MirrorSave
/
budibase
mirror of https://github.com/Budibase/budibase.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1392 from Budibase/feature/user-id-update 

Replacing User IDs with Emails
This commit is contained in:
Michael Drury 2021-04-21 14:38:30 +01:00 committed by GitHub
parent 3b4c25326b 89fef34401
commit 54150a541c
36 changed files with 334 additions and 367 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
packages/auth/src/db/index.js
View File

@ -1,5 +1,9 @@
let Pouch
module.exports.setDB = pouch => {
module.exports.CouchDB = pouch
Pouch = pouch
}
module.exports.CouchDB = null
module.exports.getDB = dbName => {
return new Pouch(dbName)
}

35
packages/auth/src/db/utils.js
View File

@ -1,5 +1,9 @@
const { newid } = require("../hashing")
exports.ViewNames = {
USER_BY_EMAIL: "by_email",
}
exports.StaticDatabases = {
GLOBAL: {
name: "global-db",
@ -19,19 +23,6 @@ const SEPARATOR = "_"
exports.SEPARATOR = SEPARATOR
/**
* Generates a new user ID based on the passed in email.
* @param {string} email The email which the ID is going to be built up of.
* @returns {string} The new user ID which the user doc can be stored under.
*/
exports.generateUserID = email => {
return `${DocumentTypes.USER}${SEPARATOR}${email}`
}
exports.getEmailFromUserID = userId => {
return userId.split(`${DocumentTypes.USER}${SEPARATOR}`)[1]
}
/**
* Generates a new group ID.
* @returns {string} The new group ID which the group doc can be stored under.
@ -51,16 +42,24 @@ exports.getGroupParams = (id = "", otherProps = {}) => {
}
}
/**
* Generates a new global user ID.
* @returns {string} The new user ID which the user doc can be stored under.
*/
exports.generateGlobalUserID = () => {
return `${DocumentTypes.USER}${SEPARATOR}${newid()}`
}
/**
* Gets parameters for retrieving users.
*/
exports.getUserParams = (email = "", otherProps = {}) => {
if (!email) {
email = ""
exports.getGlobalUserParams = (globalId = "", otherProps = {}) => {
if (!globalId) {
globalId = ""
}
return {
...otherProps,
startkey: `${DocumentTypes.USER}${SEPARATOR}${email}`,
endkey: `${DocumentTypes.USER}${SEPARATOR}${email}${UNICODE_MAX}`,
startkey: `${DocumentTypes.USER}${SEPARATOR}${globalId}`,
endkey: `${DocumentTypes.USER}${SEPARATOR}${globalId}${UNICODE_MAX}`,
}
}

35
packages/auth/src/db/views.js Normal file
View File

@ -0,0 +1,35 @@
const { DocumentTypes, ViewNames, StaticDatabases } = require("./utils")
const { getDB } = require("./index")
function DesignDoc() {
return {
_id: "_design/database",
// view collation information, read before writing any complex views:
// https://docs.couchdb.org/en/master/ddocs/views/collation.html#collation-specification
views: {},
}
}
exports.createUserEmailView = async () => {
const db = getDB(StaticDatabases.GLOBAL.name)
let designDoc
try {
designDoc = await db.get("_design/database")
} catch (err) {
// no design doc, make one
designDoc = DesignDoc()
}
const view = {
// if using variables in a map function need to inject them before use
map: `function(doc) {
if (doc._id.startsWith("${DocumentTypes.USER}")) {
emit(doc.email, doc._id)
}
}`,
}
designDoc.views = {
...designDoc.views,
[ViewNames.USER_BY_EMAIL]: view,
}
await db.put(designDoc)
}

18
packages/auth/src/index.js
View File

@ -2,7 +2,7 @@ const passport = require("koa-passport")
const LocalStrategy = require("passport-local").Strategy
const JwtStrategy = require("passport-jwt").Strategy
// const GoogleStrategy = require("passport-google-oauth").Strategy
const database = require("./db")
const { setDB, getDB } = require("./db")
const { StaticDatabases } = require("./db/utils")
const { jwt, local, authenticated } = require("./middleware")
const { Cookies, UserStatus } = require("./constants")
@ -13,13 +13,13 @@ const {
getCookie,
clearCookie,
isClient,
getGlobalUserByEmail,
} = require("./utils")
const {
generateUserID,
getUserParams,
generateGlobalUserID,
getGlobalUserParams,
generateGroupID,
getGroupParams,
getEmailFromUserID,
} = require("./db/utils")
// Strategies
@ -30,7 +30,7 @@ passport.use(new JwtStrategy(jwt.options, jwt.authenticate))
passport.serializeUser((user, done) => done(null, user))
passport.deserializeUser(async (user, done) => {
const db = new database.CouchDB(StaticDatabases.GLOBAL.name)
const db = getDB(StaticDatabases.GLOBAL.name)
try {
const user = await db.get(user._id)
@ -43,17 +43,16 @@ passport.deserializeUser(async (user, done) => {
module.exports = {
init(pouch) {
database.setDB(pouch)
setDB(pouch)
},
passport,
Cookies,
UserStatus,
StaticDatabases,
generateUserID,
getUserParams,
generateGlobalUserID,
getGlobalUserParams,
generateGroupID,
getGroupParams,
getEmailFromUserID,
hash,
compare,
getAppId,
@ -62,4 +61,5 @@ module.exports = {
clearCookie,
authenticated,
isClient,
getGlobalUserByEmail,
}

