From 19d132c6c24b35a185f5426ee681d0a50eb3c2db Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Fri, 12 Jun 2020 20:42:55 +0100
Subject: [PATCH 01/15] removal of appRoot - appId comes in cookie

---
 packages/builder/cypress/plugins/index.js     |  21 +++
 .../builder/src/builderStore/store/index.js   |  56 ++----
 .../builder/src/builderStore/storeUtils.js    |  13 ++
 .../common/Inputs/InputGroup.svelte           |   7 +-
 .../AppPreview/CurrentItemPreview.svelte      |  40 +++--
 .../AppPreview/CurrentItemPreview.svelte.orig | 161 ++++++++++++++++++
 .../AppPreview/iframeTemplate.js              |   1 +
 .../ComponentPropertiesPanel.svelte           |  26 +--
 .../components/userInterface/PagesList.svelte |   4 +-
 .../userInterface/SettingsView.svelte         |  40 +++++
 .../userInterface/propertyCategories.js       |  82 +++++++--
 .../userInterface/temporaryPanelStructure.js  |  12 ++
 packages/client/src/api/index.js              |   5 +-
 packages/client/src/createApp.js              |  11 +-
 packages/client/src/index.js                  |   9 +-
 packages/client/src/render/getAppId.js        |   5 +
 packages/client/src/render/screenRouter.js    |  16 +-
 packages/client/src/state/bbComponentApi.js   |  14 +-
 packages/client/src/state/eventHandlers.js    |   3 +-
 packages/client/src/state/stateManager.js     |   5 +-
 packages/client/tests/testAppDef.js           |   9 +-
 .../src/Test/createApp.js                     |   8 +-
 packages/server/package.json                  |   2 +-
 packages/server/src/api/controllers/auth.js   |  12 +-
 packages/server/src/api/controllers/model.js  |  32 +++-
 packages/server/src/api/controllers/record.js |  11 +-
 packages/server/src/api/controllers/static.js |  30 +++-
 packages/server/src/api/index.js              |   9 +
 packages/server/src/api/routes/auth.js        |   2 +-
 packages/server/src/api/routes/index.js       |   2 +
 packages/server/src/api/routes/model.js       |  38 +----
 packages/server/src/api/routes/record.js      |  36 ++++
 packages/server/src/api/routes/static.js      |   5 +-
 .../src/api/routes/tests/couchTestUtils.js    |   4 +
 .../server/src/api/routes/tests/model.spec.js |  47 ++++-
 .../src/api/routes/tests/record.spec.js       |  24 +++
 .../server/src/utilities/builder/buildPage.js |   6 +-
 .../src/utilities/builder/index.template.html |   8 +-
 packages/standard-components/components.json  |   7 +
 .../public/clientAppDefinition.js             |   1 -
 packages/standard-components/src/Embed.svelte |   5 +
 packages/standard-components/src/Login.svelte |  19 +--
 .../standard-components/src/Test/createApp.js |   2 +-
 packages/standard-components/src/index.js     |   1 +
 44 files changed, 616 insertions(+), 235 deletions(-)
 create mode 100644 packages/builder/cypress/plugins/index.js
 create mode 100644 packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte.orig
 create mode 100644 packages/client/src/render/getAppId.js
 create mode 100644 packages/server/src/api/routes/record.js
 create mode 100644 packages/standard-components/src/Embed.svelte

diff --git a/packages/builder/cypress/plugins/index.js b/packages/builder/cypress/plugins/index.js
new file mode 100644
index 0000000000..aa9918d215
--- /dev/null
+++ b/packages/builder/cypress/plugins/index.js
@@ -0,0 +1,21 @@
+/// <reference types="cypress" />
+// ***********************************************************
+// This example plugins/index.js can be used to load plugins
+//
+// You can change the location of this file or turn off loading
+// the plugins file with the 'pluginsFile' configuration option.
+//
+// You can read more here:
+// https://on.cypress.io/plugins-guide
+// ***********************************************************
+
+// This function is called when a project is opened or re-opened (e.g. due to
+// the project's config changing)
+
+/**
+ * @type {Cypress.PluginConfig}
+ */
+module.exports = (on, config) => {
+  // `on` is used to hook into various events Cypress emits
+  // `config` is the resolved Cypress config
+}
diff --git a/packages/builder/src/builderStore/store/index.js b/packages/builder/src/builderStore/store/index.js
index 9f91550bca..1f3ea9c0ef 100644
--- a/packages/builder/src/builderStore/store/index.js
+++ b/packages/builder/src/builderStore/store/index.js
@@ -5,7 +5,6 @@ import { writable, get } from "svelte/store"
 import api from "../api"
 import { DEFAULT_PAGES_OBJECT } from "../../constants"
 import { getExactComponent } from "components/userInterface/pagesParsing/searchComponents"
-import { rename } from "components/userInterface/pagesParsing/renameScreen"
 import {
   createProps,
   makePropsSafe,
@@ -24,6 +23,7 @@ import {
   saveCurrentPreviewItem as _saveCurrentPreviewItem,
   saveScreenApi as _saveScreenApi,
   regenerateCssForCurrentScreen,
+  renameCurrentScreen,
 } from "../storeUtils"
 
 export const getStore = () => {
@@ -52,7 +52,6 @@ export const getStore = () => {
   store.createDatabaseForApp = backendStoreActions.createDatabaseForApp(store)
 
   store.saveScreen = saveScreen(store)
-  store.renameScreen = renameScreen(store)
   store.deleteScreen = deleteScreen(store)
   store.setCurrentScreen = setCurrentScreen(store)
   store.setCurrentPage = setCurrentPage(store)
@@ -63,6 +62,7 @@ export const getStore = () => {
   store.addChildComponent = addChildComponent(store)
   store.selectComponent = selectComponent(store)
   store.setComponentProp = setComponentProp(store)
+  store.setPageOrScreenProp = setPageOrScreenProp(store)
   store.setComponentStyle = setComponentStyle(store)
   store.setComponentCode = setComponentCode(store)
   store.setScreenType = setScreenType(store)
@@ -207,46 +207,6 @@ const deleteScreen = store => name => {
   })
 }
 
-const renameScreen = store => (oldname, newname) => {
-  store.update(s => {
-    const { screens, pages, error, changedScreens } = rename(
-      s.pages,
-      s.screens,
-      oldname,
-      newname
-    )
-
-    if (error) {
-      // should really do something with this
-      return s
-    }
-
-    s.screens = screens
-    s.pages = pages
-    if (s.currentPreviewItem.name === oldname)
-      s.currentPreviewItem.name = newname
-
-    const saveAllChanged = async () => {
-      for (let screenName of changedScreens) {
-        const changedScreen = getExactComponent(screens, screenName)
-        await api.post(`/_builder/api/${s.appId}/screen`, changedScreen)
-      }
-    }
-
-    api
-      .patch(`/_builder/api/${s.appId}/screen`, {
-        oldname,
-        newname,
-      })
-      .then(() => saveAllChanged())
-      .then(() => {
-        _savePage(s)
-      })
-
-    return s
-  })
-}
-
 const savePage = store => async page => {
   store.update(state => {
     if (state.currentFrontEndType !== "page" || !state.currentPageName) {
@@ -400,6 +360,18 @@ const setComponentProp = store => (name, value) => {
   })
 }
 
+const setPageOrScreenProp = store => (name, value) => {
+  store.update(state => {
+    if (name === "name" && state.currentFrontEndType === "screen") {
+      state = renameCurrentScreen(value, state)
+    } else {
+      state.currentPreviewItem[name] = value
+      _saveCurrentPreviewItem(state)
+    }
+    return state
+  })
+}
+
 const setComponentStyle = store => (type, name, value) => {
   store.update(state => {
     if (!state.currentComponentInfo._styles) {
diff --git a/packages/builder/src/builderStore/storeUtils.js b/packages/builder/src/builderStore/storeUtils.js
index d6aa4d0308..ff951e6b6f 100644
--- a/packages/builder/src/builderStore/storeUtils.js
+++ b/packages/builder/src/builderStore/storeUtils.js
@@ -45,6 +45,19 @@ export const saveScreenApi = (screen, s) => {
     .then(() => savePage(s))
 }
 
+export const renameCurrentScreen = (newname, state) => {
+  const oldname = state.currentPreviewItem.name
+  state.currentPreviewItem.name = newname
+  api.patch(
+    `/_builder/api/${state.appId}/pages/${state.currentPageName}/screen`,
+    {
+      oldname,
+      newname,
+    }
+  )
+  return state
+}
+
 export const walkProps = (props, action, cancelToken = null) => {
   cancelToken = cancelToken || { cancelled: false }
   action(props, () => {
diff --git a/packages/builder/src/components/common/Inputs/InputGroup.svelte b/packages/builder/src/components/common/Inputs/InputGroup.svelte
index e5fed68103..385623ca19 100644
--- a/packages/builder/src/components/common/Inputs/InputGroup.svelte
+++ b/packages/builder/src/components/common/Inputs/InputGroup.svelte
@@ -19,9 +19,10 @@
     onChange(_value)
   }
 
-  $: displayValues = value && suffix
-    ? value.map(v => v.replace(new RegExp(`${suffix}$`), ""))
-    : value || []
+  $: displayValues =
+    value && suffix
+      ? value.map(v => v.replace(new RegExp(`${suffix}$`), ""))
+      : value || []
 </script>
 
 <div class="input-container">
diff --git a/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte b/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte
index 53450c2200..f97f91df6b 100644
--- a/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte
+++ b/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte
@@ -21,7 +21,7 @@
     return componentName || "element"
   }
 
-  const screenPlaceholder =  {
+  const screenPlaceholder = {
     name: "Screen Placeholder",
     route: "*",
     props: {
@@ -60,9 +60,8 @@
     },
   }
 
-
   $: hasComponent = !!$store.currentPreviewItem
-  
+
   $: {
     styles = ""
     // Apply the CSS from the currently selected page and its screens
@@ -88,11 +87,10 @@
     libraries: $store.libraries,
     page: $store.pages[$store.currentPageName],
     screens: [
-          $store.currentFrontEndType === "page"
-          ? screenPlaceholder
-          : $store.currentPreviewItem,
+      $store.currentFrontEndType === "page"
+        ? screenPlaceholder
+        : $store.currentPreviewItem,
     ],
-    appRootPath: "",
   }
 
   $: selectedComponentType = getComponentTypeName($store.currentComponentInfo)
@@ -102,20 +100,26 @@
     : ""
 
   const refreshContent = () => {
-    iframe.contentWindow.postMessage(JSON.stringify({
-      styles,
-      stylesheetLinks,
-      selectedComponentType,
-      selectedComponentId,
-      frontendDefinition,
-    }))
+    iframe.contentWindow.postMessage(
+      JSON.stringify({
+        styles,
+        stylesheetLinks,
+        selectedComponentType,
+        selectedComponentId,
+        frontendDefinition,
+        appId: $store.appId,
+      })
+    )
   }
 
-  $: if(iframe) iframe.contentWindow.addEventListener("bb-ready", refreshContent, { once: true })
+  $: if (iframe)
+    iframe.contentWindow.addEventListener("bb-ready", refreshContent, {
+      once: true,
+    })
 
-  $: if(iframe && frontendDefinition) {
-		refreshContent()
-	}
+  $: if (iframe && frontendDefinition) {
+    refreshContent()
+  }
 </script>
 
 <div class="component-container">
diff --git a/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte.orig b/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte.orig
new file mode 100644
index 0000000000..81c3624274
--- /dev/null
+++ b/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte.orig
@@ -0,0 +1,161 @@
+<script>
+  import { store, backendUiStore } from "builderStore"
+  import { map, join } from "lodash/fp"
+  import iframeTemplate from "./iframeTemplate"
+  import { pipe } from "components/common/core"
+
+  let iframe
+  let styles = ""
+
+  function transform_component(comp) {
+    const props = comp.props || comp
+    if (props && props._children && props._children.length) {
+      props._children = props._children.map(transform_component)
+    }
+
+    return props
+  }
+
+  const getComponentTypeName = component => {
+    let [componentName] = component._component.match(/[a-z]*$/)
+    return componentName || "element"
+  }
+
+  const screenPlaceholder = {
+    name: "Screen Placeholder",
+    route: "*",
+    props: {
+      _component: "@budibase/standard-components/container",
+      type: "div",
+      _children: [
+        {
+          _component: "@budibase/standard-components/container",
+          _styles: { normal: {}, hover: {}, active: {}, selected: {} },
+          _id: "__screenslot__text",
+          _code: "",
+          className: "",
+          onLoad: [],
+          type: "div",
+          _children: [
+            {
+              _component: "@budibase/standard-components/text",
+              _styles: {
+                normal: {},
+                hover: {},
+                active: {},
+                selected: {},
+              },
+              _id: "__screenslot__text_2",
+              _code: "",
+              text: "content",
+              font: "",
+              color: "",
+              textAlign: "inline",
+              verticalAlign: "inline",
+              formattingTag: "none",
+            },
+          ],
+        },
+      ],
+    },
+  }
+
+  $: hasComponent = !!$store.currentPreviewItem
+
+  $: {
+    styles = ""
+    // Apply the CSS from the currently selected page and its screens
+    const currentPage = $store.pages[$store.currentPageName]
+    styles += currentPage._css
+    for (let screen of currentPage._screens) {
+      styles += screen._css
+    }
+    styles = styles
+  }
+
+  $: stylesheetLinks = pipe($store.pages.stylesheets, [
+    map(s => `<link rel="stylesheet" href="${s}"/>`),
+    join("\n"),
+  ])
+
+  $: screensExist =
+    $store.currentPreviewItem._screens &&
+    $store.currentPreviewItem._screens.length > 0
+
+  $: frontendDefinition = {
+    appId: $store.appId,
+    libraries: $store.libraries,
+    page: $store.pages[$store.currentPageName],
+    screens: [
+      $store.currentFrontEndType === "page"
+        ? screenPlaceholder
+        : $store.currentPreviewItem,
+    ],
+  }
+
+  $: selectedComponentType = getComponentTypeName($store.currentComponentInfo)
+
+  $: selectedComponentId = $store.currentComponentInfo
+    ? $store.currentComponentInfo._id
+    : ""
+
+  const refreshContent = () => {
+<<<<<<< HEAD
+    iframe.contentWindow.postMessage(JSON.stringify({
+      styles,
+      stylesheetLinks,
+      selectedComponentType,
+      selectedComponentId,
+      frontendDefinition,
+      appId: $store.appId
+    }))
+=======
+    iframe.contentWindow.postMessage(
+      JSON.stringify({
+        styles,
+        stylesheetLinks,
+        selectedComponentType,
+        selectedComponentId,
+        frontendDefinition,
+      })
+    )
+>>>>>>> master
+  }
+
+  $: if (iframe)
+    iframe.contentWindow.addEventListener("bb-ready", refreshContent, {
+      once: true,
+    })
+
+  $: if (iframe && frontendDefinition) {
+    refreshContent()
+  }
+</script>
+
+<div class="component-container">
+  {#if hasComponent && $store.currentPreviewItem}
+    <iframe
+      style="height: 100%; width: 100%"
+      title="componentPreview"
+      bind:this={iframe}
+      srcdoc={iframeTemplate} />
+  {/if}
+</div>
+
+<style>
+  .component-container {
+    grid-row-start: middle;
+    grid-column-start: middle;
+    position: relative;
+    overflow: hidden;
+    margin: auto;
+    height: 100%;
+  }
+
+  .component-container iframe {
+    border: 0;
+    left: 0;
+    top: 0;
+    width: 100%;
+  }
+</style>
diff --git a/packages/builder/src/components/userInterface/AppPreview/iframeTemplate.js b/packages/builder/src/components/userInterface/AppPreview/iframeTemplate.js
index 3d305f1c1d..b1bda4ab4f 100644
--- a/packages/builder/src/components/userInterface/AppPreview/iframeTemplate.js
+++ b/packages/builder/src/components/userInterface/AppPreview/iframeTemplate.js
@@ -44,6 +44,7 @@ export default `<html>
         document.head.appendChild(styles)
         styles.appendChild(document.createTextNode(data.styles))
 
