2021-06-15 20:39:40 +02:00
|
|
|
const { getAppId, setCookie, getCookie, clearCookie } =
|
|
|
|
require("@budibase/auth").utils
|
2021-04-21 17:42:44 +02:00
|
|
|
const { Cookies } = require("@budibase/auth").constants
|
2021-05-14 16:43:41 +02:00
|
|
|
const { getRole } = require("@budibase/auth/roles")
|
|
|
|
const { BUILTIN_ROLE_IDS } = require("@budibase/auth/roles")
|
2021-10-25 17:59:09 +02:00
|
|
|
const { generateUserMetadataID, isDevAppID } = require("../db/utils")
|
2021-10-07 16:49:26 +02:00
|
|
|
const { dbExists } = require("@budibase/auth/db")
|
|
|
|
const { isUserInAppTenant } = require("@budibase/auth/tenancy")
|
2021-07-06 19:10:04 +02:00
|
|
|
const { getCachedSelf } = require("../utilities/global")
|
2021-06-08 19:06:16 +02:00
|
|
|
const CouchDB = require("../db")
|
2021-10-06 23:16:50 +02:00
|
|
|
const env = require("../environment")
|
2021-11-03 15:08:47 +01:00
|
|
|
const { isWebhookEndpoint } = require("./utils")
|
2021-10-06 23:16:50 +02:00
|
|
|
|
2021-04-12 19:31:58 +02:00
|
|
|
module.exports = async (ctx, next) => {
|
|
|
|
// try to get the appID from the request
|
2021-08-04 19:20:51 +02:00
|
|
|
let requestAppId = getAppId(ctx)
|
2021-04-12 19:31:58 +02:00
|
|
|
// get app cookie if it exists
|
2021-07-23 14:29:50 +02:00
|
|
|
let appCookie = null
|
|
|
|
try {
|
|
|
|
appCookie = getCookie(ctx, Cookies.CurrentApp)
|
|
|
|
} catch (err) {
|
|
|
|
clearCookie(ctx, Cookies.CurrentApp)
|
|
|
|
}
|
2021-04-12 19:31:58 +02:00
|
|
|
if (!appCookie && !requestAppId) {
|
|
|
|
return next()
|
|
|
|
}
|
2021-06-08 19:06:16 +02:00
|
|
|
// check the app exists referenced in cookie
|
|
|
|
if (appCookie) {
|
|
|
|
const appId = appCookie.appId
|
|
|
|
const exists = await dbExists(CouchDB, appId)
|
|
|
|
if (!exists) {
|
|
|
|
clearCookie(ctx, Cookies.CurrentApp)
|
|
|
|
return next()
|
|
|
|
}
|
2021-08-04 19:20:51 +02:00
|
|
|
// if the request app ID wasn't set, update it with the cookie
|
|
|
|
requestAppId = requestAppId || appId
|
2021-06-08 19:06:16 +02:00
|
|
|
}
|
2021-04-12 19:31:58 +02:00
|
|
|
|
2021-10-25 17:59:09 +02:00
|
|
|
// deny access to application preview
|
2021-10-26 10:42:19 +02:00
|
|
|
if (
|
|
|
|
isDevAppID(requestAppId) &&
|
2021-11-03 15:08:47 +01:00
|
|
|
!isWebhookEndpoint(ctx) &&
|
2021-10-26 10:42:19 +02:00
|
|
|
(!ctx.user || !ctx.user.builder || !ctx.user.builder.global)
|
|
|
|
) {
|
2021-10-25 17:59:09 +02:00
|
|
|
clearCookie(ctx, Cookies.CurrentApp)
|
|
|
|
return ctx.redirect("/")
|
|
|
|
}
|
|
|
|
|
2021-07-07 18:15:53 +02:00
|
|
|
let appId,
|
|
|
|
roleId = BUILTIN_ROLE_IDS.PUBLIC
|
2021-04-12 19:31:58 +02:00
|
|
|
if (!ctx.user) {
|
|
|
|
// not logged in, try to set a cookie for public apps
|
|
|
|
appId = requestAppId
|
2021-07-06 19:10:04 +02:00
|
|
|
} else if (requestAppId != null) {
|
2021-04-13 17:56:45 +02:00
|
|
|
// Different App ID means cookie needs reset, or if the same public user has logged in
|
2021-07-06 19:10:04 +02:00
|
|
|
const globalUser = await getCachedSelf(ctx, requestAppId)
|
2021-04-12 19:31:58 +02:00
|
|
|
appId = requestAppId
|
2021-05-13 19:10:09 +02:00
|
|
|
// retrieving global user gets the right role
|
2021-10-12 15:03:47 +02:00
|
|
|
roleId = globalUser.roleId || roleId
|
2021-04-12 19:31:58 +02:00
|
|
|
}
|
2021-10-06 23:16:50 +02:00
|
|
|
|
2021-04-20 18:17:44 +02:00
|
|
|
// nothing more to do
|
|
|
|
if (!appId) {
|
|
|
|
return next()
|
|
|
|
}
|
|
|
|
|
2021-10-07 16:49:26 +02:00
|
|
|
let noCookieSet = false
|
|
|
|
// if the user not in the right tenant then make sure they have no permissions
|
|
|
|
// need to judge this only based on the request app ID,
|
|
|
|
if (
|
|
|
|
env.MULTI_TENANCY &&
|
|
|
|
ctx.user &&
|
|
|
|
requestAppId &&
|
|
|
|
!isUserInAppTenant(requestAppId)
|
|
|
|
) {
|
|
|
|
// don't error, simply remove the users rights (they are a public user)
|
|
|
|
delete ctx.user.builder
|
|
|
|
delete ctx.user.admin
|
|
|
|
delete ctx.user.roles
|
|
|
|
roleId = BUILTIN_ROLE_IDS.PUBLIC
|
|
|
|
noCookieSet = true
|
2021-10-06 23:16:50 +02:00
|
|
|
}
|
|
|
|
|
2021-04-20 18:17:44 +02:00
|
|
|
ctx.appId = appId
|
|
|
|
if (roleId) {
|
|
|
|
ctx.roleId = roleId
|
2021-04-22 12:45:22 +02:00
|
|
|
const userId = ctx.user ? generateUserMetadataID(ctx.user._id) : null
|
2021-04-20 18:17:44 +02:00
|
|
|
ctx.user = {
|
|
|
|
...ctx.user,
|
|
|
|
// override userID with metadata one
|
|
|
|
_id: userId,
|
|
|
|
userId,
|
2021-05-27 15:53:41 +02:00
|
|
|
roleId,
|
2021-04-20 18:17:44 +02:00
|
|
|
role: await getRole(appId, roleId),
|
2021-04-13 15:35:00 +02:00
|
|
|
}
|
|
|
|
}
|
2021-07-08 01:30:55 +02:00
|
|
|
if (
|
2021-10-07 16:49:26 +02:00
|
|
|
(requestAppId !== appId ||
|
|
|
|
appCookie == null ||
|
|
|
|
appCookie.appId !== requestAppId) &&
|
|
|
|
!noCookieSet
|
2021-07-08 01:30:55 +02:00
|
|
|
) {
|
2021-07-06 19:10:04 +02:00
|
|
|
setCookie(ctx, { appId }, Cookies.CurrentApp)
|
2021-04-13 15:35:00 +02:00
|
|
|
}
|
2021-08-05 10:59:08 +02:00
|
|
|
|
2021-04-13 15:35:00 +02:00
|
|
|
return next()
|
2021-04-12 19:31:58 +02:00
|
|
|
}
|