3
packages/auth/src/middleware/authenticated.js
View File

@ -1,6 +1,5 @@
const { Cookies } = require("../constants")
const { getCookie } = require("../utils")
const { getEmailFromUserID } = require("../db/utils")
module.exports = async (ctx, next) => {
try {
@ -10,8 +9,6 @@ module.exports = async (ctx, next) => {
if (authCookie) {
ctx.isAuthenticated = true
ctx.user = authCookie
// make sure email is correct from ID
ctx.user.email = getEmailFromUserID(authCookie.userId)
}
await next()

19
packages/auth/src/middleware/passport/local.js
View File

@ -1,9 +1,8 @@
const jwt = require("jsonwebtoken")
const { UserStatus } = require("../../constants")
const database = require("../../db")
const { StaticDatabases, generateUserID } = require("../../db/utils")
const { compare } = require("../../hashing")
const env = require("../../environment")
const { getGlobalUserByEmail } = require("../../utils")
const INVALID_ERR = "Invalid Credentials"
@ -11,23 +10,17 @@ exports.options = {}
/**
* Passport Local Authentication Middleware.
* @param {*} username - username to login with
* @param {*} email - username to login with
* @param {*} password - plain text password to log in with
* @param {*} done - callback from passport to return user information and errors
* @returns The authenticated user, or errors if they occur
*/
exports.authenticate = async function(username, password, done) {
if (!username) return done(null, false, "Email Required.")
exports.authenticate = async function(email, password, done) {
if (!email) return done(null, false, "Email Required.")
if (!password) return done(null, false, "Password Required.")
// Check the user exists in the instance DB by email
const db = new database.CouchDB(StaticDatabases.GLOBAL.name)
let dbUser
try {
dbUser = await db.get(generateUserID(username))
} catch (err) {
console.error("User not found", err)
const dbUser = await getGlobalUserByEmail(email)
if (dbUser == null) {
return done(null, false, { message: "User not found" })
}

30
packages/auth/src/utils.js
View File

@ -1,6 +1,13 @@
const { DocumentTypes, SEPARATOR } = require("./db/utils")
const {
DocumentTypes,
SEPARATOR,
ViewNames,
StaticDatabases,
} = require("./db/utils")
const jwt = require("jsonwebtoken")
const { options } = require("./middleware/passport/jwt")
const { createUserEmailView } = require("./db/views")
const { getDB } = require("./db")
const APP_PREFIX = DocumentTypes.APP + SEPARATOR
@ -97,3 +104,24 @@ exports.clearCookie = (ctx, name) => {
exports.isClient = ctx => {
return ctx.headers["x-budibase-type"] === "client"
}
exports.getGlobalUserByEmail = async email => {
const db = getDB(StaticDatabases.GLOBAL.name)
try {
let users = (
await db.query(`database/${ViewNames.USER_BY_EMAIL}`, {
key: email,
include_docs: true,
})
).rows
users = users.map(user => user.doc)
return users.length <= 1 ? users[0] : users
} catch (err) {
if (err != null && err.name === "not_found") {
await createUserEmailView()
return exports.getGlobalUserByEmail(email)
} else {
throw err
}
}
}

6
packages/builder/cypress/integration/createBinding.spec.js
View File

@ -6,12 +6,8 @@ context("Create Bindings", () => {
})
it("should add a current user binding", () => {
cy.addComponent("Elements", "Paragraph").then(componentId => {
cy.addComponent("Elements", "Paragraph").then(() => {
addSettingBinding("text", "Current User._id")
cy.getComponent(componentId).should(
"have.text",
`ro_ta_users_test@test.com`
)
})
})

19
packages/builder/cypress/support/commands.js
View File

@ -1,28 +1,9 @@
// ***********************************************
// This example commands.js shows you how to
// create various custom commands and overwrite
// existing commands.
//
// For more comprehensive examples of custom
// commands please read more here:
// https://on.cypress.io/custom-commands
// ***********************************************
//
//
// -- This is a parent command --
// Cypress.Commands.add("login", (email, password) => { ... })
//
//
// -- This is a child command --
// Cypress.Commands.add("drag", { prevSubject: 'element'}, (subject, options) => { ... })
//
//
// -- This is a dual command --
// Cypress.Commands.add("dismiss", { prevSubject: 'optional'}, (subject, options) => { ... })
//
//
// -- This will overwrite an existing command --
// Cypress.Commands.overwrite("visit", (originalFn, url, options) => { ... })
Cypress.Commands.add("login", () => {
cy.getCookie("budibase:auth").then(cookie => {

5
packages/builder/package.json
View File

@ -14,9 +14,10 @@
"cy:setup": "node ./cypress/setup.js",
"cy:run": "cypress run",
"cy:open": "cypress open",
"cy:run:ci": "cypress run --browser electron --record --key f308590b-6070-41af-b970-794a3823d451",
"cy:run:ci": "cypress run --record --key f308590b-6070-41af-b970-794a3823d451",
"cy:test": "start-server-and-test cy:setup http://localhost:10000/builder cy:run",
"cy:ci": "start-server-and-test cy:setup http://localhost:10000/builder cy:run:ci"
"cy:ci": "start-server-and-test cy:setup http://localhost:10000/builder cy:run:ci",
"cy:debug": "start-server-and-test cy:setup http://localhost:10000/builder cy:open"
},
"jest": {
"globals": {

9
packages/builder/src/components/login/LoginForm.svelte
View File

@ -21,14 +21,7 @@
async function createTestUser() {
try {
await auth.createUser({
email: "test@test.com",
password: "test",
roles: {},
builder: {
global: true,
},
})
await auth.firstUser()
notifier.success("Test user created")
} catch (err) {
console.error(err)