+        document.cookie = "budibase:appid=" + data.appId
         window["##BUDIBASE_FRONTEND_DEFINITION##"] = data.frontendDefinition;
         if (clientModule) {
           clientModule.loadBudibase({ window, localStorage })
diff --git a/packages/builder/src/components/userInterface/ComponentPropertiesPanel.svelte b/packages/builder/src/components/userInterface/ComponentPropertiesPanel.svelte
index bfe5507256..bcebb4d2d4 100644
--- a/packages/builder/src/components/userInterface/ComponentPropertiesPanel.svelte
+++ b/packages/builder/src/components/userInterface/ComponentPropertiesPanel.svelte
@@ -13,7 +13,6 @@
   import CodeEditor from "./CodeEditor.svelte"
   import LayoutEditor from "./LayoutEditor.svelte"
   import EventsEditor from "./EventsEditor"
-
   import panelStructure from "./temporaryPanelStructure.js"
   import CategoryTab from "./CategoryTab.svelte"
   import DesignView from "./DesignView.svelte"
@@ -37,26 +36,11 @@
       //use for getting controls for each component property
       c => c._component === componentInstance._component
     ) || {}
-  
+
   let panelDefinition = {}
 
-  $: {
-    if(componentPropDefinition.properties) {
-      if(selectedCategory.value === "design") {
-        panelDefinition = componentPropDefinition.properties["design"]
-      }else{
-        let panelDef = componentPropDefinition.properties["settings"]
-        if($store.currentFrontEndType === "page" && $store.currentView !== "component") {
-          panelDefinition = [...page,...panelDef]
-        }else if($store.currentFrontEndType === "screen" && $store.currentView !== "component") {
-          panelDefinition = [...screen, ...panelDef]
-        }else {
-          panelDefinition = panelDef
-        }
-      }
-    }
-  }
-
+  $: panelDefinition = componentPropDefinition.properties && 
+      componentPropDefinition.properties[selectedCategory.value]
 
   const onStyleChanged = store.setComponentStyle
   const onPropChanged = store.setComponentProp
@@ -102,7 +86,9 @@
         {componentInstance}
         {componentDefinition}
         {panelDefinition}
-        onChange={onPropChanged} />
+        onChange={onPropChanged}
+        onScreenPropChange={store.setPageOrScreenProp}
+        screenOrPageInstance={$store.currentView !== "component" && $store.currentPreviewItem} />
     {:else if selectedCategory.value === 'events'}
       <EventsEditor component={componentInstance} />
     {/if}
diff --git a/packages/builder/src/components/userInterface/PagesList.svelte b/packages/builder/src/components/userInterface/PagesList.svelte
index 4a87c4ac8a..5a78ef7121 100644
--- a/packages/builder/src/components/userInterface/PagesList.svelte
+++ b/packages/builder/src/components/userInterface/PagesList.svelte
@@ -9,11 +9,11 @@
 
   const pages = [
     {
-      title: "Main",
+      title: "Private",
       id: "main",
     },
     {
-      title: "Login",
+      title: "Public",
       id: "unauthenticated",
     },
   ]
diff --git a/packages/builder/src/components/userInterface/SettingsView.svelte b/packages/builder/src/components/userInterface/SettingsView.svelte
index 99e704d1d9..17e4fe5e71 100644
--- a/packages/builder/src/components/userInterface/SettingsView.svelte
+++ b/packages/builder/src/components/userInterface/SettingsView.svelte
@@ -2,20 +2,60 @@
   import PropertyControl from "./PropertyControl.svelte"
   import InputGroup from "../common/Inputs/InputGroup.svelte"
   import Colorpicker from "../common/Colorpicker.svelte"
+  import { goto } from "@sveltech/routify"
   import { excludeProps } from "./propertyCategories.js"
+  import Input from "../common/Input.svelte"
 
   export let panelDefinition = []
   export let componentDefinition = {}
   export let componentInstance = {}
   export let onChange = () => {}
+  export let onScreenPropChange = () => {}
+  export let screenOrPageInstance
 
   const propExistsOnComponentDef = prop => prop in componentDefinition.props
 
   function handleChange(key, data) {
     data.target ? onChange(key, data.target.value) : onChange(key, data)
   }
+
+  function handleScreenPropChange (name, value) {
+    onScreenPropChange(name,value)
+    if(!isPage && name === "name") {
+      // screen name is changed... change URL
+      $goto(`./:page/${value}`)
+    }
+  }
+
+  const screenDefinition = [
+    { key: "name", label: "Name", control: Input },
+    { key: "description", label: "Description", control: Input },
+    { key: "route", label: "Route", control: Input },
+  ]
+
+  const pageDefinition = [
+    { key: "title", label: "Title", control: Input },
+    { key: "favicon", label: "Favicon", control: Input },
+  ]
+
+  $: isPage = screenOrPageInstance && screenOrPageInstance.favicon
+  $: screenOrPageDefinition = isPage ? pageDefinition : screenDefinition
+
 </script>
 
+{#if screenOrPageInstance}
+  {#each screenOrPageDefinition as def}
+    <PropertyControl
+        control={def.control}
+        label={def.label}
+        key={def.key}
+        value={screenOrPageInstance[def.key]}
+        onChange={handleScreenPropChange}
+        props={{ ...excludeProps(def, ['control', 'label']) }} />
+  {/each}
+  <hr/>
+{/if}
+
 {#if panelDefinition && panelDefinition.length > 0}
   {#each panelDefinition as definition}
     {#if propExistsOnComponentDef(definition.key)}
diff --git a/packages/builder/src/components/userInterface/propertyCategories.js b/packages/builder/src/components/userInterface/propertyCategories.js
index 38ef0558e4..c0485304ce 100644
--- a/packages/builder/src/components/userInterface/propertyCategories.js
+++ b/packages/builder/src/components/userInterface/propertyCategories.js
@@ -12,8 +12,9 @@ export const layout = [
     label: "Display",
     key: "display",
     control: OptionSelect,
-    initialValue: "Flex",
+    initialValue: "",
     options: [
+      { label: "", value: "" },
       { label: "Flex", value: "flex" },
       { label: "Inline Flex", value: "inline-flex" },
     ],
@@ -39,6 +40,7 @@ export const layout = [
     control: OptionSelect,
     initialValue: "Flex Start",
     options: [
+      { label: "", value: "" },
       { label: "Flex Start", value: "flex-start" },
       { label: "Flex End", value: "flex-end" },
       { label: "Center", value: "center" },
@@ -317,19 +319,31 @@ export const border = [
   {
     label: "Radius",
     key: "border-radius",
-    control: Input,
-    width: "48px",
-    placeholder: "px",
-    textAlign: "center",
+    control: OptionSelect,
+    defaultValue: "None",
+    options: [
+      { label: "None", value: "0" },
+      { label: "small", value: "0.125rem" },
+      { label: "Medium", value: "0.25rem;" },
+      { label: "Large", value: "0.375rem" },
+      { label: "Extra large", value: "0.5rem" },
+      { label: "Full", value: "5678px" },
+    ],
   },
   {
     label: "Width",
     key: "border-width",
-    control: Input,
-    width: "48px",
-    placeholder: "px",
-    textAlign: "center",
-  }, //custom
+    control: OptionSelect,
+    defaultValue: "None",
+    options: [
+      { label: "None", value: "0" },
+      { label: "Extra small", value: "0.5px" },
+      { label: "Small", value: "1px" },
+      { label: "Medium", value: "2px" },
+      { label: "Large", value: "4px" },
+      { label: "Extra large", value: "8px" },
+    ],
+  },
   {
     label: "Color",
     key: "border-color",
@@ -339,6 +353,7 @@ export const border = [
     label: "Style",
     key: "border-style",
     control: OptionSelect,
+    defaultValue: "None",
     options: [
       "none",
       "hidden",
@@ -365,17 +380,50 @@ export const effects = [
   },
   {
     label: "Rotate",
-    key: "transform",
-    control: Input,
-    width: "48px",
-    textAlign: "center",
-    placeholder: "deg",
+    key: "transform-rotate",
+    control: OptionSelect,
+    defaultValue: "0",
+    options: [
+      "0",
+      "45deg",
+      "90deg",
+      "90deg",
+      "135deg",
+      "180deg",
+      "225deg",
+      "270deg",
+      "315dev",
+    ],
   }, //needs special control
   {
     label: "Shadow",
     key: "box-shadow",
-    control: InputGroup,
-    meta: [{ placeholder: "X" }, { placeholder: "Y" }, { placeholder: "B" }],
+    control: OptionSelect,
+    defaultValue: "None",
+    options: [
+      { label: "None", value: "none" },
+      { label: "Extra small", value: "0 1px 2px 0 rgba(0, 0, 0, 0.05)" },
+      {
+        label: "Small",
+        value:
+          "0 1px 3px 0 rgba(0, 0, 0, 0.1), 0 1px 2px 0 rgba(0, 0, 0, 0.06)",
+      },
+      {
+        label: "Medium",
+        value:
+          "0 4px 6px -1px rgba(0, 0, 0, 0.1), 0 2px 4px -1px rgba(0, 0, 0, 0.06)",
+      },
+      {
+        label: "Large",
+        value:
+          "0 10px 15px -3px rgba(0, 0, 0, 0.1), 0 4px 6px -2px rgba(0, 0, 0, 0.05)",
+      },
+      {
+        label: "Extra large",
+        value:
+          "0 20px 25px -5px rgba(0, 0, 0, 0.1), 0 10px 10px -5px rgba(0, 0, 0, 0.04)",
+      },
+    ],
   },
 ]
 
diff --git a/packages/builder/src/components/userInterface/temporaryPanelStructure.js b/packages/builder/src/components/userInterface/temporaryPanelStructure.js
index afd3a06694..7315e09736 100644
--- a/packages/builder/src/components/userInterface/temporaryPanelStructure.js
+++ b/packages/builder/src/components/userInterface/temporaryPanelStructure.js
@@ -11,6 +11,18 @@ export default {
       name: "Basic",
       isCategory: true,
       children: [
+        {
+          _component: "@budibase/standard-components/embed",
+          icon: "ri-code-line",
+          name: "Embed",
+          description: "Embed content from 3rd party sources",
+          properties: {
+            design: {
+              ...all,
+            },
+            settings: [{ label: "Embed", key: "embed", control: Input }],
+          },
+        },
         {
           _component: "@budibase/standard-components/container",
           name: "Container",
diff --git a/packages/client/src/api/index.js b/packages/client/src/api/index.js
index f019897494..373ac1809e 100644
--- a/packages/client/src/api/index.js
+++ b/packages/client/src/api/index.js
@@ -1,9 +1,9 @@
 import { authenticate } from "./authenticate"
 import { triggerWorkflow } from "./workflow"
 
-export const createApi = ({ rootPath = "", setState, getState }) => {
+export const createApi = ({ setState, getState }) => {
   const apiCall = method => async ({ url, body }) => {
-    const response = await fetch(`${rootPath}${url}`, {
+    const response = await fetch(url, {
       method: method,
       headers: {
         "Content-Type": "application/json",
@@ -45,7 +45,6 @@ export const createApi = ({ rootPath = "", setState, getState }) => {
   const isSuccess = obj => !obj || !obj[ERROR_MEMBER]
 
   const apiOpts = {
-    rootPath,
     setState,
     getState,
     isSuccess,
diff --git a/packages/client/src/createApp.js b/packages/client/src/createApp.js
index a80c1009c7..a8874960e0 100644
--- a/packages/client/src/createApp.js
+++ b/packages/client/src/createApp.js
@@ -2,6 +2,7 @@ import { attachChildren } from "./render/attachChildren"
 import { createTreeNode } from "./render/prepareRenderComponent"
 import { screenRouter } from "./render/screenRouter"
 import { createStateManager } from "./state/stateManager"
+import { getAppId } from "./render/getAppId"
 
 export const createApp = ({
   componentLibraries,
@@ -15,11 +16,9 @@ export const createApp = ({
   const onScreenSlotRendered = screenSlotNode => {
     const onScreenSelected = (screen, url) => {
       const stateManager = createStateManager({
-        frontendDefinition,
         componentLibraries,
         onScreenSlotRendered: () => {},
         routeTo,
-        appRootPath: frontendDefinition.appRootPath,
       })
       const getAttachChildrenParams = attachChildrenParams(stateManager)
       screenSlotNode.props._children = [screen.props]
@@ -36,12 +35,8 @@ export const createApp = ({
     routeTo = screenRouter({
       screens: frontendDefinition.screens,
       onScreenSelected,
-      appRootPath: frontendDefinition.appRootPath,
     })
-    const fallbackPath = window.location.pathname.replace(
-      frontendDefinition.appRootPath,
-      ""
-    )
+    const fallbackPath = window.location.pathname.replace(getAppId(), "")
     routeTo(currentUrl || fallbackPath)
   }
 
@@ -59,10 +54,8 @@ export const createApp = ({
 
   let rootTreeNode
   const pageStateManager = createStateManager({
-    frontendDefinition,
     componentLibraries,
     onScreenSlotRendered,
-    appRootPath: frontendDefinition.appRootPath,
     // seems weird, but the routeTo variable may not be available at this point
     routeTo: url => routeTo(url),
   })
diff --git a/packages/client/src/index.js b/packages/client/src/index.js
index 95f722d445..a54ad79420 100644
--- a/packages/client/src/index.js
+++ b/packages/client/src/index.js
@@ -1,5 +1,6 @@
 import { createApp } from "./createApp"
 import { builtins, builtinLibName } from "./render/builtinComponents"
+import { getAppId } from "./render/getAppId"
 
 /**
  * create a web application from static budibase definition files.
@@ -8,7 +9,7 @@ import { builtins, builtinLibName } from "./render/builtinComponents"
 export const loadBudibase = async opts => {
   const _window = (opts && opts.window) || window
   // const _localStorage = (opts && opts.localStorage) || localStorage
-
+  const appId = getAppId()
   const frontendDefinition = _window["##BUDIBASE_FRONTEND_DEFINITION##"]
 
   const user = {}
@@ -20,9 +21,7 @@ export const loadBudibase = async opts => {
   for (let library of libraries) {
     // fetch the JavaScript for the component libraries from the server
     componentLibraryModules[library] = await import(
-      `/${frontendDefinition.appId}/componentlibrary?library=${encodeURI(
-        library
-      )}`
+      `/componentlibrary?library=${encodeURI(library)}`
     )
   }
 
