   "module": "dist/budibase-client.js",
   "main": "dist/budibase-client.js",
@@ -19,9 +19,9 @@
     "dev:builder": "rollup -cw"
   },
   "dependencies": {
-    "@budibase/bbui": "^1.0.2",
+    "@budibase/bbui": "^1.0.3",
     "@budibase/standard-components": "^0.9.139",
-    "@budibase/string-templates": "^1.0.2",
+    "@budibase/string-templates": "^1.0.3",
     "regexparam": "^1.3.0",
     "shortid": "^2.2.15",
     "svelte-spa-router": "^3.0.5"
diff --git a/packages/server/package.json b/packages/server/package.json
index 17ce9e6582..d86d303da2 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@budibase/server",
   "email": "hi@budibase.com",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Budibase Web Server",
   "main": "src/index.ts",
   "repository": {
@@ -69,9 +69,9 @@
   "author": "Budibase",
   "license": "GPL-3.0",
   "dependencies": {
-    "@budibase/auth": "^1.0.2",
-    "@budibase/client": "^1.0.2",
-    "@budibase/string-templates": "^1.0.2",
+    "@budibase/auth": "^1.0.3",
+    "@budibase/client": "^1.0.3",
+    "@budibase/string-templates": "^1.0.3",
     "@bull-board/api": "^3.7.0",
     "@bull-board/koa": "^3.7.0",
     "@elastic/elasticsearch": "7.10.0",
diff --git a/packages/string-templates/package.json b/packages/string-templates/package.json
index ba3bd76dad..62acf460f1 100644
--- a/packages/string-templates/package.json
+++ b/packages/string-templates/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@budibase/string-templates",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Handlebars wrapper for Budibase templating.",
   "main": "src/index.cjs",
   "module": "dist/bundle.mjs",
diff --git a/packages/worker/package.json b/packages/worker/package.json
index 1ec2488af3..91330aff09 100644
--- a/packages/worker/package.json
+++ b/packages/worker/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@budibase/worker",
   "email": "hi@budibase.com",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Budibase background service",
   "main": "src/index.js",
   "repository": {
@@ -29,8 +29,8 @@
   "author": "Budibase",
   "license": "GPL-3.0",
   "dependencies": {
-    "@budibase/auth": "^1.0.2",
-    "@budibase/string-templates": "^1.0.2",
+    "@budibase/auth": "^1.0.3",
+    "@budibase/string-templates": "^1.0.3",
     "@koa/router": "^8.0.0",
     "@sentry/node": "^6.0.0",
     "@techpass/passport-openidconnect": "^0.3.0",