4
packages/builder/src/components/start/CreateAppModal.svelte
View File

@ -151,8 +151,8 @@
const user = {
roleId: $createAppStore.values.roleId,
}
const userResp = await api.post(`/api/users/metadata`, user)
const json = await userResp.json()
const userResp = await api.post(`/api/users/metadata/self`, user)
await userResp.json()
$goto(`./${appJson._id}`)
} catch (error) {
console.error(error)

13
packages/builder/src/stores/backend/auth.js
View File

@ -30,11 +30,24 @@ export function createAuthStore() {
},
logout: async () => {
const response = await api.post(`/api/admin/auth/logout`)
if (response.status !== 200) {
throw "Unable to create logout"
}
await response.json()
set({ user: null })
},
createUser: async user => {
const response = await api.post(`/api/admin/users`, user)
if (response.status !== 200) {
throw "Unable to create user"
}
await response.json()
},
firstUser: async () => {
const response = await api.post(`/api/admin/users/first`)
if (response.status !== 200) {
throw "Unable to create test user"
}
await response.json()
},
}

69
packages/server/src/api/controllers/auth.js
View File

@ -1,75 +1,8 @@
const jwt = require("jsonwebtoken")
const CouchDB = require("../../db")
const bcrypt = require("../../utilities/bcrypt")
const env = require("../../environment")
const { getAPIKey } = require("../../utilities/usageQuota")
const { generateUserMetadataID } = require("../../db/utils")
const { setCookie } = require("../../utilities")
const { outputProcessing } = require("../../utilities/rowProcessor")
const { InternalTables } = require("../../db/utils")
const { UserStatus } = require("@budibase/auth")
const { getFullUser } = require("../../utilities/users")
const INVALID_ERR = "Invalid Credentials"
exports.authenticate = async ctx => {
const appId = ctx.appId
if (!appId) ctx.throw(400, "No appId")
const { email, password } = ctx.request.body
if (!email) ctx.throw(400, "Email Required.")
if (!password) ctx.throw(400, "Password Required.")
// Check the user exists in the instance DB by email
const db = new CouchDB(appId)
const app = await db.get(appId)
let dbUser
try {
dbUser = await db.get(generateUserMetadataID(email))
} catch (_) {
// do not want to throw a 404 - as this could be
// used to determine valid emails
ctx.throw(401, INVALID_ERR)
}
// check that the user is currently inactive, if this is the case throw invalid
if (dbUser.status === UserStatus.INACTIVE) {
ctx.throw(401, INVALID_ERR)
}
// authenticate
if (await bcrypt.compare(password, dbUser.password)) {
const payload = {
userId: dbUser._id,
roleId: dbUser.roleId,
version: app.version,
}
// if in prod add the user api key, unless self hosted
/* istanbul ignore next */
if (env.isProd() && !env.SELF_HOSTED) {
const { apiKey } = await getAPIKey(ctx.appId)
payload.apiKey = apiKey
}
const token = jwt.sign(payload, ctx.config.jwtSecret, {
expiresIn: "1 day",
})
setCookie(ctx, token, appId)
delete dbUser.password
ctx.body = {
token,
...dbUser,
appId,
}
} else {
ctx.throw(401, INVALID_ERR)
}
}
exports.fetchSelf = async ctx => {
if (!ctx.user) {
ctx.throw(403, "No user logged in")
@ -82,7 +15,7 @@ exports.fetchSelf = async ctx => {
return
}
const user = await getFullUser({ ctx, userId: userId })
const user = await getFullUser(ctx, userId)
if (appId) {
const db = new CouchDB(appId)

4
packages/server/src/api/controllers/dev.js
View File

@ -4,9 +4,9 @@ const { checkSlashesInUrl } = require("../../utilities")
const { request } = require("../../utilities/workerRequests")
async function redirect(ctx, method) {
const { path } = ctx.params
const { devPath } = ctx.params
const response = await fetch(
checkSlashesInUrl(`${env.WORKER_URL}/api/admin/${path}`),
checkSlashesInUrl(`${env.WORKER_URL}/api/admin/${devPath}`),
request(ctx, {
method,
body: ctx.request.body,

14
packages/server/src/api/controllers/row.js
View File

@ -7,7 +7,6 @@ const {
DocumentTypes,
SEPARATOR,
InternalTables,
generateUserMetadataID,
} = require("../../db/utils")
const userController = require("./user")
const {
@ -42,7 +41,7 @@ async function findRow(ctx, db, tableId, rowId) {
// TODO remove special user case in future
if (tableId === InternalTables.USER_METADATA) {
ctx.params = {
userId: rowId,
id: rowId,
}
await userController.findMetadata(ctx)
row = ctx.body
@ -140,12 +139,7 @@ exports.save = async function(ctx) {
}
if (!inputs._rev && !inputs._id) {
// TODO remove special user case in future
if (inputs.tableId === InternalTables.USER_METADATA) {
inputs._id = generateUserMetadataID(inputs.email)
} else {
inputs._id = generateRowID(inputs.tableId)
}
inputs._id = generateRowID(inputs.tableId)
}
// this returns the table and row incase they have been updated
@ -342,7 +336,7 @@ exports.destroy = async function(ctx) {
// TODO remove special user case in future
if (ctx.params.tableId === InternalTables.USER_METADATA) {
ctx.params = {
userId: ctx.params.rowId,
id: ctx.params.rowId,
}
await userController.destroyMetadata(ctx)
} else {
@ -449,7 +443,7 @@ async function bulkDelete(ctx) {
updates = updates.concat(
rows.map(row => {
ctx.params = {
userId: row._id,
id: row._id,
}
return userController.destroyMetadata(ctx)
})