@@ -42,7 +41,7 @@ export const loadBudibase = async opts => {
   })
 
   const route = _window.location
-    ? _window.location.pathname.replace(frontendDefinition.appRootPath, "")
+    ? _window.location.pathname.replace(`${appId}/`, "").replace(appId, "")
     : ""
 
   initialisePage(frontendDefinition.page, _window.document.body, route)
diff --git a/packages/client/src/render/getAppId.js b/packages/client/src/render/getAppId.js
new file mode 100644
index 0000000000..09a1f1b54f
--- /dev/null
+++ b/packages/client/src/render/getAppId.js
@@ -0,0 +1,5 @@
+export const getAppId = () =>
+  document.cookie
+    .split(";")
+    .find(c => c.trim().startsWith("budibase:appid"))
+    .split("=")[1]
diff --git a/packages/client/src/render/screenRouter.js b/packages/client/src/render/screenRouter.js
index 64319102f8..8bff4950ca 100644
--- a/packages/client/src/render/screenRouter.js
+++ b/packages/client/src/render/screenRouter.js
@@ -1,11 +1,19 @@
 import regexparam from "regexparam"
 import { routerStore } from "../state/store"
+import { getAppId } from "./getAppId"
 
-export const screenRouter = ({ screens, onScreenSelected, appRootPath }) => {
+export const screenRouter = ({ screens, onScreenSelected }) => {
   const makeRootedPath = url => {
-    if (appRootPath) {
-      if (url) return `${appRootPath}${url.startsWith("/") ? "" : "/"}${url}`
-      return appRootPath
+    if (
+      window.location.hostname === "localhost" ||
+      window.location.hostname === "127.0.0.1"
+    ) {
+      const appId = getAppId()
+      if (url) {
+        if (url.startsWith(appId)) return url
+        return `/${appId}${url.startsWith("/") ? "" : "/"}${url}`
+      }
+      return appId
     }
     return url
   }
diff --git a/packages/client/src/state/bbComponentApi.js b/packages/client/src/state/bbComponentApi.js
index 7366a90f5c..4452b4839e 100644
--- a/packages/client/src/state/bbComponentApi.js
+++ b/packages/client/src/state/bbComponentApi.js
@@ -6,21 +6,9 @@ export const trimSlash = str => str.replace(/^\/+|\/+$/g, "")
 
 export const bbFactory = ({
   store,
-  frontendDefinition,
   componentLibraries,
   onScreenSlotRendered,
 }) => {
-  const relativeUrl = url => {
-    if (!frontendDefinition.appRootPath) return url
-    if (
-      url.startsWith("http:") ||
-      url.startsWith("https:") ||
-      url.startsWith("./")
-    )
-      return url
-
-    return frontendDefinition.appRootPath + "/" + trimSlash(url)
-  }
 
   const apiCall = method => (url, body) =>
     fetch(url, {
@@ -30,6 +18,7 @@ export const bbFactory = ({
         "x-user-agent": "Budibase Builder",
       },
       body: body && JSON.stringify(body),
+      credentials: "same-origin",
     })
 
   const api = {
@@ -63,7 +52,6 @@ export const bbFactory = ({
       getContext: getContext(treeNode),
       setContext: setContext(treeNode),
       store: store,
-      relativeUrl,
       api,
       parent,
     }
diff --git a/packages/client/src/state/eventHandlers.js b/packages/client/src/state/eventHandlers.js
index b013956dd4..cab825c24b 100644
--- a/packages/client/src/state/eventHandlers.js
+++ b/packages/client/src/state/eventHandlers.js
@@ -6,14 +6,13 @@ import { createApi } from "../api"
 
 export const EVENT_TYPE_MEMBER_NAME = "##eventHandlerType"
 
-export const eventHandlers = (rootPath, routeTo) => {
+export const eventHandlers = routeTo => {
   const handler = (parameters, execute) => ({
     execute,
     parameters,
   })
 
   const api = createApi({
-    rootPath,
     setState,
     getState: (path, fallback) => getState(path, fallback),
   })
diff --git a/packages/client/src/state/stateManager.js b/packages/client/src/state/stateManager.js
index 8e777ca4b9..5c5f198956 100644
--- a/packages/client/src/state/stateManager.js
+++ b/packages/client/src/state/stateManager.js
@@ -21,13 +21,11 @@ const isMetaProp = propName =>
   propName === "_styles"
 
 export const createStateManager = ({
-  appRootPath,
-  frontendDefinition,
   componentLibraries,
   onScreenSlotRendered,
   routeTo,
 }) => {
-  let handlerTypes = eventHandlers(appRootPath, routeTo)
+  let handlerTypes = eventHandlers(routeTo)
   let currentState
 
   const getCurrentState = () => currentState
@@ -35,7 +33,6 @@ export const createStateManager = ({
   const bb = bbFactory({
     store: appStore,
     getCurrentState,
-    frontendDefinition,
     componentLibraries,
     onScreenSlotRendered,
   })
diff --git a/packages/client/tests/testAppDef.js b/packages/client/tests/testAppDef.js
index c02c18a3b2..e1e41c60c5 100644
--- a/packages/client/tests/testAppDef.js
+++ b/packages/client/tests/testAppDef.js
@@ -1,10 +1,9 @@
 import { JSDOM } from "jsdom"
 import { loadBudibase } from "../src/index"
 
-export const load = async (page, screens, url, appRootPath) => {
+export const load = async (page, screens, url) => {
   screens = screens || []
   url = url || "/"
-  appRootPath = appRootPath || ""
   const dom = new JSDOM("<!DOCTYPE html><html><body></body><html>", {
     url: `http://test${url}`,
   })
@@ -13,7 +12,7 @@ export const load = async (page, screens, url, appRootPath) => {
     autoAssignIds(s.props)
   }
   setAppDef(dom.window, page, screens)
-  addWindowGlobals(dom.window, page, screens, appRootPath, {
+  addWindowGlobals(dom.window, page, screens, {
     hierarchy: {},
     actions: [],
     triggers: [],
@@ -27,11 +26,10 @@ export const load = async (page, screens, url, appRootPath) => {
   return { dom, app }
 }
 
-const addWindowGlobals = (window, page, screens, appRootPath) => {
+const addWindowGlobals = (window, page, screens) => {
   window["##BUDIBASE_FRONTEND_DEFINITION##"] = {
     page,
     screens,
-    appRootPath,
   }
 }
 
@@ -88,7 +86,6 @@ const setAppDef = (window, page, screens) => {
     componentLibraries: [],
     page,
     screens,
-    appRootPath: "",
   }
 }
 
diff --git a/packages/materialdesign-components/src/Test/createApp.js b/packages/materialdesign-components/src/Test/createApp.js
index 96106635b7..0bd3098688 100644
--- a/packages/materialdesign-components/src/Test/createApp.js
+++ b/packages/materialdesign-components/src/Test/createApp.js
@@ -14,12 +14,6 @@ export default async () => {
   componentLibraries["@budibase/standard-components"] = standardcomponents
   const appDef = { hierarchy: {}, actions: {} }
   const user = { name: "yeo", permissions: [] }
-  const { initialisePage } = createApp(
-    componentLibraries,
-    { appRootPath: "" },
-    appDef,
-    user,
-    {}
-  )
+  const { initialisePage } = createApp(componentLibraries, {}, appDef, user, {})
   return initialisePage
 }
diff --git a/packages/server/package.json b/packages/server/package.json
index 0888ef2ae4..49a5626f6f 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -25,7 +25,7 @@
   "scripts": {
     "test": "jest routes --runInBand",
     "test:integration": "jest workflow --runInBand",
-    "test:watch": "jest -w",
+    "test:watch": "jest --watch",
     "initialise": "node ../cli/bin/budi init -b local -q",
     "budi": "node ../cli/bin/budi",
     "dev:builder": "nodemon ../cli/bin/budi run",
diff --git a/packages/server/src/api/controllers/auth.js b/packages/server/src/api/controllers/auth.js
index 5ec3aea617..6ca6d7edac 100644
--- a/packages/server/src/api/controllers/auth.js
+++ b/packages/server/src/api/controllers/auth.js
@@ -4,25 +4,27 @@ const ClientDb = require("../../db/clientDb")
 const bcrypt = require("../../utilities/bcrypt")
 
 exports.authenticate = async ctx => {
+  if (!ctx.appId) ctx.throw(400, "No appId")
+
   const { username, password } = ctx.request.body
 
   if (!username) ctx.throw(400, "Username Required.")
   if (!password) ctx.throw(400, "Password Required")
 
   const masterDb = new CouchDB("clientAppLookup")
-  const { clientId } = await masterDb.get(ctx.params.appId)
+
+  const { clientId } = await masterDb.get(ctx.appId)
 
   if (!clientId) {
     ctx.throw(400, "ClientId not suplied")
   }
   // find the instance that the user is associated with
   const db = new CouchDB(ClientDb.name(clientId))
-  const appId = ctx.params.appId
-  const app = await db.get(appId)
+  const app = await db.get(ctx.appId)
   const instanceId = app.userInstanceMap[username]
 
   if (!instanceId)
-    ctx.throw(500, "User is not associated with an instance of app", appId)
+    ctx.throw(500, "User is not associated with an instance of app", ctx.appId)
 
   // Check the user exists in the instance DB by username
   const instanceDb = new CouchDB(instanceId)
@@ -41,7 +43,7 @@ exports.authenticate = async ctx => {
     const payload = {
       userId: dbUser._id,
       accessLevelId: dbUser.accessLevelId,
-      instanceId: instanceId,
+      instanceId,
     }
 
     const token = jwt.sign(payload, ctx.config.jwtSecret, {
diff --git a/packages/server/src/api/controllers/model.js b/packages/server/src/api/controllers/model.js
index 9d06c7a413..650342b33c 100644
--- a/packages/server/src/api/controllers/model.js
+++ b/packages/server/src/api/controllers/model.js
@@ -27,6 +27,23 @@ exports.create = async function(ctx) {
   const result = await db.post(newModel)
   newModel._rev = result.rev
 
+  const { schema } = ctx.request.body
+  for (let key in schema) {
+    // model has a linked record
+    if (schema[key].type === "link") {
+      // create the link field in the other model
+      const linkedModel = await db.get(schema[key].modelId)
+      linkedModel.schema[newModel.name] = {
+        type: "link",
+        modelId: newModel._id,
+        constraints: {
+          type: "array",
+        },
+      }
+      await db.put(linkedModel)
+    }
+  }
+
   const designDoc = await db.get("_design/database")
   designDoc.views = {
     ...designDoc.views,
@@ -50,7 +67,10 @@ exports.update = async function() {}
 exports.destroy = async function(ctx) {
   const db = new CouchDB(ctx.params.instanceId)
 
-  await db.remove(ctx.params.modelId, ctx.params.revId)
+  const modelToDelete = await db.get(ctx.params.modelId)
+
+  await db.remove(modelToDelete)
+
   const modelViewId = `all_${ctx.params.modelId}`
 
   // Delete all records for that model
@@ -59,6 +79,16 @@ exports.destroy = async function(ctx) {
     records.rows.map(record => ({ id: record.id, _deleted: true }))
   )
 
+  // Delete linked record fields in dependent models
+  for (let key in modelToDelete.schema) {
+    const { type, modelId } = modelToDelete.schema[key]
+    if (type === "link") {
+      const linkedModel = await db.get(modelId)
+      delete linkedModel.schema[modelToDelete.name]
+      await db.put(linkedModel)
+    }
+  }
+
   // delete the "all" view
   const designDoc = await db.get("_design/database")
   delete designDoc.views[modelViewId]
diff --git a/packages/server/src/api/controllers/record.js b/packages/server/src/api/controllers/record.js
index 5fab413f04..cf8eb27606 100644
--- a/packages/server/src/api/controllers/record.js
+++ b/packages/server/src/api/controllers/record.js
@@ -61,7 +61,7 @@ exports.fetchView = async function(ctx) {
   ctx.body = response.rows.map(row => row.doc)
 }
 
-exports.fetchModel = async function(ctx) {
+exports.fetchModelRecords = async function(ctx) {
   const db = new CouchDB(ctx.params.instanceId)
   const response = await db.query(`database/all_${ctx.params.modelId}`, {
     include_docs: true,
@@ -69,6 +69,15 @@ exports.fetchModel = async function(ctx) {
   ctx.body = response.rows.map(row => row.doc)
 }
 
+exports.search = async function(ctx) {
+  const db = new CouchDB(ctx.params.instanceId)
+  const response = await db.allDocs({
+    include_docs: true,
+    ...ctx.request.body,
+  })
+  ctx.body = response.rows.map(row => row.doc)
+}
+
 exports.find = async function(ctx) {
   const db = new CouchDB(ctx.params.instanceId)
   const record = await db.get(ctx.params.recordId)
diff --git a/packages/server/src/api/controllers/static.js b/packages/server/src/api/controllers/static.js
index 557a9efe7a..d2d2596c0a 100644
--- a/packages/server/src/api/controllers/static.js
+++ b/packages/server/src/api/controllers/static.js
@@ -20,6 +20,27 @@ exports.serveApp = async function(ctx) {
     "public",
     ctx.isAuthenticated ? "main" : "unauthenticated"
   )
+  // only set the appId cookie for /appId .. we COULD check for valid appIds
+  // but would like to avoid that DB hit
+  if (looksLikeAppId(ctx.params.appId)) {
+    ctx.cookies.set("budibase:appid", ctx.params.appId, {
+      path: "/",
+      httpOnly: false,
+      expires: new Date(2099, 1, 1),
+    })
+  }
+
+  await send(ctx, ctx.file || "index.html", { root: ctx.devPath || appPath })
+}
+
+exports.serveAppAsset = async function(ctx) {
+  // default to homedir
+  const appPath = resolve(
+    budibaseAppsDir(),
+    ctx.appId,
+    "public",
+    ctx.isAuthenticated ? "main" : "unauthenticated"
+  )
 
   await send(ctx, ctx.file, { root: ctx.devPath || appPath })
 }
@@ -28,7 +49,7 @@ exports.serveComponentLibrary = async function(ctx) {
   // default to homedir
   let componentLibraryPath = resolve(
     budibaseAppsDir(),
-    ctx.params.appId,
+    ctx.appId,
     "node_modules",
     decodeURI(ctx.query.library),
     "dist"
@@ -44,3 +65,10 @@ exports.serveComponentLibrary = async function(ctx) {
 
   await send(ctx, "/index.js", { root: componentLibraryPath })
 }
+
+const looksLikeAppId = appId => {
+  const allowedChars = "0123456789abcdef".split("")
+  return (
+    appId.length === 32 && !appId.split("").some(c => allowedChars.includes(c))
+  )
+}
diff --git a/packages/server/src/api/index.js b/packages/server/src/api/index.js
index 990714fdc7..8c69407736 100644
--- a/packages/server/src/api/index.js
+++ b/packages/server/src/api/index.js
@@ -10,6 +10,7 @@ const {
   instanceRoutes,
   clientRoutes,
   applicationRoutes,
+  recordRoutes,
   modelRoutes,
   viewRoutes,
   staticRoutes,
@@ -59,6 +60,11 @@ router.use(async (ctx, next) => {
   }
 })
 