63
packages/server/src/api/controllers/user.js
View File

@ -2,7 +2,7 @@ const CouchDB = require("../../db")
const {
generateUserMetadataID,
getUserMetadataParams,
getEmailFromUserMetadataID,
getGlobalIDFromUserMetadataID,
} = require("../../db/utils")
const { InternalTables } = require("../../db/utils")
const { getRole } = require("../../utilities/security/roles")
@ -25,15 +25,14 @@ exports.fetchMetadata = async function(ctx) {
).rows.map(row => row.doc)
const users = []
for (let user of global) {
const info = metadata.find(meta => meta._id.includes(user.email))
// find the metadata that matches up to the global ID
const info = metadata.find(meta => meta._id.includes(user._id))
// remove these props, not for the correct DB
delete user._id
delete user._rev
users.push({
...user,
...info,
// make sure the ID is always a local ID, not a global one
_id: generateUserMetadataID(user.email),
_id: generateUserMetadataID(user._id),
})
}
ctx.body = users
@ -43,17 +42,20 @@ exports.createMetadata = async function(ctx) {
const appId = ctx.appId
const db = new CouchDB(appId)
const { roleId } = ctx.request.body
const email = ctx.request.body.email || ctx.user.email
if (ctx.request.body._id) {
return exports.updateMetadata(ctx)
}
// check role valid
const role = await getRole(appId, roleId)
if (!role) ctx.throw(400, "Invalid Role")
const metadata = await saveGlobalUser(ctx, appId, email, ctx.request.body)
const globalUser = await saveGlobalUser(ctx, appId, ctx.request.body)
const user = {
...metadata,
_id: generateUserMetadataID(email),
...globalUser,
_id: generateUserMetadataID(globalUser._id),
type: "user",
tableId: InternalTables.USER_METADATA,
}
@ -64,47 +66,48 @@ exports.createMetadata = async function(ctx) {
ctx.body = {
_id: response.id,
_rev: response.rev,
email,
email: ctx.request.body.email,
}
}
exports.updateSelfMetadata = async function(ctx) {
// overwrite the ID with current users
ctx.request.body._id = ctx.user.userId
// make sure no stale rev
delete ctx.request.body._rev
await exports.updateMetadata(ctx)
}
exports.updateMetadata = async function(ctx) {
const appId = ctx.appId
const db = new CouchDB(appId)
const user = ctx.request.body
let email = user.email || getEmailFromUserMetadataID(user._id)
const metadata = await saveGlobalUser(ctx, appId, email, ctx.request.body)
if (!metadata._id) {
metadata._id = generateUserMetadataID(email)
}
if (!metadata._rev) {
metadata._rev = ctx.request.body._rev
}
ctx.body = await db.put({
...metadata,
const globalUser = await saveGlobalUser(ctx, appId, {
...user,
_id: getGlobalIDFromUserMetadataID(user._id),
})
const metadata = {
...globalUser,
_id: user._id || generateUserMetadataID(globalUser._id),
_rev: user._rev,
}
ctx.body = await db.put(metadata)
}
exports.destroyMetadata = async function(ctx) {
const db = new CouchDB(ctx.appId)
const email =
ctx.params.email || getEmailFromUserMetadataID(ctx.params.userId)
await deleteGlobalUser(ctx, email)
await deleteGlobalUser(ctx, getGlobalIDFromUserMetadataID(ctx.params.id))
try {
const dbUser = await db.get(generateUserMetadataID(email))
const dbUser = await db.get(ctx.params.id)
await db.remove(dbUser._id, dbUser._rev)
} catch (err) {
// error just means the global user has no config in this app
}
ctx.body = {
message: `User ${ctx.params.email} deleted.`,
message: `User ${ctx.params.id} deleted.`,
}
}
exports.findMetadata = async function(ctx) {
ctx.body = await getFullUser({
ctx,
email: ctx.params.email,
userId: ctx.params.userId,
})
ctx.body = await getFullUser(ctx, ctx.params.id)
}

7
packages/server/src/api/routes/dev.js
View File

@ -5,9 +5,10 @@ const env = require("../../environment")
const router = Router()
if (env.isDev() || env.isTest()) {
router.get("/api/admin/:path", controller.redirectGet)
router.post("/api/admin/:path", controller.redirectPost)
router.delete("/api/admin/:path", controller.redirectDelete)
router
.get("/api/admin/:devPath(.*)", controller.redirectGet)
.post("/api/admin/:devPath(.*)", controller.redirectPost)
.delete("/api/admin/:devPath(.*)", controller.redirectDelete)
}
module.exports = router

15
packages/server/src/api/routes/tests/auth.spec.js
View File

@ -1,13 +1,18 @@
const setup = require("./utilities")
const { generateUserMetadataID } = require("../../../db/utils")
require("../../../utilities/workerRequests")
jest.mock("../../../utilities/workerRequests", () => ({
getGlobalUsers: jest.fn(() => {
return {
email: "test@test.com",
_id: "us_uuid1",
}
}),
saveGlobalUser: jest.fn(() => {
return {
_id: "us_uuid1",
}
}),
saveGlobalUser: jest.fn(),
}))
describe("/authenticate", () => {
@ -22,14 +27,14 @@ describe("/authenticate", () => {
describe("fetch self", () => {
it("should be able to fetch self", async () => {
await config.createUser("test@test.com", "p4ssw0rd")
const headers = await config.login("test@test.com", "p4ssw0rd")
const user = await config.createUser("test@test.com", "p4ssw0rd")
const headers = await config.login("test@test.com", "p4ssw0rd", { userId: "us_uuid1" })
const res = await request
.get(`/api/self`)
.set(headers)
.expect("Content-Type", /json/)
.expect(200)
expect(res.body.email).toEqual("test@test.com")
expect(res.body._id).toEqual(generateUserMetadataID("us_uuid1"))
})
})
})

5
packages/server/src/api/routes/tests/routing.spec.js
View File

@ -4,11 +4,6 @@ const { checkBuilderEndpoint } = require("./utilities/TestFunctions")
const { BUILTIN_ROLE_IDS } = require("../../../utilities/security/roles")
const workerRequests = require("../../../utilities/workerRequests")
jest.mock("../../../utilities/workerRequests", () => ({
getGlobalUsers: jest.fn(),
saveGlobalUser: jest.fn(),
}))
const route = "/test"
describe("/routing", () => {

43
packages/server/src/api/routes/tests/user.spec.js
View File

@ -7,7 +7,10 @@ const workerRequests = require("../../../utilities/workerRequests")
jest.mock("../../../utilities/workerRequests", () => ({
getGlobalUsers: jest.fn(),
saveGlobalUser: jest.fn(() => {
return {}
const uuid = require("uuid/v4")
return {
_id: `us_${uuid()}`
}
}),
deleteGlobalUser: jest.fn(),
}))
@ -26,10 +29,10 @@ describe("/users", () => {
beforeEach(() => {
workerRequests.getGlobalUsers.mockImplementationOnce(() => ([
{
email: "brenda@brenda.com"
_id: "us_uuid1",
},
{
email: "pam@pam.com"
_id: "us_uuid2",
}
]
))
@ -45,8 +48,8 @@ describe("/users", () => {
.expect(200)
expect(res.body.length).toBe(2)
expect(res.body.find(u => u.email === "brenda@brenda.com")).toBeDefined()
expect(res.body.find(u => u.email === "pam@pam.com")).toBeDefined()
expect(res.body.find(u => u._id === `ro_ta_users_us_uuid1`)).toBeDefined()
expect(res.body.find(u => u._id === `ro_ta_users_us_uuid2`)).toBeDefined()
})
it("should apply authorization to endpoint", async () => {
@ -66,10 +69,10 @@ describe("/users", () => {
beforeEach(() => {
workerRequests.getGlobalUsers.mockImplementationOnce(() => ([
{
email: "bill@budibase.com"
_id: "us_uuid1",
},
{
email: "brandNewUser@user.com"
_id: "us_uuid2",
}
]
))
@ -86,7 +89,6 @@ describe("/users", () => {
it("returns a success message when a user is successfully created", async () => {
const body = basicUser(BUILTIN_ROLE_IDS.POWER)
body.email = "bill@budibase.com"
const res = await create(body)
expect(res.res.statusMessage).toEqual("OK")
@ -95,7 +97,6 @@ describe("/users", () => {
it("should apply authorization to endpoint", async () => {
const body = basicUser(BUILTIN_ROLE_IDS.POWER)
body.email = "brandNewUser@user.com"
await checkPermissionsEndpoint({
config,
method: "POST",
@ -110,13 +111,6 @@ describe("/users", () => {
const user = basicUser(null)
await create(user, 400)
})
it("should throw error if user exists already", async () => {
await config.createUser("test@test.com")
const user = basicUser(BUILTIN_ROLE_IDS.POWER)
user.email = "test@test.com"
await create(user, 409)
})
})
describe("update", () => {
@ -141,10 +135,9 @@ describe("/users", () => {
describe("destroy", () => {
it("should be able to delete the user", async () => {
const email = "test@test.com"
await config.createUser(email)
const user = await config.createUser()
const res = await request
.delete(`/api/users/metadata/${email}`)
.delete(`/api/users/metadata/${user._id}`)
.set(config.defaultHeaders())
.expect(200)
.expect("Content-Type", /json/)
@ -156,21 +149,23 @@ describe("/users", () => {
describe("find", () => {
beforeEach(() => {
jest.resetAllMocks()
workerRequests.saveGlobalUser.mockImplementationOnce(() => ({
_id: "us_uuid1",
}))
workerRequests.getGlobalUsers.mockImplementationOnce(() => ({
email: "test@test.com",
_id: "us_uuid1",
roleId: BUILTIN_ROLE_IDS.POWER,
}))
})
it("should be able to find the user", async () => {
const email = "test@test.com"
await config.createUser(email)
const user = await config.createUser()
const res = await request
.get(`/api/users/metadata/${email}`)
.get(`/api/users/metadata/${user._id}`)
.set(config.defaultHeaders())
.expect(200)
.expect("Content-Type", /json/)
expect(res.body.email).toEqual(email)
expect(res.body._id).toEqual(user._id)
expect(res.body.roleId).toEqual(BUILTIN_ROLE_IDS.POWER)
expect(res.body.tableId).toBeDefined()
})

16
packages/server/src/api/routes/tests/utilities/TestFunctions.js
View File

@ -63,11 +63,9 @@ exports.checkPermissionsEndpoint = async ({
}) => {
const password = "PASSWORD"
await config.createUser("passUser@budibase.com", password, passRole)
const passHeader = await config.login(
"passUser@budibase.com",
password,
passRole
)
const passHeader = await config.login("passUser@budibase.com", password, {
roleId: passRole,
})
await exports
.createRequest(config.request, method, url, body)
@ -75,11 +73,9 @@ exports.checkPermissionsEndpoint = async ({
.expect(200)
await config.createUser("failUser@budibase.com", password, failRole)
const failHeader = await config.login(
"failUser@budibase.com",
password,
failRole
)
const failHeader = await config.login("failUser@budibase.com", password, {
roleId: failRole,
})
await exports
.createRequest(config.request, method, url, body)