+router.use(async (ctx, next) => {
+  ctx.appId = ctx.cookies.get("budibase:appid")
+  await next()
+})
+
 router.use(authRoutes.routes())
 router.use(authRoutes.allowedMethods())
 
@@ -69,6 +75,9 @@ router.use(viewRoutes.allowedMethods())
 router.use(modelRoutes.routes())
 router.use(modelRoutes.allowedMethods())
 
+router.use(recordRoutes.routes())
+router.use(recordRoutes.allowedMethods())
+
 router.use(userRoutes.routes())
 router.use(userRoutes.allowedMethods())
 
diff --git a/packages/server/src/api/routes/auth.js b/packages/server/src/api/routes/auth.js
index fa95a3a5e6..b4b68e8929 100644
--- a/packages/server/src/api/routes/auth.js
+++ b/packages/server/src/api/routes/auth.js
@@ -3,6 +3,6 @@ const controller = require("../controllers/auth")
 
 const router = Router()
 
-router.post("/:appId/api/authenticate", controller.authenticate)
+router.post("/api/authenticate", controller.authenticate)
 
 module.exports = router
diff --git a/packages/server/src/api/routes/index.js b/packages/server/src/api/routes/index.js
index c515d5f437..b50fee788a 100644
--- a/packages/server/src/api/routes/index.js
+++ b/packages/server/src/api/routes/index.js
@@ -5,6 +5,7 @@ const instanceRoutes = require("./instance")
 const clientRoutes = require("./client")
 const applicationRoutes = require("./application")
 const modelRoutes = require("./model")
+const recordRoutes = require("./record")
 const viewRoutes = require("./view")
 const staticRoutes = require("./static")
 const componentRoutes = require("./component")
@@ -18,6 +19,7 @@ module.exports = {
   instanceRoutes,
   clientRoutes,
   applicationRoutes,
+  recordRoutes,
   modelRoutes,
   viewRoutes,
   staticRoutes,
diff --git a/packages/server/src/api/routes/model.js b/packages/server/src/api/routes/model.js
index 388f4618bd..f1ec46dbe5 100644
--- a/packages/server/src/api/routes/model.js
+++ b/packages/server/src/api/routes/model.js
@@ -1,46 +1,10 @@
 const Router = require("@koa/router")
 const modelController = require("../controllers/model")
-const recordController = require("../controllers/record")
 const authorized = require("../../middleware/authorized")
-const {
-  READ_MODEL,
-  WRITE_MODEL,
-  BUILDER,
-} = require("../../utilities/accessLevels")
+const { BUILDER } = require("../../utilities/accessLevels")
 
 const router = Router()
 
-// records
-
-router
-  .get(
-    "/api/:instanceId/:modelId/records",
-    authorized(READ_MODEL, ctx => ctx.params.modelId),
-    recordController.fetchModel
-  )
-  .get(
-    "/api/:instanceId/:modelId/records/:recordId",
-    authorized(READ_MODEL, ctx => ctx.params.modelId),
-    recordController.find
-  )
-  .post(
-    "/api/:instanceId/:modelId/records",
-    authorized(WRITE_MODEL, ctx => ctx.params.modelId),
-    recordController.save
-  )
-  .post(
-    "/api/:instanceId/:modelId/records/validate",
-    authorized(WRITE_MODEL, ctx => ctx.params.modelId),
-    recordController.validate
-  )
-  .delete(
-    "/api/:instanceId/:modelId/records/:recordId/:revId",
-    authorized(WRITE_MODEL, ctx => ctx.params.modelId),
-    recordController.destroy
-  )
-
-// models
-
 router
   .get("/api/:instanceId/models", authorized(BUILDER), modelController.fetch)
   .get("/api/:instanceId/models/:id", authorized(BUILDER), modelController.find)
diff --git a/packages/server/src/api/routes/record.js b/packages/server/src/api/routes/record.js
new file mode 100644
index 0000000000..d555d3d8c8
--- /dev/null
+++ b/packages/server/src/api/routes/record.js
@@ -0,0 +1,36 @@
+const Router = require("@koa/router")
+const recordController = require("../controllers/record")
+const authorized = require("../../middleware/authorized")
+const { READ_MODEL, WRITE_MODEL } = require("../../utilities/accessLevels")
+
+const router = Router()
+
+router
+  .get(
+    "/api/:instanceId/:modelId/records",
+    authorized(READ_MODEL, ctx => ctx.params.modelId),
+    recordController.fetchModelRecords
+  )
+  .get(
+    "/api/:instanceId/:modelId/records/:recordId",
+    authorized(READ_MODEL, ctx => ctx.params.modelId),
+    recordController.find
+  )
+  .post("/api/:instanceId/records/search", recordController.search)
+  .post(
+    "/api/:instanceId/:modelId/records",
+    authorized(WRITE_MODEL, ctx => ctx.params.modelId),
+    recordController.save
+  )
+  .post(
+    "/api/:instanceId/:modelId/records/validate",
+    authorized(WRITE_MODEL, ctx => ctx.params.modelId),
+    recordController.validate
+  )
+  .delete(
+    "/api/:instanceId/:modelId/records/:recordId/:revId",
+    authorized(WRITE_MODEL, ctx => ctx.params.modelId),
+    recordController.destroy
+  )
+
+module.exports = router
diff --git a/packages/server/src/api/routes/static.js b/packages/server/src/api/routes/static.js
index 5909d31d09..6fff1996fa 100644
--- a/packages/server/src/api/routes/static.js
+++ b/packages/server/src/api/routes/static.js
@@ -21,7 +21,8 @@ if (env.NODE_ENV !== "production") {
 }
 
 router
-  .get("/:appId/componentlibrary", controller.serveComponentLibrary)
-  .get("/:appId/:file*", controller.serveApp)
+  .get("/componentlibrary", controller.serveComponentLibrary)
+  .get("/assets/:file*", controller.serveAppAsset)
+  .get("/:appId/:path*", controller.serveApp)
 
 module.exports = router
diff --git a/packages/server/src/api/routes/tests/couchTestUtils.js b/packages/server/src/api/routes/tests/couchTestUtils.js
index 6029e080cc..495b841b10 100644
--- a/packages/server/src/api/routes/tests/couchTestUtils.js
+++ b/packages/server/src/api/routes/tests/couchTestUtils.js
@@ -253,3 +253,7 @@ exports.insertDocument = async (databaseId, document) => {
 exports.destroyDocument = async (databaseId, documentId) => {
   return await new CouchDB(databaseId).destroy(documentId)
 }
+
+exports.getDocument = async (databaseId, documentId) => {
+  return await new CouchDB(databaseId).get(documentId)
+}
diff --git a/packages/server/src/api/routes/tests/model.spec.js b/packages/server/src/api/routes/tests/model.spec.js
index 65a44b677a..7134245fb3 100644
--- a/packages/server/src/api/routes/tests/model.spec.js
+++ b/packages/server/src/api/routes/tests/model.spec.js
@@ -3,9 +3,10 @@ const {
   createModel, 
   supertest, 
   createClientDatabase, 
-  createApplication ,
+  createApplication,
   defaultHeaders,
-  builderEndpointShouldBlockNormalUsers
+  builderEndpointShouldBlockNormalUsers,
+  getDocument
 } = require("./couchTestUtils")
 
 describe("/models", () => {
@@ -97,7 +98,6 @@ describe("/models", () => {
           instanceId: instance._id,
         })
       })
-
     });
 
   describe("destroy", () => {
@@ -108,7 +108,11 @@ describe("/models", () => {
       testModel = await createModel(request, instance._id, testModel)
     });
 
-    it("returns a success response when a model is deleted.", done => {
+    afterEach(() => {
+      delete testModel._rev
+    })
+
+    it("returns a success response when a model is deleted.", async done => {
       request
         .delete(`/api/${instance._id}/models/${testModel._id}/${testModel._rev}`)
         .set(defaultHeaders)
@@ -120,6 +124,41 @@ describe("/models", () => {
         });
       })
 
+    it("deletes linked references to the model after deletion", async done => {
+      const linkedModel = await createModel(request, instance._id, {
+        name: "LinkedModel",
+        type: "model",
+        key: "name",
+        schema: {
+          name: {
+            type: "text",
+            constraints: {
+              type: "string",
+            },
+          },
+          TestModel: {
+            type: "link",
+            modelId: testModel._id,
+            constraints: {
+              type: "array"
+            }
+          }
+        },
+      })
+
+      request
+        .delete(`/api/${instance._id}/models/${testModel._id}/${testModel._rev}`)
+        .set(defaultHeaders)
+        .expect('Content-Type', /json/)
+        .expect(200)
+        .end(async (_, res) => {
+            expect(res.res.statusMessage).toEqual(`Model ${testModel._id} deleted.`);            
+            const dependentModel = await getDocument(instance._id, linkedModel._id)
+            expect(dependentModel.schema.TestModel).not.toBeDefined();
+            done();
+        });
+      })
+
     it("should apply authorization to endpoint", async () => {
       await builderEndpointShouldBlockNormalUsers({
         request,
diff --git a/packages/server/src/api/routes/tests/record.spec.js b/packages/server/src/api/routes/tests/record.spec.js
index 2c8c542715..22ac67ecdc 100644
--- a/packages/server/src/api/routes/tests/record.spec.js
+++ b/packages/server/src/api/routes/tests/record.spec.js
@@ -110,6 +110,30 @@ describe("/records", () => {
       expect(res.body.find(r => r.name === record.name)).toBeDefined()
     })
 
+    it("lists records when queried by their ID", async () => {
+      const newRecord = {
+        modelId: model._id,
+        name: "Second Contact",
+        status: "new"
+      }
+      const record = await createRecord()
+      const secondRecord = await createRecord(newRecord)
+
+      const recordIds = [record.body._id, secondRecord.body._id]
+
+      const res = await request
+        .post(`/api/${instance._id}/records/search`)
+        .set(defaultHeaders)
+        .send({
+          keys: recordIds
+        })
+        .expect('Content-Type', /json/)
+        .expect(200)
+
+      expect(res.body.length).toBe(2)
+      expect(res.body.map(response => response._id)).toEqual(expect.arrayContaining(recordIds))
+    })
+
     it("load should return 404 when record does not exist", async () => {
       await createRecord()
       await request
diff --git a/packages/server/src/utilities/builder/buildPage.js b/packages/server/src/utilities/builder/buildPage.js
index 3d44cb8072..ea0c9cce25 100644
--- a/packages/server/src/utilities/builder/buildPage.js
+++ b/packages/server/src/utilities/builder/buildPage.js
@@ -45,18 +45,16 @@ const copyClientLib = async (appPath, pageName) => {
 
 const buildIndexHtml = async (config, appId, pageName, appPath, pkg) => {
   const appPublicPath = publicPath(appPath, pageName)
-  const appRootPath = rootPath(config, appId)
 
   const stylesheetUrl = s =>
     s.startsWith("http") ? s : `/${rootPath(config, appId)}/${s}`
 
   const templateObj = {
     title: pkg.page.title || "Budibase App",
-    favicon: `${appRootPath}/${pkg.page.favicon || "/_shared/favicon.png"}`,
+    favicon: `${pkg.page.favicon || "/_shared/favicon.png"}`,
     stylesheets: (pkg.page.stylesheets || []).map(stylesheetUrl),
     screenStyles: pkg.screens.filter(s => s._css).map(s => s._css),
     pageStyle: pkg.page._css,
-    appRootPath,
   }
 
   const indexHtmlTemplate = await readFile(
@@ -74,7 +72,6 @@ const buildIndexHtml = async (config, appId, pageName, appPath, pkg) => {
 const buildFrontendAppDefinition = async (config, appId, pageName, pkg) => {
   const appPath = appPackageFolder(config, appId)
   const appPublicPath = publicPath(appPath, pageName)
-  const appRootPath = rootPath(config, appId)
 
   const filename = join(appPublicPath, "clientFrontendDefinition.js")
 
@@ -89,7 +86,6 @@ const buildFrontendAppDefinition = async (config, appId, pageName, pkg) => {
   }
 
   const clientUiDefinition = JSON.stringify({
-    appRootPath: appRootPath,
     page: pkg.page,
     screens: pkg.screens,
     libraries: [
diff --git a/packages/server/src/utilities/builder/index.template.html b/packages/server/src/utilities/builder/index.template.html
index 2f1f7ed87c..a21219de9b 100644
--- a/packages/server/src/utilities/builder/index.template.html
+++ b/packages/server/src/utilities/builder/index.template.html
@@ -24,15 +24,15 @@
     {{ /each }}
 
     {{ each(options.screenStyles) }}
-    <link rel='stylesheet' href='{{ appRootPath }}{{ @this }}'>
+    <link rel='stylesheet' href='/assets{{ @this }}'>
     {{ /each }}
 
     {{ if(options.pageStyle) }}
-    <link rel='stylesheet' href='{{ appRootPath }}{{ pageStyle }}'>
+    <link rel='stylesheet' href='/assets{{ pageStyle }}'>
     {{ /if }}
 
-    <script src='{{ appRootPath }}/clientFrontendDefinition.js'></script>
-    <script src='{{ appRootPath }}/budibase-client.js'></script>
+    <script src='/assets/clientFrontendDefinition.js'></script>
+    <script src='/assets/budibase-client.js'></script>
 
 </head>
 
diff --git a/packages/standard-components/components.json b/packages/standard-components/components.json
index a562650b85..c4c0246672 100644
--- a/packages/standard-components/components.json
+++ b/packages/standard-components/components.json
@@ -6,6 +6,13 @@
 			"component": "button"
 		}
 	},
+	"embed": {
+		"name": "Embed",
+		"description": "Embed stuff",
+		"props": {
+			"embed": "string"
+		}
+	},
 	"Navigation": {
 		"name": "Navigation",
 		"description": "A basic header navigation component",
diff --git a/packages/standard-components/public/clientAppDefinition.js b/packages/standard-components/public/clientAppDefinition.js
index be67dcf1a8..f77f59ec03 100644
--- a/packages/standard-components/public/clientAppDefinition.js
+++ b/packages/standard-components/public/clientAppDefinition.js
@@ -98,6 +98,5 @@ window["##BUDIBASE_APPDEFINITION##"] = {
     nodeId: 0,
   },
   componentLibraries: ["budibase-standard-components"],
-  appRootPath: "/testApp2",
   props: {},
 }
diff --git a/packages/standard-components/src/Embed.svelte b/packages/standard-components/src/Embed.svelte
new file mode 100644
index 0000000000..2640864681
--- /dev/null
+++ b/packages/standard-components/src/Embed.svelte
@@ -0,0 +1,5 @@
+<script>
+  export let embed
+</script>
+
+{@html embed}
diff --git a/packages/standard-components/src/Login.svelte b/packages/standard-components/src/Login.svelte
index b52cc154ea..0675c65f46 100644
--- a/packages/standard-components/src/Login.svelte
+++ b/packages/standard-components/src/Login.svelte
@@ -13,30 +13,17 @@
   let password = ""
   let loading = false
   let error = false
-  let _logo = ""
   let _buttonClass = ""
   let _inputClass = ""
 