9
packages/server/src/api/routes/tests/utilities/index.js
View File

@ -2,6 +2,15 @@ const TestConfig = require("../../../../tests/utilities/TestConfiguration")
const structures = require("../../../../tests/utilities/structures")
const env = require("../../../../environment")
jest.mock("../../../../utilities/workerRequests", () => ({
getGlobalUsers: jest.fn(),
saveGlobalUser: jest.fn(() => {
return {
_id: "us_uuid1",
}
}),
}))
exports.delay = ms => new Promise(resolve => setTimeout(resolve, ms))
let request, config

10
packages/server/src/api/routes/user.js
View File

@ -16,7 +16,7 @@ router
controller.fetchMetadata
)
.get(
"/api/users/metadata/:email",
"/api/users/metadata/:id",
authorized(PermissionTypes.USER, PermissionLevels.READ),
controller.findMetadata
)
@ -31,8 +31,14 @@ router
usage,
controller.createMetadata
)
.post(
"/api/users/metadata/self",
authorized(PermissionTypes.USER, PermissionLevels.WRITE),
usage,
controller.updateSelfMetadata
)
.delete(
"/api/users/metadata/:email",
"/api/users/metadata/:id",
authorized(PermissionTypes.USER, PermissionLevels.WRITE),
usage,
controller.destroyMetadata

1
packages/server/src/automations/tests/createUser.spec.js
View File

@ -25,6 +25,7 @@ describe("test the create user action", () => {
expect(res.id).toBeDefined()
expect(res.revision).toBeDefined()
const userDoc = await config.getRow(InternalTables.USER_METADATA, res.id)
expect(userDoc).toBeDefined()
})
it("should return an error if no inputs provided", async () => {

1
packages/server/src/constants/index.js
View File

@ -33,6 +33,7 @@ exports.USERS_TABLE_SCHEMA = {
type: "table",
views: {},
name: "Users",
// TODO: ADMIN PANEL - when implemented this doesn't need to be carried out
schema: {
email: {
type: exports.FieldTypes.STRING,

16
packages/server/src/db/utils.js
View File

@ -127,23 +127,23 @@ exports.generateRowID = (tableId, id = null) => {
/**
* Gets parameters for retrieving users, this is a utility function for the getDocParams function.
*/
exports.getUserMetadataParams = (email = "", otherProps = {}) => {
return exports.getRowParams(InternalTables.USER_METADATA, email, otherProps)
exports.getUserMetadataParams = (userId = null, otherProps = {}) => {
return exports.getRowParams(InternalTables.USER_METADATA, userId, otherProps)
}
/**
* Generates a new user ID based on the passed in email.
* @param {string} email The email which the ID is going to be built up of.
* Generates a new user ID based on the passed in global ID.
* @param {string} globalId The ID of the global user.
* @returns {string} The new user ID which the user doc can be stored under.
*/
exports.generateUserMetadataID = email => {
return exports.generateRowID(InternalTables.USER_METADATA, email)
exports.generateUserMetadataID = globalId => {
return exports.generateRowID(InternalTables.USER_METADATA, globalId)
}
/**
* Breaks up the ID to get the email address back out of it.
* Breaks up the ID to get the global ID.
*/
exports.getEmailFromUserMetadataID = id => {
exports.getGlobalIDFromUserMetadataID = id => {
return id.split(
`${DocumentTypes.ROW}${SEPARATOR}${InternalTables.USER_METADATA}${SEPARATOR}`
)[1]

38
packages/server/src/middleware/currentapp.js
View File

@ -1,8 +1,11 @@
const { getAppId, setCookie, getCookie, Cookies } = require("@budibase/auth")
const { getRole } = require("../utilities/security/roles")
const { generateUserMetadataID } = require("../db/utils")
const { getGlobalUsers } = require("../utilities/workerRequests")
const { BUILTIN_ROLE_IDS } = require("../utilities/security/roles")
const {
getGlobalIDFromUserMetadataID,
generateUserMetadataID,
} = require("../db/utils")
module.exports = async (ctx, next) => {
// try to get the appID from the request
@ -27,7 +30,8 @@ module.exports = async (ctx, next) => {
appCookie.roleId === BUILTIN_ROLE_IDS.PUBLIC)
) {
// Different App ID means cookie needs reset, or if the same public user has logged in
const globalUser = await getGlobalUsers(ctx, requestAppId, ctx.user.email)
const globalId = getGlobalIDFromUserMetadataID(ctx.user.userId)
const globalUser = await getGlobalUsers(ctx, requestAppId, globalId)
updateCookie = true
appId = requestAppId
if (globalUser.roles && globalUser.roles[requestAppId]) {
@ -37,22 +41,24 @@ module.exports = async (ctx, next) => {
appId = appCookie.appId
roleId = appCookie.roleId || BUILTIN_ROLE_IDS.PUBLIC
}
if (appId) {
ctx.appId = appId
if (roleId) {
const userId = ctx.user
? generateUserMetadataID(ctx.user.email)
: undefined
ctx.roleId = roleId
ctx.user = {
...ctx.user,
_id: userId,
userId,
role: await getRole(appId, roleId),
}
// nothing more to do
if (!appId) {
return next()
}
ctx.appId = appId
if (roleId) {
ctx.roleId = roleId
const userId = ctx.user ? generateUserMetadataID(ctx.user.userId) : null
ctx.user = {
...ctx.user,
// override userID with metadata one
_id: userId,
userId,
role: await getRole(appId, roleId),
}
}
if (updateCookie && appId) {
if (updateCookie) {
setCookie(ctx, { appId, roleId }, Cookies.CurrentApp)
}
return next()

4
packages/server/src/middleware/tests/currentapp.spec.js
View File

@ -5,7 +5,7 @@ function mockWorker() {
jest.mock("../../utilities/workerRequests", () => ({
getGlobalUsers: () => {
return {
email: "test@test.com",
email: "us_uuid1",
roles: {
"app_test": "BASIC",
}
@ -59,7 +59,7 @@ class TestConfiguration {
setUser() {
this.ctx.user = {
email: "test@test.com",
userId: "ro_ta_user_us_uuid1",
}
}

34
packages/server/src/tests/utilities/TestConfiguration.js
View File

@ -70,8 +70,7 @@ class TestConfiguration {
defaultHeaders() {
const user = {
userId: "us_test@test.com",
email: "test@test.com",
userId: "ro_ta_user_us_uuid1",
builder: {
global: true,
},
@ -106,12 +105,13 @@ class TestConfiguration {
}
async roleHeaders(email = EMAIL, roleId = BUILTIN_ROLE_IDS.ADMIN) {
let user
try {
await this.createUser(email, PASSWORD, roleId)
user = await this.createUser(email, PASSWORD, roleId)
} catch (err) {
// allow errors here
}
return this.login(email, PASSWORD, roleId)
return this.login(email, PASSWORD, { roleId, userId: user._id })
}
async createApp(appName) {
@ -293,33 +293,19 @@ class TestConfiguration {
)
}
async makeUserInactive(email) {
const user = await this._req(
null,
{
email,
},
controllers.user.findMetadata
)
return this._req(
{
...user,
status: "inactive",
},
null,
controllers.user.updateMetadata
)
}
async login(email, password, roleId = BUILTIN_ROLE_IDS.BUILDER) {
async login(email, password, { roleId, userId } = {}) {
if (!roleId) {
roleId = BUILTIN_ROLE_IDS.BUILDER
}
if (!this.request) {
throw "Server has not been opened, cannot login."
}
if (!email || !password) {
await this.createUser()
}
// have to fake this
const user = {
userId: `us_${email || EMAIL}`,
userId: userId || `us_uuid1`,
email: email || EMAIL,
}
const app = {

20
packages/server/src/utilities/users.js
View File

@ -1,20 +1,18 @@
const CouchDB = require("../db")
const {
generateUserMetadataID,
getEmailFromUserMetadataID,
} = require("../db/utils")
const { getGlobalIDFromUserMetadataID } = require("../db/utils")
const { getGlobalUsers } = require("../utilities/workerRequests")
exports.getFullUser = async ({ ctx, email, userId }) => {
if (!email) {
email = getEmailFromUserMetadataID(userId)
}
const global = await getGlobalUsers(ctx, ctx.appId, email)
exports.getFullUser = async (ctx, userId) => {
const global = await getGlobalUsers(
ctx,
ctx.appId,
getGlobalIDFromUserMetadataID(userId)
)
let metadata
try {
// this will throw an error if the db doesn't exist, or there is no appId
const db = new CouchDB(ctx.appId)
metadata = await db.get(generateUserMetadataID(email))
metadata = await db.get(userId)
} catch (err) {
// it is fine if there is no user metadata, just remove global db info
delete global._id
@ -24,6 +22,6 @@ exports.getFullUser = async ({ ctx, email, userId }) => {
...global,
...metadata,
// make sure the ID is always a local ID, not a global one
_id: generateUserMetadataID(email),
_id: userId,
}
}

23
packages/server/src/utilities/workerRequests.js
View File

@ -60,8 +60,8 @@ exports.getDeployedApps = async ctx => {
}
}
exports.deleteGlobalUser = async (ctx, email) => {
const endpoint = `/api/admin/users/${email}`
exports.deleteGlobalUser = async (ctx, globalId) => {
const endpoint = `/api/admin/users/${globalId}`
const reqCfg = { method: "DELETE" }
const response = await fetch(
checkSlashesInUrl(env.WORKER_URL + endpoint),
@ -70,8 +70,10 @@ exports.deleteGlobalUser = async (ctx, email) => {
return response.json()
}
exports.getGlobalUsers = async (ctx, appId = null, email = null) => {
const endpoint = email ? `/api/admin/users/${email}` : `/api/admin/users`
exports.getGlobalUsers = async (ctx, appId = null, globalId = null) => {
const endpoint = globalId
? `/api/admin/users/${globalId}`
: `/api/admin/users`
const reqCfg = { method: "GET" }
const response = await fetch(
checkSlashesInUrl(env.WORKER_URL + endpoint),
@ -89,8 +91,10 @@ exports.getGlobalUsers = async (ctx, appId = null, email = null) => {
return users
}
exports.saveGlobalUser = async (ctx, appId, email, body) => {
const globalUser = await exports.getGlobalUsers(ctx, appId, email)
exports.saveGlobalUser = async (ctx, appId, body) => {
const globalUser = body._id
? await exports.getGlobalUsers(ctx, appId, body._id)
: {}
const roles = globalUser.roles || {}
if (body.roleId) {
roles[appId] = body.roleId
@ -100,9 +104,9 @@ exports.saveGlobalUser = async (ctx, appId, email, body) => {
method: "POST",
body: {
...globalUser,
email,
password: body.password || undefined,
status: body.status,
email: body.email,
roles,
builder: {
global: true,
@ -124,5 +128,8 @@ exports.saveGlobalUser = async (ctx, appId, email, body) => {
delete body.status
delete body.roles
delete body.builder
return body
return {
...body,
_id: json._id,
}
}