   $: {
-    _logo = _bb.relativeUrl(logo)
     _buttonClass = buttonClass || "default-button"
     _inputClass = inputClass || "default-input"
   }
 
   const login = async () => {
     loading = true
-    const response = await fetch(_bb.relativeUrl("/api/authenticate"), {
-      body: JSON.stringify({
-        username,
-        password,
-      }),
-      headers: {
-        "Content-Type": "application/json",
-        "x-user-agent": "Budibase Builder",
-      },
-      method: "POST",
-    })
-
+    const response = await _bb.api.post("/api/authenticate", { username, password })
     if (response.status === 200) {
       const json = await response.json()
       localStorage.setItem("budibase:token", json.token)
@@ -51,9 +38,9 @@
 
 <div class="root">
   <div class="content">
-    {#if _logo}
+    {#if logo}
       <div class="logo-container">
-        <img src={_logo} alt="logo" />
+        <img src={logo} alt="logo" />
       </div>
     {/if}
 
diff --git a/packages/standard-components/src/Test/createApp.js b/packages/standard-components/src/Test/createApp.js
index 65ad4792c4..48f65c5789 100644
--- a/packages/standard-components/src/Test/createApp.js
+++ b/packages/standard-components/src/Test/createApp.js
@@ -15,7 +15,7 @@ export default async () => {
   const { initialisePage } = createApp(
     window.document,
     componentLibraries,
-    { appRootPath: "" },
+    {},
     appDef,
     user,
     {},
diff --git a/packages/standard-components/src/index.js b/packages/standard-components/src/index.js
index 2284ab1fcb..24342066e8 100644
--- a/packages/standard-components/src/index.js
+++ b/packages/standard-components/src/index.js
@@ -21,3 +21,4 @@ export { default as datalist } from "./DataList.svelte"
 export { default as list } from "./List.svelte"
 export { default as datasearch } from "./DataSearch.svelte"
 export { default as datamap } from "./DataMap.svelte"
+export { default as embed } from "./Embed.svelte"

From 42166e01a5cacc928143f20ee100a50b887267c0 Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Fri, 12 Jun 2020 21:04:30 +0100
Subject: [PATCH 02/15] accidentally commited cypress folder

---
 packages/builder/cypress/plugins/index.js | 21 ---------------------
 1 file changed, 21 deletions(-)
 delete mode 100644 packages/builder/cypress/plugins/index.js

diff --git a/packages/builder/cypress/plugins/index.js b/packages/builder/cypress/plugins/index.js
deleted file mode 100644
index aa9918d215..0000000000
--- a/packages/builder/cypress/plugins/index.js
+++ /dev/null
@@ -1,21 +0,0 @@
-/// <reference types="cypress" />
-// ***********************************************************
-// This example plugins/index.js can be used to load plugins
-//
-// You can change the location of this file or turn off loading
-// the plugins file with the 'pluginsFile' configuration option.
-//
-// You can read more here:
-// https://on.cypress.io/plugins-guide
-// ***********************************************************
-
-// This function is called when a project is opened or re-opened (e.g. due to
-// the project's config changing)
-
-/**
- * @type {Cypress.PluginConfig}
- */
-module.exports = (on, config) => {
-  // `on` is used to hook into various events Cypress emits
-  // `config` is the resolved Cypress config
-}

From f956e141b4847673247b7b1a168d9ea113239cf7 Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Fri, 12 Jun 2020 21:08:00 +0100
Subject: [PATCH 03/15] fixing tests - not using new auth endpoint

---
 packages/server/src/api/routes/tests/couchTestUtils.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/server/src/api/routes/tests/couchTestUtils.js b/packages/server/src/api/routes/tests/couchTestUtils.js
index 495b841b10..54a78c68a9 100644
--- a/packages/server/src/api/routes/tests/couchTestUtils.js
+++ b/packages/server/src/api/routes/tests/couchTestUtils.js
@@ -177,7 +177,8 @@ const createUserWithPermissions = async (
   const designDoc = await db.get("_design/database")
 
   const loginResult = await request
-    .post(`/${designDoc.metadata.applicationId}/api/authenticate`)
+    .post(`/api/authenticate`)
+    .set({ Cookie: `budibase:appid=${designDoc.metadata.applicationId}`})
     .send({ username, password })
 
   // returning necessary request headers

From 5b59a110a6442a77226abf9b6d0b1caa4eb24fa1 Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Fri, 12 Jun 2020 21:11:39 +0100
Subject: [PATCH 04/15] lint fix

---
 packages/client/src/state/bbComponentApi.js            | 1 -
 packages/server/src/api/routes/tests/couchTestUtils.js | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/packages/client/src/state/bbComponentApi.js b/packages/client/src/state/bbComponentApi.js
index 4452b4839e..b022ddca27 100644
--- a/packages/client/src/state/bbComponentApi.js
+++ b/packages/client/src/state/bbComponentApi.js
@@ -9,7 +9,6 @@ export const bbFactory = ({
   componentLibraries,
   onScreenSlotRendered,
 }) => {
-
   const apiCall = method => (url, body) =>
     fetch(url, {
       method: method,
diff --git a/packages/server/src/api/routes/tests/couchTestUtils.js b/packages/server/src/api/routes/tests/couchTestUtils.js
index 54a78c68a9..e21d459d3a 100644
--- a/packages/server/src/api/routes/tests/couchTestUtils.js
+++ b/packages/server/src/api/routes/tests/couchTestUtils.js
@@ -178,7 +178,7 @@ const createUserWithPermissions = async (
 
   const loginResult = await request
     .post(`/api/authenticate`)
-    .set({ Cookie: `budibase:appid=${designDoc.metadata.applicationId}`})
+    .set({ Cookie: `budibase:appid=${designDoc.metadata.applicationId}` })
     .send({ username, password })
 
   // returning necessary request headers

From 5174c3f1dc02d357ebbd2de0de87fc98a10a5661 Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Fri, 12 Jun 2020 21:20:44 +0100
Subject: [PATCH 05/15] build errors from dodgy merge

---
 .../userInterface/AppPreview/CurrentItemPreview.svelte           | 1 -
 .../src/pages/[application]/workflow/[workflow]/_layout.svelte   | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte b/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte
index 9059f4524e..f97f91df6b 100644
--- a/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte
+++ b/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte
@@ -110,7 +110,6 @@
         appId: $store.appId,
       })
     )
-    )
   }
 
   $: if (iframe)
diff --git a/packages/builder/src/pages/[application]/workflow/[workflow]/_layout.svelte b/packages/builder/src/pages/[application]/workflow/[workflow]/_layout.svelte
index f1b3bae003..a00f7b4ab0 100644
--- a/packages/builder/src/pages/[application]/workflow/[workflow]/_layout.svelte
+++ b/packages/builder/src/pages/[application]/workflow/[workflow]/_layout.svelte
@@ -1,3 +1,4 @@
 <script>
+  import { params } from "@sveltech/routify"
   store.setCurrentPage($params.page)
 </script>

From ea3a8fd81aecea41b699b6d596f20d5c367f3b70 Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Sun, 14 Jun 2020 20:30:23 +0100
Subject: [PATCH 06/15] client: fixing broken tests

---
 packages/client/package.json                |  2 +-
 packages/client/src/createApp.js            |  6 +++++-
 packages/client/src/index.js                |  4 ++--
 packages/client/src/render/getAppId.js      |  4 ++--
 packages/client/src/render/screenRouter.js  |  9 ++++----
 packages/client/tests/screenRouting.spec.js |  2 +-
 packages/client/tests/testAppDef.js         | 24 ++++++++++++++++++---
 7 files changed, 37 insertions(+), 14 deletions(-)

diff --git a/packages/client/package.json b/packages/client/package.json
index 01b90a7bc5..acefff3770 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -15,7 +15,7 @@
         "client": "web"
       }
     },
-    "testURL": "http://jest-breaks-if-this-does-not-exist",
+    "testURL": "http://test.com",
     "moduleNameMapper": {
       "\\.(jpg|jpeg|png|gif|eot|otf|webp|svg|ttf|woff|woff2|mp4|webm|wav|mp3|m4a|aac|oga)$": "<rootDir>/internals/mocks/fileMock.js",
       "\\.(css|less|sass|scss)$": "identity-obj-proxy"
diff --git a/packages/client/src/createApp.js b/packages/client/src/createApp.js
index a8874960e0..9e1a9ea1b1 100644
--- a/packages/client/src/createApp.js
+++ b/packages/client/src/createApp.js
@@ -35,8 +35,12 @@ export const createApp = ({
     routeTo = screenRouter({
       screens: frontendDefinition.screens,
       onScreenSelected,
+      window,
     })
-    const fallbackPath = window.location.pathname.replace(getAppId(), "")
+    const fallbackPath = window.location.pathname.replace(
+      getAppId(window.document.cookie),
+      ""
+    )
     routeTo(currentUrl || fallbackPath)
   }
 
diff --git a/packages/client/src/index.js b/packages/client/src/index.js
index a54ad79420..87813a812d 100644
--- a/packages/client/src/index.js
+++ b/packages/client/src/index.js
@@ -9,7 +9,7 @@ import { getAppId } from "./render/getAppId"
 export const loadBudibase = async opts => {
   const _window = (opts && opts.window) || window
   // const _localStorage = (opts && opts.localStorage) || localStorage
-  const appId = getAppId()
+  const appId = getAppId(_window.document.cookie)
   const frontendDefinition = _window["##BUDIBASE_FRONTEND_DEFINITION##"]
 
   const user = {}
@@ -37,7 +37,7 @@ export const loadBudibase = async opts => {
     componentLibraries: componentLibraryModules,
     frontendDefinition,
     user,
-    window,
+    window: _window,
   })
 
   const route = _window.location
diff --git a/packages/client/src/render/getAppId.js b/packages/client/src/render/getAppId.js
index 09a1f1b54f..1a8d445920 100644
--- a/packages/client/src/render/getAppId.js
+++ b/packages/client/src/render/getAppId.js
@@ -1,5 +1,5 @@
-export const getAppId = () =>
-  document.cookie
+export const getAppId = cookie =>
+  cookie
     .split(";")
     .find(c => c.trim().startsWith("budibase:appid"))
     .split("=")[1]
diff --git a/packages/client/src/render/screenRouter.js b/packages/client/src/render/screenRouter.js
index 8bff4950ca..ae11c10949 100644
--- a/packages/client/src/render/screenRouter.js
+++ b/packages/client/src/render/screenRouter.js
@@ -2,13 +2,14 @@ import regexparam from "regexparam"
 import { routerStore } from "../state/store"
 import { getAppId } from "./getAppId"
 
-export const screenRouter = ({ screens, onScreenSelected }) => {
+export const screenRouter = ({ screens, onScreenSelected, window }) => {
   const makeRootedPath = url => {
     if (
-      window.location.hostname === "localhost" ||
-      window.location.hostname === "127.0.0.1"
+      window.location &&
+      (window.location.hostname === "localhost" ||
+        window.location.hostname === "127.0.0.1")
     ) {
-      const appId = getAppId()
+      const appId = getAppId(window.document.cookie)
       if (url) {
         if (url.startsWith(appId)) return url
         return `/${appId}${url.startsWith("/") ? "" : "/"}${url}`
diff --git a/packages/client/tests/screenRouting.spec.js b/packages/client/tests/screenRouting.spec.js
index bb4380196f..d0b2c1b4d5 100644
--- a/packages/client/tests/screenRouting.spec.js
+++ b/packages/client/tests/screenRouting.spec.js
@@ -18,7 +18,7 @@ describe("screenRouting", () => {
 
   it("should load correct screen, for initial URL, when appRootPath is something", async () => {
     const { page, screens } = pageWith3Screens()
-    const { dom } = await load(page, screens, "/testApp/screen2", "/testApp")
+    const { dom } = await load(page, screens, "/TEST_APP_ID/screen2", "localhost")
 
     const rootDiv = dom.window.document.body.children[0]
     expect(rootDiv.children.length).toBe(1)
diff --git a/packages/client/tests/testAppDef.js b/packages/client/tests/testAppDef.js
index e1e41c60c5..f75abb6556 100644
--- a/packages/client/tests/testAppDef.js
+++ b/packages/client/tests/testAppDef.js
@@ -1,12 +1,29 @@
-import { JSDOM } from "jsdom"
+import jsdom, { JSDOM } from "jsdom"
 import { loadBudibase } from "../src/index"
 
-export const load = async (page, screens, url) => {
+export const load = async (page, screens, url, host = "test.com") => {
   screens = screens || []
   url = url || "/"
+
+  const fullUrl = `http://${host}${url}`
+  const cookieJar = new jsdom.CookieJar()
+  cookieJar.setCookie(
+    `budibase:appid=TEST_APP_ID;domain=${host};path=/`,
+    fullUrl,
+    {
+      looseMode: false,
+    },
+    () => {}
+  )
+
   const dom = new JSDOM("<!DOCTYPE html><html><body></body><html>", {
-    url: `http://test${url}`,
+    url: fullUrl,
+    cookieJar,
   })
+  /*const cookie = tough.Cookie
+  cookie.key = "budibase:appid"
+  cookie.value = "TEST_APPID"*/
+
   autoAssignIds(page.props)
   for (let s of screens) {
     autoAssignIds(s.props)
@@ -27,6 +44,7 @@ export const load = async (page, screens, url) => {
 }
 
 const addWindowGlobals = (window, page, screens) => {
+  window.document.cookie = "budibase:appid=TEST_APP_ID"
   window["##BUDIBASE_FRONTEND_DEFINITION##"] = {
     page,
     screens,

From f0ee7293765ef4ddbf060ebccd3841c23fb5432f Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Sun, 14 Jun 2020 20:36:51 +0100
Subject: [PATCH 07/15] code review - static controller - test app id with
 regex

---
 packages/server/src/api/controllers/static.js | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/packages/server/src/api/controllers/static.js b/packages/server/src/api/controllers/static.js
index d2d2596c0a..82545d459c 100644
--- a/packages/server/src/api/controllers/static.js
+++ b/packages/server/src/api/controllers/static.js
@@ -66,9 +66,4 @@ exports.serveComponentLibrary = async function(ctx) {
   await send(ctx, "/index.js", { root: componentLibraryPath })
 }
 
-const looksLikeAppId = appId => {
-  const allowedChars = "0123456789abcdef".split("")
-  return (
-    appId.length === 32 && !appId.split("").some(c => allowedChars.includes(c))
-  )
-}
+const looksLikeAppId = appId => /^[0-9a-f]{32}$/.test(appId)

From bf14aa5ccbb22aa65507023391257b6a139ecc92 Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Thu, 18 Jun 2020 16:59:31 +0100
Subject: [PATCH 08/15] instanceid removal

---
 packages/builder/src/builderStore/api.js      | 42 ++++++----
 .../builder/src/builderStore/store/backend.js |  4 +-
 .../builder/src/builderStore/store/index.js   |  4 -
 .../src/builderStore/store/workflow/index.js  | 20 ++---
 .../components/database/ModelDataTable/api.js | 16 ++--
 .../CreateEditModel/CreateEditModel.svelte    |  4 +-
 .../modals/CreateEditView.svelte              |  4 +-
 .../src/components/nav/HierarchyRow.svelte    |  1 -
 .../nav/SchemaManagementDrawer.svelte         |  4 +-
 .../src/components/nav/UsersList.svelte       |  4 +-
 .../AppPreview/CurrentItemPreview.svelte      |  1 +
 .../AppPreview/iframeTemplate.js              | 16 ++--
 .../SetupPanel/DeleteWorkflowModal.svelte     |  1 -
 .../workflow/SetupPanel/SetupPanel.svelte     |  1 -
 .../WorkflowBuilder/WorkflowBuilder.svelte    |  1 -
 .../WorkflowPanel/BlockList/BlockList.svelte  |  1 -
 .../WorkflowList/CreateWorkflowModal.svelte   |  1 -
 .../WorkflowList/WorkflowList.svelte          |  1 -
 .../WorkflowPanel/WorkflowPanel.svelte        |  1 -
 packages/client/src/render/getAppId.js        | 10 ++-
 packages/client/tests/testAppDef.js           |  7 +-
 .../server/src/api/controllers/accesslevel.js | 16 ++--
 .../server/src/api/controllers/application.js | 19 ++++-
 packages/server/src/api/controllers/auth.js   | 13 +++-
 .../server/src/api/controllers/instance.js    | 10 +--
 packages/server/src/api/controllers/model.js  |  8 +-
 packages/server/src/api/controllers/record.js | 16 ++--
 packages/server/src/api/controllers/static.js | 19 +++--
 packages/server/src/api/controllers/user.js   | 10 +--
 packages/server/src/api/controllers/view.js   |  6 +-
 .../src/api/controllers/workflow/index.js     |  8 +-
 packages/server/src/api/index.js              |  5 --
 packages/server/src/api/routes/accesslevel.js | 12 +--
 packages/server/src/api/routes/instance.js    |  2 +-
 packages/server/src/api/routes/model.js       | 14 ++--
 packages/server/src/api/routes/record.js      | 12 +--
 packages/server/src/api/routes/screen.js      | 10 +--
 .../src/api/routes/tests/accesslevel.spec.js  | 28 +++----
 .../src/api/routes/tests/application.spec.js  | 14 ++--
 .../src/api/routes/tests/couchTestUtils.js    | 78 ++++++++++++++-----
 .../src/api/routes/tests/instance.spec.js     |  6 +-
 .../server/src/api/routes/tests/model.spec.js | 14 ++--
 .../src/api/routes/tests/record.spec.js       | 36 ++++-----
 .../server/src/api/routes/tests/user.spec.js  | 12 +--
 .../server/src/api/routes/tests/view.spec.js  |  6 +-
 .../src/api/routes/tests/workflow.spec.js     |  8 +-
 packages/server/src/api/routes/user.js        | 16 +---
 packages/server/src/api/routes/view.js        |  6 +-
 packages/server/src/api/routes/workflow.js    | 14 ++--
 .../server/src/middleware/authenticated.js    | 26 +++++--
 packages/server/src/middleware/authorized.js  | 11 +--
 packages/server/src/utilities/accessLevels.js | 10 ++-
 .../src/utilities/builder/setBuilderToken.js  | 19 +++++
 .../standard-components/src/DataChart.svelte  |  3 +-
 .../standard-components/src/DataForm.svelte   |  5 +-
 .../standard-components/src/DataList.svelte   |  3 +-
 .../standard-components/src/DataTable.svelte  |  3 +-
 packages/standard-components/src/List.svelte  |  3 +-
 58 files changed, 358 insertions(+), 287 deletions(-)
 create mode 100644 packages/server/src/utilities/builder/setBuilderToken.js

diff --git a/packages/builder/src/builderStore/api.js b/packages/builder/src/builderStore/api.js
index 3fcd35ce28..795aaf8cd7 100644
--- a/packages/builder/src/builderStore/api.js
+++ b/packages/builder/src/builderStore/api.js
@@ -1,17 +1,17 @@
-const apiCall = method => async (url, body) => {
+const apiCall = (method, instanceId) => async (url, body) => {
+  const headers = {
+    "Content-Type": "application/json",
+    "x-user-agent": "Budibase Builder",
+  }
+  if (instanceId) {
+    headers["x-budibase-instanceid"] = instanceId
+  }
   const response = await fetch(url, {
     method: method,
-    headers: {
-      "Content-Type": "application/json",
-      "x-user-agent": "Budibase Builder",
-    },
     body: body && JSON.stringify(body),
+    headers,
   })
 
-  // if (response.status === 500) {
-  //   throw new Error("Server Error");
-  // }
-
   return response
 }
 
@@ -21,10 +21,20 @@ export const patch = apiCall("PATCH")
 export const del = apiCall("DELETE")
 export const put = apiCall("PUT")
 
-export default {
-  post,
-  get,
-  patch,
-  delete: del,
-  put,
-}
+// usage: api(instanceId).post(...) ... will supply instance Id in header
+const api = instanceId => ({
+  post: apiCall("POST", instanceId),
+  get: apiCall("GET", instanceId),
+  patch: apiCall("PATCH", instanceId),
+  delete: apiCall("DELETE", instanceId),
+  put: apiCall("PUT", instanceId),
+})
+
+// usage: api.post(...)... will not supply instanceid in header
+api.post = apiCall("POST")
+api.get = apiCall("GET")
+api.patch = apiCall("PATCH")
+api.delete = apiCall("DELETE")
+api.put = apiCall("PUT")
+
+export default api
diff --git a/packages/builder/src/builderStore/store/backend.js b/packages/builder/src/builderStore/store/backend.js
index 9a5a7b1fbc..6efb980506 100644
--- a/packages/builder/src/builderStore/store/backend.js
+++ b/packages/builder/src/builderStore/store/backend.js
@@ -24,8 +24,8 @@ export const getBackendUiStore = () => {
   store.actions = {
     database: {
       select: async db => {
-        const modelsResponse = await api.get(`/api/${db._id}/models`)
-        const viewsResponse = await api.get(`/api/${db._id}/views`)
+        const modelsResponse = await api(db._id).get(`/api/models`)
+        const viewsResponse = await api(db._id).get(`/api/views`)
         const models = await modelsResponse.json()
         const views = await viewsResponse.json()
         store.update(state => {
diff --git a/packages/builder/src/builderStore/store/index.js b/packages/builder/src/builderStore/store/index.js
index 1f3ea9c0ef..0b17e8c61c 100644
--- a/packages/builder/src/builderStore/store/index.js
+++ b/packages/builder/src/builderStore/store/index.js
@@ -1,5 +1,4 @@
 import { values } from "lodash/fp"
-import { backendUiStore } from "builderStore"
 import * as backendStoreActions from "./backend"
 import { writable, get } from "svelte/store"
 import api from "../api"
@@ -295,13 +294,10 @@ const addChildComponent = store => (componentToAdd, presetName) => {
 
     const presetProps = presetName ? component.presets[presetName] : {}
 
-    const instanceId = get(backendUiStore).selectedDatabase._id
-
     const newComponent = createProps(
       component,
       {
         ...presetProps,
-        _instanceId: instanceId,
       },
       state
     )
diff --git a/packages/builder/src/builderStore/store/workflow/index.js b/packages/builder/src/builderStore/store/workflow/index.js
index 8d5e63b197..7c814c27ee 100644
--- a/packages/builder/src/builderStore/store/workflow/index.js
+++ b/packages/builder/src/builderStore/store/workflow/index.js
@@ -4,8 +4,8 @@ import Workflow from "./Workflow"
 
 const workflowActions = store => ({
   fetch: async instanceId => {
-    const WORKFLOWS_URL = `/api/${instanceId}/workflows`
-    const workflowResponse = await api.get(WORKFLOWS_URL)
+    const WORKFLOWS_URL = `/api/workflows`
+    const workflowResponse = await api(instanceId).get(WORKFLOWS_URL)
     const json = await workflowResponse.json()
     store.update(state => {
       state.workflows = json
@@ -19,8 +19,8 @@ const workflowActions = store => ({
         steps: [],
       },
     }
-    const CREATE_WORKFLOW_URL = `/api/${instanceId}/workflows`
-    const response = await api.post(CREATE_WORKFLOW_URL, workflow)
+    const CREATE_WORKFLOW_URL = `/api/workflows`
+    const response = await api(instanceId).post(CREATE_WORKFLOW_URL, workflow)
     const json = await response.json()
     store.update(state => {
       state.workflows = state.workflows.concat(json.workflow)
@@ -29,8 +29,8 @@ const workflowActions = store => ({
     })
   },
   save: async ({ instanceId, workflow }) => {
-    const UPDATE_WORKFLOW_URL = `/api/${instanceId}/workflows`
-    const response = await api.put(UPDATE_WORKFLOW_URL, workflow)
+    const UPDATE_WORKFLOW_URL = `/api/workflows`
+    const response = await api(instanceId).put(UPDATE_WORKFLOW_URL, workflow)
     const json = await response.json()
     store.update(state => {
       const existingIdx = state.workflows.findIndex(
@@ -43,8 +43,8 @@ const workflowActions = store => ({
     })
   },
   update: async ({ instanceId, workflow }) => {
-    const UPDATE_WORKFLOW_URL = `/api/${instanceId}/workflows`
-    const response = await api.put(UPDATE_WORKFLOW_URL, workflow)
+    const UPDATE_WORKFLOW_URL = `/api/workflows`
+    const response = await api(instanceId).put(UPDATE_WORKFLOW_URL, workflow)
     const json = await response.json()
     store.update(state => {
       const existingIdx = state.workflows.findIndex(
@@ -57,8 +57,8 @@ const workflowActions = store => ({
   },
   delete: async ({ instanceId, workflow }) => {
     const { _id, _rev } = workflow
-    const DELETE_WORKFLOW_URL = `/api/${instanceId}/workflows/${_id}/${_rev}`
-    await api.delete(DELETE_WORKFLOW_URL)
+    const DELETE_WORKFLOW_URL = `/api/workflows/${_id}/${_rev}`
+    await api(instanceId).delete(DELETE_WORKFLOW_URL)
 
     store.update(state => {
       const existingIdx = state.workflows.findIndex(
diff --git a/packages/builder/src/components/database/ModelDataTable/api.js b/packages/builder/src/components/database/ModelDataTable/api.js
index cb98879567..9fb6651983 100644
--- a/packages/builder/src/components/database/ModelDataTable/api.js
+++ b/packages/builder/src/components/database/ModelDataTable/api.js
@@ -1,8 +1,8 @@
 import api from "builderStore/api"
 
 export async function createUser(user, instanceId) {
-  const CREATE_USER_URL = `/api/${instanceId}/users`
-  const response = await api.post(CREATE_USER_URL, user)
+  const CREATE_USER_URL = `/api/users`
+  const response = await api(instanceId).post(CREATE_USER_URL, user)
   return await response.json()
 }
 
@@ -15,21 +15,21 @@ export async function createDatabase(appname, instanceName) {
 }
 
 export async function deleteRecord(record, instanceId) {
-  const DELETE_RECORDS_URL = `/api/${instanceId}/${record._modelId}/records/${record._id}/${record._rev}`
-  const response = await api.delete(DELETE_RECORDS_URL)
+  const DELETE_RECORDS_URL = `/api/${record._modelId}/records/${record._id}/${record._rev}`
+  const response = await api(instanceId).delete(DELETE_RECORDS_URL)
   return response
 }
 
 export async function saveRecord(record, instanceId, modelId) {
-  const SAVE_RECORDS_URL = `/api/${instanceId}/${modelId}/records`
-  const response = await api.post(SAVE_RECORDS_URL, record)
+  const SAVE_RECORDS_URL = `/api/${modelId}/records`
+  const response = await api(instanceId).post(SAVE_RECORDS_URL, record)
 
   return await response.json()
 }
 
 export async function fetchDataForView(viewName, instanceId) {
-  const FETCH_RECORDS_URL = `/api/${instanceId}/views/${viewName}`
+  const FETCH_RECORDS_URL = `/api/views/${viewName}`
 
-  const response = await api.get(FETCH_RECORDS_URL)
+  const response = await api(instanceId).get(FETCH_RECORDS_URL)
   return await response.json()
 }
diff --git a/packages/builder/src/components/database/ModelDataTable/modals/CreateEditModel/CreateEditModel.svelte b/packages/builder/src/components/database/ModelDataTable/modals/CreateEditModel/CreateEditModel.svelte
index 6264b74e09..6fb6cc8a2f 100644
--- a/packages/builder/src/components/database/ModelDataTable/modals/CreateEditModel/CreateEditModel.svelte
+++ b/packages/builder/src/components/database/ModelDataTable/modals/CreateEditModel/CreateEditModel.svelte
@@ -27,8 +27,8 @@
   function onFinishedFieldEdit() {}
 
   async function saveModel() {
-    const SAVE_MODEL_URL = `/api/${instanceId}/models`
-    const response = await api.post(SAVE_MODEL_URL, model)
+    const SAVE_MODEL_URL = `/api/models`
+    const response = await api(instanceId).post(SAVE_MODEL_URL, model)
     const newModel = await response.json()
     backendUiStore.actions.models.create(newModel)
     onClosed()
diff --git a/packages/builder/src/components/database/ModelDataTable/modals/CreateEditView.svelte b/packages/builder/src/components/database/ModelDataTable/modals/CreateEditView.svelte
index 4db445e54f..6f9f5dac1a 100644
--- a/packages/builder/src/components/database/ModelDataTable/modals/CreateEditView.svelte
+++ b/packages/builder/src/components/database/ModelDataTable/modals/CreateEditView.svelte
@@ -29,8 +29,8 @@
   function deleteView() {}
 
   async function saveView() {
-    const SAVE_VIEW_URL = `/api/${instanceId}/views`
-    const response = await api.post(SAVE_VIEW_URL, view)
+    const SAVE_VIEW_URL = `/api/views`
+    const response = await api(instanceId).post(SAVE_VIEW_URL, view)
     backendUiStore.update(state => {
       state.views = [...state.views, response.view]
       return state
diff --git a/packages/builder/src/components/nav/HierarchyRow.svelte b/packages/builder/src/components/nav/HierarchyRow.svelte
index 8921ab74de..7653e46fd0 100644
--- a/packages/builder/src/components/nav/HierarchyRow.svelte
+++ b/packages/builder/src/components/nav/HierarchyRow.svelte
@@ -7,7 +7,6 @@
     CreateEditModelModal,
     CreateEditViewModal,
   } from "components/database/ModelDataTable/modals"
-  import api from "builderStore/api"
 
   const { open, close } = getContext("simple-modal")
 
diff --git a/packages/builder/src/components/nav/SchemaManagementDrawer.svelte b/packages/builder/src/components/nav/SchemaManagementDrawer.svelte
index cc9e5d86a7..de7d010894 100644
--- a/packages/builder/src/components/nav/SchemaManagementDrawer.svelte
+++ b/packages/builder/src/components/nav/SchemaManagementDrawer.svelte
@@ -52,8 +52,8 @@
   }
 
   async function deleteModel(modelToDelete) {
-    const DELETE_MODEL_URL = `/api/${instanceId}/models/${node._id}/${node._rev}`
-    const response = await api.delete(DELETE_MODEL_URL)
+    const DELETE_MODEL_URL = `/api/models/${node._id}/${node._rev}`
+    const response = await api(instanceId).delete(DELETE_MODEL_URL)
     backendUiStore.update(state => {
       state.models = state.models.filter(
         model => model._id !== modelToDelete._id
diff --git a/packages/builder/src/components/nav/UsersList.svelte b/packages/builder/src/components/nav/UsersList.svelte
index faef8a4234..29bc4a4ed3 100644
--- a/packages/builder/src/components/nav/UsersList.svelte
+++ b/packages/builder/src/components/nav/UsersList.svelte
@@ -16,8 +16,8 @@
   }
 
   async function fetchUsers() {
-    const FETCH_USERS_URL = `/api/${currentAppInfo.instanceId}/users`
-    const response = await api.get(FETCH_USERS_URL)
+    const FETCH_USERS_URL = `/api/users`
+    const response = await api(currentAppInfo.instanceId).get(FETCH_USERS_URL)
     const users = await response.json()
     backendUiStore.update(state => {
       state.users = users
diff --git a/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte b/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte
index f97f91df6b..523ed25031 100644
--- a/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte
+++ b/packages/builder/src/components/userInterface/AppPreview/CurrentItemPreview.svelte
@@ -108,6 +108,7 @@
         selectedComponentId,
         frontendDefinition,
         appId: $store.appId,
+        instanceId: $backendUiStore.selectedDatabase._id,
       })
     )
   }
diff --git a/packages/builder/src/components/userInterface/AppPreview/iframeTemplate.js b/packages/builder/src/components/userInterface/AppPreview/iframeTemplate.js
index b1bda4ab4f..c9272dddb2 100644
--- a/packages/builder/src/components/userInterface/AppPreview/iframeTemplate.js
+++ b/packages/builder/src/components/userInterface/AppPreview/iframeTemplate.js
@@ -20,6 +20,7 @@ export default `<html>
           font-weight: bold;
         }
     </style>
+    <script src='/assets/budibase-client.js'></script>
     <script>
       function receiveMessage(event) { 
 