6
packages/worker/src/api/controllers/admin/groups.js
View File

@ -31,15 +31,13 @@ exports.fetch = async function(ctx) {
include_docs: true,
})
)
const groups = response.rows.map(row => row.doc)
ctx.body = groups
ctx.body = response.rows.map(row => row.doc)
}
exports.find = async function(ctx) {
const db = new CouchDB(GLOBAL_DB)
try {
const record = await db.get(ctx.params.id)
ctx.body = record
ctx.body = await db.get(ctx.params.id)
} catch (err) {
ctx.throw(err.status, err)
}

59
packages/worker/src/api/controllers/admin/users.js
View File

@ -1,27 +1,42 @@
const CouchDB = require("../../../db")
const {
hash,
generateUserID,
getUserParams,
generateGlobalUserID,
getGlobalUserParams,
StaticDatabases,
getGlobalUserByEmail,
} = require("@budibase/auth")
const { UserStatus } = require("../../../constants")
const FIRST_USER_EMAIL = "test@test.com"
const FIRST_USER_PASSWORD = "test"
const GLOBAL_DB = StaticDatabases.GLOBAL.name
exports.userSave = async ctx => {
const db = new CouchDB(GLOBAL_DB)
const { email, password, _id } = ctx.request.body
const hashedPassword = password ? await hash(password) : null
let user = {
...ctx.request.body,
_id: generateUserID(email),
password: hashedPassword,
// make sure another user isn't using the same email
const dbUser = await getGlobalUserByEmail(email)
if (dbUser != null && (dbUser._id !== _id || Array.isArray(dbUser))) {
ctx.throw(400, "Email address already in use.")
}
let dbUser
// in-case user existed already
if (_id) {
dbUser = await db.get(_id)
// get the password, make sure one is defined
let hashedPassword
if (password) {
hashedPassword = await hash(password)
} else if (dbUser) {
hashedPassword = dbUser.password
} else {
ctx.throw(400, "Password must be specified.")
}
let user = {
...dbUser,
...ctx.request.body,
_id: _id || generateGlobalUserID(),
password: hashedPassword,
}
// add the active status to a user if its not provided
if (user.status == null) {
@ -29,7 +44,7 @@ exports.userSave = async ctx => {
}
try {
const response = await db.post({
password: hashedPassword || dbUser.password,
password: hashedPassword,
...user,
})
ctx.body = {
@ -46,12 +61,24 @@ exports.userSave = async ctx => {
}
}
exports.firstUser = async ctx => {
ctx.request.body = {
email: FIRST_USER_EMAIL,
password: FIRST_USER_PASSWORD,
roles: {},
builder: {
global: true,
},
}
await exports.userSave(ctx)
}
exports.userDelete = async ctx => {
const db = new CouchDB(GLOBAL_DB)
const dbUser = await db.get(generateUserID(ctx.params.email))
const dbUser = await db.get(ctx.params.id)
await db.remove(dbUser._id, dbUser._rev)
ctx.body = {
message: `User ${ctx.params.email} deleted.`,
message: `User ${ctx.params.id} deleted.`,
}
}
@ -59,7 +86,7 @@ exports.userDelete = async ctx => {
exports.userFetch = async ctx => {
const db = new CouchDB(GLOBAL_DB)
const response = await db.allDocs(
getUserParams(null, {
getGlobalUserParams(null, {
include_docs: true,
})
)
@ -78,7 +105,7 @@ exports.userFind = async ctx => {
const db = new CouchDB(GLOBAL_DB)
let user
try {
user = await db.get(generateUserID(ctx.params.email))
user = await db.get(ctx.params.id)
} catch (err) {
// no user found, just return nothing
user = {}

5
packages/worker/src/api/routes/admin/users.js
View File

@ -32,8 +32,9 @@ router
authenticated,
controller.userSave
)
.delete("/api/admin/users/:email", authenticated, controller.userDelete)
.post("/api/admin/users/first", controller.firstUser)
.delete("/api/admin/users/:id", authenticated, controller.userDelete)
.get("/api/admin/users", authenticated, controller.userFetch)
.get("/api/admin/users/:email", authenticated, controller.userFind)
.get("/api/admin/users/:id", authenticated, controller.userFind)
module.exports = router

35
packages/worker/src/db/utils.js
View File

@ -1,35 +0,0 @@
exports.StaticDatabases = {
USER: {
name: "user-db",
},
}
const DocumentTypes = {
USER: "us",
APP: "app",
}
exports.DocumentTypes = DocumentTypes
const UNICODE_MAX = "\ufff0"
const SEPARATOR = "_"
/**
* Generates a new user ID based on the passed in email.
* @param {string} email The email which the ID is going to be built up of.
* @returns {string} The new user ID which the user doc can be stored under.
*/
exports.generateUserID = email => {
return `${DocumentTypes.USER}${SEPARATOR}${email}`
}
/**
* Gets parameters for retrieving users, this is a utility function for the getDocParams function.
*/
exports.getUserParams = (email = "", otherProps = {}) => {
return {
...otherProps,
startkey: `${DocumentTypes.USER}${SEPARATOR}${email}`,
endkey: `${DocumentTypes.USER}${SEPARATOR}${email}${UNICODE_MAX}`,
}
}