@@ -44,13 +45,11 @@ export default `<html>
         document.head.appendChild(styles)
         styles.appendChild(document.createTextNode(data.styles))
 
-        document.cookie = "budibase:appid=" + data.appId
         window["##BUDIBASE_FRONTEND_DEFINITION##"] = data.frontendDefinition;
-        if (clientModule) {
-          clientModule.loadBudibase({ window, localStorage })
+        if (window.loadBudibase) {
+          loadBudibase({ window, localStorage })
         }
       }
-      let clientModule
       let styles
       let selectedComponentStyle
 
@@ -60,12 +59,9 @@ export default `<html>
         return false;
       }, true)
 
-      import('/_builder/budibase-client.esm.mjs')
-      .then(module => {
-        clientModule = module
-        window.addEventListener('message', receiveMessage)
-        window.dispatchEvent(new Event('bb-ready'))
-      })
+      window.addEventListener('message', receiveMessage)
+      window.dispatchEvent(new Event('bb-ready'))
+      
     </script>
   </head>
   <body>
diff --git a/packages/builder/src/components/workflow/SetupPanel/DeleteWorkflowModal.svelte b/packages/builder/src/components/workflow/SetupPanel/DeleteWorkflowModal.svelte
index 9f51362419..4eed82bf25 100644
--- a/packages/builder/src/components/workflow/SetupPanel/DeleteWorkflowModal.svelte
+++ b/packages/builder/src/components/workflow/SetupPanel/DeleteWorkflowModal.svelte
@@ -1,7 +1,6 @@
 <script>
   import { store, backendUiStore, workflowStore } from "builderStore"
   import { notifier } from "@beyonk/svelte-notifications"
-  import api from "builderStore/api"
   import ActionButton from "components/common/ActionButton.svelte"
 
   export let onClosed
diff --git a/packages/builder/src/components/workflow/SetupPanel/SetupPanel.svelte b/packages/builder/src/components/workflow/SetupPanel/SetupPanel.svelte
index 456505a4a8..85fae4c62f 100644
--- a/packages/builder/src/components/workflow/SetupPanel/SetupPanel.svelte
+++ b/packages/builder/src/components/workflow/SetupPanel/SetupPanel.svelte
@@ -3,7 +3,6 @@
   import { onMount, getContext } from "svelte"
   import { backendUiStore, workflowStore } from "builderStore"
   import { notifier } from "@beyonk/svelte-notifications"
-  import api from "builderStore/api"
   import WorkflowBlockSetup from "./WorkflowBlockSetup.svelte"
   import DeleteWorkflowModal from "./DeleteWorkflowModal.svelte"
 
diff --git a/packages/builder/src/components/workflow/WorkflowBuilder/WorkflowBuilder.svelte b/packages/builder/src/components/workflow/WorkflowBuilder/WorkflowBuilder.svelte
index 506575f05d..aa71a2e9a5 100644
--- a/packages/builder/src/components/workflow/WorkflowBuilder/WorkflowBuilder.svelte
+++ b/packages/builder/src/components/workflow/WorkflowBuilder/WorkflowBuilder.svelte
@@ -3,7 +3,6 @@
   import { workflowStore, backendUiStore } from "builderStore"
   import { notifier } from "@beyonk/svelte-notifications"
   import Flowchart from "./flowchart/FlowChart.svelte"
-  import api from "builderStore/api"
 
   let selectedWorkflow
   let uiTree
diff --git a/packages/builder/src/components/workflow/WorkflowPanel/BlockList/BlockList.svelte b/packages/builder/src/components/workflow/WorkflowPanel/BlockList/BlockList.svelte
index 523545a929..b70fe93640 100644
--- a/packages/builder/src/components/workflow/WorkflowPanel/BlockList/BlockList.svelte
+++ b/packages/builder/src/components/workflow/WorkflowPanel/BlockList/BlockList.svelte
@@ -3,7 +3,6 @@
   import { backendUiStore, workflowStore } from "builderStore"
   import { WorkflowList } from "../"
   import WorkflowBlock from "./WorkflowBlock.svelte"
-  import api from "builderStore/api"
   import blockDefinitions from "../blockDefinitions"
 
   let selectedTab = "TRIGGER"
diff --git a/packages/builder/src/components/workflow/WorkflowPanel/WorkflowList/CreateWorkflowModal.svelte b/packages/builder/src/components/workflow/WorkflowPanel/WorkflowList/CreateWorkflowModal.svelte
index 66683182b8..315332890f 100644
--- a/packages/builder/src/components/workflow/WorkflowPanel/WorkflowList/CreateWorkflowModal.svelte
+++ b/packages/builder/src/components/workflow/WorkflowPanel/WorkflowList/CreateWorkflowModal.svelte
@@ -1,7 +1,6 @@
 <script>
   import { store, backendUiStore, workflowStore } from "builderStore"
   import { notifier } from "@beyonk/svelte-notifications"
-  import api from "builderStore/api"
   import ActionButton from "components/common/ActionButton.svelte"
 
   export let onClosed
diff --git a/packages/builder/src/components/workflow/WorkflowPanel/WorkflowList/WorkflowList.svelte b/packages/builder/src/components/workflow/WorkflowPanel/WorkflowList/WorkflowList.svelte
index 7ba022fb78..f4c0f2ebf8 100644
--- a/packages/builder/src/components/workflow/WorkflowPanel/WorkflowList/WorkflowList.svelte
+++ b/packages/builder/src/components/workflow/WorkflowPanel/WorkflowList/WorkflowList.svelte
@@ -3,7 +3,6 @@
   import { notifier } from "@beyonk/svelte-notifications"
   import { onMount, getContext } from "svelte"
   import { backendUiStore, workflowStore } from "builderStore"
-  import api from "builderStore/api"
   import CreateWorkflowModal from "./CreateWorkflowModal.svelte"
 
   const { open, close } = getContext("simple-modal")
diff --git a/packages/builder/src/components/workflow/WorkflowPanel/WorkflowPanel.svelte b/packages/builder/src/components/workflow/WorkflowPanel/WorkflowPanel.svelte
index f1a1357978..ffa9e8f408 100644
--- a/packages/builder/src/components/workflow/WorkflowPanel/WorkflowPanel.svelte
+++ b/packages/builder/src/components/workflow/WorkflowPanel/WorkflowPanel.svelte
@@ -2,7 +2,6 @@
   import { onMount } from "svelte"
   import { backendUiStore, workflowStore } from "builderStore"
   import { WorkflowList, BlockList } from "./"
-  import api from "builderStore/api"
   import blockDefinitions from "./blockDefinitions"
 
   let selectedTab = "WORKFLOWS"
diff --git a/packages/client/src/render/getAppId.js b/packages/client/src/render/getAppId.js
index 1a8d445920..75753e381d 100644
--- a/packages/client/src/render/getAppId.js
+++ b/packages/client/src/render/getAppId.js
@@ -1,5 +1,9 @@
-export const getAppId = cookie =>
-  cookie
+export const getAppId = cookie => {
+  const base64Token = cookie
     .split(";")
-    .find(c => c.trim().startsWith("budibase:appid"))
+    .find(c => c.trim().startsWith("budibase:token"))
     .split("=")[1]
+
+  const user = JSON.parse(atob(base64Token.split(".")[1]))
+  return user.appId
+}
diff --git a/packages/client/tests/testAppDef.js b/packages/client/tests/testAppDef.js
index f75abb6556..bafba601e9 100644
--- a/packages/client/tests/testAppDef.js
+++ b/packages/client/tests/testAppDef.js
@@ -7,8 +7,9 @@ export const load = async (page, screens, url, host = "test.com") => {
 
   const fullUrl = `http://${host}${url}`
   const cookieJar = new jsdom.CookieJar()
+  const cookie = btoa('{}{"appId":"TEST_APP_ID"}signature')
   cookieJar.setCookie(
-    `budibase:appid=TEST_APP_ID;domain=${host};path=/`,
+    `budibase:token=${cookie};domain=${host};path=/`,
     fullUrl,
     {
       looseMode: false,
@@ -20,9 +21,6 @@ export const load = async (page, screens, url, host = "test.com") => {
     url: fullUrl,
     cookieJar,
   })
-  /*const cookie = tough.Cookie
-  cookie.key = "budibase:appid"
-  cookie.value = "TEST_APPID"*/
 
   autoAssignIds(page.props)
   for (let s of screens) {
@@ -44,7 +42,6 @@ export const load = async (page, screens, url, host = "test.com") => {
 }
 
 const addWindowGlobals = (window, page, screens) => {
-  window.document.cookie = "budibase:appid=TEST_APP_ID"
   window["##BUDIBASE_FRONTEND_DEFINITION##"] = {
     page,
     screens,
diff --git a/packages/server/src/api/controllers/accesslevel.js b/packages/server/src/api/controllers/accesslevel.js
index 9c9c7ff727..44b638ed41 100644
--- a/packages/server/src/api/controllers/accesslevel.js
+++ b/packages/server/src/api/controllers/accesslevel.js
@@ -8,7 +8,7 @@ const {
 } = require("../../utilities/accessLevels")
 
 exports.fetch = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const body = await db.query("database/by_type", {
     include_docs: true,
     key: ["accesslevel"],
@@ -19,12 +19,12 @@ exports.fetch = async function(ctx) {
     {
       _id: ADMIN_LEVEL_ID,
       name: "Admin",
-      permissions: await generateAdminPermissions(ctx.params.instanceId),
+      permissions: await generateAdminPermissions(ctx.user.instanceId),
     },
     {
       _id: POWERUSER_LEVEL_ID,
       name: "Power User",
-      permissions: await generatePowerUserPermissions(ctx.params.instanceId),
+      permissions: await generatePowerUserPermissions(ctx.user.instanceId),
     },
   ]
 
@@ -32,12 +32,12 @@ exports.fetch = async function(ctx) {
 }
 
 exports.find = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   ctx.body = await db.get(ctx.params.levelId)
 }
 
 exports.update = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const level = await db.get(ctx.params.levelId)
   level.name = ctx.body.name
   level.permissions = ctx.request.body.permissions
@@ -48,7 +48,7 @@ exports.update = async function(ctx) {
 }
 
 exports.patch = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const level = await db.get(ctx.params.levelId)
   const { removedPermissions, addedPermissions, _rev } = ctx.request.body
 
@@ -84,7 +84,7 @@ exports.patch = async function(ctx) {
 }
 
 exports.create = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
 
   const level = {
     name: ctx.request.body.name,
@@ -101,7 +101,7 @@ exports.create = async function(ctx) {
 }
 
 exports.destroy = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   await db.remove(ctx.params.levelId, ctx.params.rev)
   ctx.message = `Access Level ${ctx.params.id} deleted successfully`
   ctx.status = 200
diff --git a/packages/server/src/api/controllers/application.js b/packages/server/src/api/controllers/application.js
index 0f604be0e7..ab4820794f 100644
--- a/packages/server/src/api/controllers/application.js
+++ b/packages/server/src/api/controllers/application.js
@@ -9,6 +9,7 @@ const { copy, exists, readFile, writeFile } = require("fs-extra")
 const { budibaseAppsDir } = require("../../utilities/budibaseDir")
 const { exec } = require("child_process")
 const sqrl = require("squirrelly")
+const setBuilderToken = require("../../utilities/builder/setBuilderToken")
 
 exports.fetch = async function(ctx) {
   const db = new CouchDB(ClientDb.name(getClientId(ctx)))
@@ -25,6 +26,14 @@ exports.fetchAppPackage = async function(ctx) {
   const db = new CouchDB(ClientDb.name(clientId))
   const application = await db.get(ctx.params.applicationId)
   ctx.body = await getPackageForBuilder(ctx.config, application)
+  /* 
+  instance is hardcoded now - this can only change when we move
+  pages and screens into the database 
+  */
+  const devInstance = application.instances.find(
+    i => i.name === `dev-${clientId}`
+  )
+  setBuilderToken(ctx, ctx.params.applicationId, devInstance._id)
 }
 
 exports.create = async function(ctx) {
@@ -37,10 +46,12 @@ exports.create = async function(ctx) {
   const appId = newid()
   // insert an appId -> clientId lookup
   const masterDb = new CouchDB("clientAppLookup")
+
   await masterDb.put({
     _id: appId,
     clientId,
   })
+
   const db = new CouchDB(ClientDb.name(clientId))
 
   const newApplication = {
@@ -56,18 +67,18 @@ exports.create = async function(ctx) {
     description: ctx.request.body.description,
   }
 
-  const { rev } = await db.post(newApplication)
+  const { rev } = await db.put(newApplication)
   newApplication._rev = rev
-
   const createInstCtx = {
-    params: {
-      applicationId: newApplication._id,
+    user: {
+      appId: newApplication._id,
     },
     request: {
       body: { name: `dev-${clientId}` },
     },
   }
   await instanceController.create(createInstCtx)
+  newApplication.instances.push(createInstCtx.body)
 
   if (ctx.isDev) {
     const newAppFolder = await createEmptyAppPackage(ctx, newApplication)
diff --git a/packages/server/src/api/controllers/auth.js b/packages/server/src/api/controllers/auth.js
index 6ca6d7edac..88eb86c472 100644
--- a/packages/server/src/api/controllers/auth.js
+++ b/packages/server/src/api/controllers/auth.js
@@ -4,7 +4,7 @@ const ClientDb = require("../../db/clientDb")
 const bcrypt = require("../../utilities/bcrypt")
 
 exports.authenticate = async ctx => {
-  if (!ctx.appId) ctx.throw(400, "No appId")
+  if (!ctx.user.appId) ctx.throw(400, "No appId")
 
   const { username, password } = ctx.request.body
 
@@ -13,18 +13,22 @@ exports.authenticate = async ctx => {
 
   const masterDb = new CouchDB("clientAppLookup")
 
-  const { clientId } = await masterDb.get(ctx.appId)
+  const { clientId } = await masterDb.get(ctx.user.appId)
 
   if (!clientId) {
     ctx.throw(400, "ClientId not suplied")
   }
   // find the instance that the user is associated with
   const db = new CouchDB(ClientDb.name(clientId))
-  const app = await db.get(ctx.appId)
+  const app = await db.get(ctx.user.appId)
   const instanceId = app.userInstanceMap[username]
 
   if (!instanceId)
-    ctx.throw(500, "User is not associated with an instance of app", ctx.appId)
+    ctx.throw(
+      500,
+      "User is not associated with an instance of app",
+      ctx.user.appId
+    )
 
   // Check the user exists in the instance DB by username
   const instanceDb = new CouchDB(instanceId)
@@ -43,6 +47,7 @@ exports.authenticate = async ctx => {
     const payload = {
       userId: dbUser._id,
       accessLevelId: dbUser.accessLevelId,
+      appId: ctx.user.appId,
       instanceId,
     }
 
diff --git a/packages/server/src/api/controllers/instance.js b/packages/server/src/api/controllers/instance.js
index 155437371f..903d3ff651 100644
--- a/packages/server/src/api/controllers/instance.js
+++ b/packages/server/src/api/controllers/instance.js
@@ -4,19 +4,19 @@ const newid = require("../../db/newid")
 
 exports.create = async function(ctx) {
   const instanceName = ctx.request.body.name
-  const appShortId = ctx.params.applicationId.substring(0, 7)
+  const { appId } = ctx.user
+  const appShortId = appId.substring(0, 7)
   const instanceId = `inst_${appShortId}_${newid()}`
-  const { applicationId } = ctx.params
 
   const masterDb = new CouchDB("clientAppLookup")
-  const { clientId } = await masterDb.get(applicationId)
+  const { clientId } = await masterDb.get(appId)
 
   const db = new CouchDB(instanceId)
   await db.put({
     _id: "_design/database",
     metadata: {
       clientId,
-      applicationId,
+      applicationId: appId,
     },
     views: {
       by_username: {
@@ -46,7 +46,7 @@ exports.create = async function(ctx) {
 
   // Add the new instance under the app clientDB
   const clientDb = new CouchDB(client.name(clientId))
-  const budibaseApp = await clientDb.get(applicationId)
+  const budibaseApp = await clientDb.get(appId)
   const instance = { _id: instanceId, name: instanceName }
   budibaseApp.instances.push(instance)
   await clientDb.put(budibaseApp)
diff --git a/packages/server/src/api/controllers/model.js b/packages/server/src/api/controllers/model.js
index 650342b33c..e7792195cb 100644
--- a/packages/server/src/api/controllers/model.js
+++ b/packages/server/src/api/controllers/model.js
@@ -2,7 +2,7 @@ const CouchDB = require("../../db")
 const newid = require("../../db/newid")
 
 exports.fetch = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const body = await db.query("database/by_type", {
     include_docs: true,
     key: ["model"],
@@ -11,13 +11,13 @@ exports.fetch = async function(ctx) {
 }
 
 exports.find = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const model = await db.get(ctx.params.id)
   ctx.body = model
 }
 
 exports.create = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const newModel = {
     type: "model",
     ...ctx.request.body,
@@ -65,7 +65,7 @@ exports.create = async function(ctx) {
 exports.update = async function() {}
 
 exports.destroy = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
 
   const modelToDelete = await db.get(ctx.params.modelId)
 
diff --git a/packages/server/src/api/controllers/record.js b/packages/server/src/api/controllers/record.js
index cf8eb27606..4e4af81e01 100644
--- a/packages/server/src/api/controllers/record.js
+++ b/packages/server/src/api/controllers/record.js
@@ -3,7 +3,7 @@ const validateJs = require("validate.js")
 const newid = require("../../db/newid")
 
 exports.save = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const record = ctx.request.body
   record.modelId = ctx.params.modelId
 
@@ -46,7 +46,7 @@ exports.save = async function(ctx) {
   ctx.eventEmitter &&
     ctx.eventEmitter.emit(`record:save`, {
       record,
-      instanceId: ctx.params.instanceId,
+      instanceId: ctx.user.instanceId,
     })
   ctx.body = record
   ctx.status = 200
@@ -54,7 +54,7 @@ exports.save = async function(ctx) {
 }
 
 exports.fetchView = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const response = await db.query(`database/${ctx.params.viewName}`, {
     include_docs: true,
   })
@@ -62,7 +62,7 @@ exports.fetchView = async function(ctx) {
 }
 
 exports.fetchModelRecords = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const response = await db.query(`database/all_${ctx.params.modelId}`, {
     include_docs: true,
   })
@@ -70,7 +70,7 @@ exports.fetchModelRecords = async function(ctx) {
 }
 
 exports.search = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const response = await db.allDocs({
     include_docs: true,
     ...ctx.request.body,
@@ -79,7 +79,7 @@ exports.search = async function(ctx) {
 }
 
 exports.find = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const record = await db.get(ctx.params.recordId)
   if (record.modelId !== ctx.params.modelId) {
     ctx.throw(400, "Supplied modelId doe not match the record's modelId")
@@ -89,7 +89,7 @@ exports.find = async function(ctx) {
 }
 
 exports.destroy = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const record = await db.get(ctx.params.recordId)
   if (record.modelId !== ctx.params.modelId) {
     ctx.throw(400, "Supplied modelId doe not match the record's modelId")
@@ -101,7 +101,7 @@ exports.destroy = async function(ctx) {
 
 exports.validate = async function(ctx) {
   const errors = await validate({
-    instanceId: ctx.params.instanceId,
+    instanceId: ctx.user.instanceId,
     modelId: ctx.params.modelId,
     record: ctx.request.body,
   })
diff --git a/packages/server/src/api/controllers/static.js b/packages/server/src/api/controllers/static.js
index 82545d459c..181af162c5 100644
--- a/packages/server/src/api/controllers/static.js
+++ b/packages/server/src/api/controllers/static.js
@@ -4,11 +4,12 @@ const {
   budibaseAppsDir,
   budibaseTempDir,
 } = require("../../utilities/budibaseDir")
-const env = require("../../environment")
+const setBuilderToken = require("../../utilities/builder/setBuilderToken")
+const { ANON_LEVEL_ID } = require("../../utilities/accessLevels")
 
 exports.serveBuilder = async function(ctx) {
   let builderPath = resolve(__dirname, "../../../builder")
-  ctx.cookies.set("builder:token", env.ADMIN_SECRET)
+  setBuilderToken(ctx)
   await send(ctx, ctx.file, { root: ctx.devPath || builderPath })
 }
 
@@ -22,11 +23,15 @@ exports.serveApp = async function(ctx) {
   )
   // only set the appId cookie for /appId .. we COULD check for valid appIds
   // but would like to avoid that DB hit
-  if (looksLikeAppId(ctx.params.appId)) {
-    ctx.cookies.set("budibase:appid", ctx.params.appId, {
+  if (looksLikeAppId(ctx.params.appId) && !ctx.isAuthenticated) {
+    const anonToken = {
+      userId: "ANON",
+      accessLevelId: ANON_LEVEL_ID,
+      appId: ctx.params.appId,
+    }
+    ctx.cookies.set("budibase:token", anonToken, {
       path: "/",
       httpOnly: false,
-      expires: new Date(2099, 1, 1),
     })
   }
 
@@ -37,7 +42,7 @@ exports.serveAppAsset = async function(ctx) {
   // default to homedir
   const appPath = resolve(
     budibaseAppsDir(),
-    ctx.appId,
+    ctx.user.appId,
     "public",
     ctx.isAuthenticated ? "main" : "unauthenticated"
   )
@@ -49,7 +54,7 @@ exports.serveComponentLibrary = async function(ctx) {
   // default to homedir
   let componentLibraryPath = resolve(
     budibaseAppsDir(),
-    ctx.appId,
+    ctx.user.appId,
     "node_modules",
     decodeURI(ctx.query.library),
     "dist"
diff --git a/packages/server/src/api/controllers/user.js b/packages/server/src/api/controllers/user.js
index 1b66cf1cca..71816f1c78 100644
--- a/packages/server/src/api/controllers/user.js
+++ b/packages/server/src/api/controllers/user.js
@@ -8,7 +8,7 @@ const {
 } = require("../../utilities/accessLevels")
 
 exports.fetch = async function(ctx) {
-  const database = new CouchDB(ctx.params.instanceId)
+  const database = new CouchDB(ctx.user.instanceId)
   const data = await database.query("database/by_type", {
     include_docs: true,
     key: ["user"],
@@ -18,7 +18,7 @@ exports.fetch = async function(ctx) {
 }
 
 exports.create = async function(ctx) {
-  const database = new CouchDB(ctx.params.instanceId)
+  const database = new CouchDB(ctx.user.instanceId)
   const appId = (await database.get("_design/database")).metadata.applicationId
   const { username, password, name, accessLevelId } = ctx.request.body
 
@@ -50,7 +50,7 @@ exports.create = async function(ctx) {
 
   app.userInstanceMap = {
     ...app.userInstanceMap,
-    [username]: ctx.params.instanceId,
+    [username]: ctx.user.instanceId,
   }
   await db.put(app)
 
@@ -66,14 +66,14 @@ exports.create = async function(ctx) {
 exports.update = async function() {}
 
 exports.destroy = async function(ctx) {
-  const database = new CouchDB(ctx.params.instanceId)
+  const database = new CouchDB(ctx.user.instanceId)
   await database.destroy(getUserId(ctx.params.username))
   ctx.message = `User ${ctx.params.username} deleted.`
   ctx.status = 200
 }
 
 exports.find = async function(ctx) {
-  const database = new CouchDB(ctx.params.instanceId)
+  const database = new CouchDB(ctx.user.instanceId)
   const user = await database.get(getUserId(ctx.params.username))
   ctx.body = {
     username: user.username,
diff --git a/packages/server/src/api/controllers/view.js b/packages/server/src/api/controllers/view.js
index 9e847da358..d449ae36f9 100644
--- a/packages/server/src/api/controllers/view.js
+++ b/packages/server/src/api/controllers/view.js
@@ -3,7 +3,7 @@ const CouchDB = require("../../db")
 const controller = {
   query: async () => {},
   fetch: async ctx => {
-    const db = new CouchDB(ctx.params.instanceId)
+    const db = new CouchDB(ctx.user.instanceId)
     const designDoc = await db.get("_design/database")
     const response = []
 
@@ -24,7 +24,7 @@ const controller = {
     ctx.body = response
   },
   create: async ctx => {
-    const db = new CouchDB(ctx.params.instanceId)
+    const db = new CouchDB(ctx.user.instanceId)
     const newView = ctx.request.body
 
     const designDoc = await db.get("_design/database")
@@ -38,7 +38,7 @@ const controller = {
     ctx.message = `View ${newView.name} created successfully.`
   },
   destroy: async ctx => {
-    const db = new CouchDB(ctx.params.instanceId)
+    const db = new CouchDB(ctx.user.instanceId)
     ctx.body = await db.destroy(ctx.params.userId)
   },
 }
diff --git a/packages/server/src/api/controllers/workflow/index.js b/packages/server/src/api/controllers/workflow/index.js
index f1dd1bcb89..5c77bbfaa6 100644
--- a/packages/server/src/api/controllers/workflow/index.js
+++ b/packages/server/src/api/controllers/workflow/index.js
@@ -2,7 +2,7 @@ const CouchDB = require("../../../db")
 const newid = require("../../../db/newid")
 
 exports.create = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const workflow = ctx.request.body
 
   workflow._id = newid()
@@ -22,7 +22,7 @@ exports.create = async function(ctx) {
 }
 
 exports.update = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const workflow = ctx.request.body
 
   const response = await db.put(workflow)
@@ -40,7 +40,7 @@ exports.update = async function(ctx) {
 }
 
 exports.fetch = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   const response = await db.query(`database/by_type`, {
     key: ["workflow"],
     include_docs: true,
@@ -69,6 +69,6 @@ exports.fetchActionScript = async function(ctx) {
 }
 
 exports.destroy = async function(ctx) {
-  const db = new CouchDB(ctx.params.instanceId)
+  const db = new CouchDB(ctx.user.instanceId)
   ctx.body = await db.remove(ctx.params.id, ctx.params.rev)
 }
diff --git a/packages/server/src/api/index.js b/packages/server/src/api/index.js
index 8c69407736..e6143d6725 100644
--- a/packages/server/src/api/index.js
+++ b/packages/server/src/api/index.js
@@ -60,11 +60,6 @@ router.use(async (ctx, next) => {
   }
 })
 
-router.use(async (ctx, next) => {
-  ctx.appId = ctx.cookies.get("budibase:appid")
-  await next()
-})
-
 router.use(authRoutes.routes())
 router.use(authRoutes.allowedMethods())
 
diff --git a/packages/server/src/api/routes/accesslevel.js b/packages/server/src/api/routes/accesslevel.js
index d34acab02c..af1ff80ec6 100644
--- a/packages/server/src/api/routes/accesslevel.js
+++ b/packages/server/src/api/routes/accesslevel.js
@@ -4,11 +4,11 @@ const controller = require("../controllers/accesslevel")
 const router = Router()
 
 router
-  .post("/api/:instanceId/accesslevels", controller.create)
-  .put("/api/:instanceId/accesslevels", controller.update)
-  .get("/api/:instanceId/accesslevels", controller.fetch)
-  .get("/api/:instanceId/accesslevels/:levelId", controller.find)
-  .delete("/api/:instanceId/accesslevels/:levelId/:rev", controller.destroy)
-  .patch("/api/:instanceId/accesslevels/:levelId", controller.patch)
+  .post("/api/accesslevels", controller.create)
+  .put("/api/accesslevels", controller.update)
+  .get("/api/accesslevels", controller.fetch)
+  .get("/api/accesslevels/:levelId", controller.find)
+  .delete("/api/accesslevels/:levelId/:rev", controller.destroy)
+  .patch("/api/accesslevels/:levelId", controller.patch)
 
 module.exports = router
diff --git a/packages/server/src/api/routes/instance.js b/packages/server/src/api/routes/instance.js
index 9b7b3db511..00fce6bb12 100644
--- a/packages/server/src/api/routes/instance.js
+++ b/packages/server/src/api/routes/instance.js
@@ -6,7 +6,7 @@ const { BUILDER } = require("../../utilities/accessLevels")
 const router = Router()
 
 router
-  .post("/api/:applicationId/instances", authorized(BUILDER), controller.create)
+  .post("/api/instances", authorized(BUILDER), controller.create)
   .delete("/api/instances/:instanceId", authorized(BUILDER), controller.destroy)
 
 module.exports = router
diff --git a/packages/server/src/api/routes/model.js b/packages/server/src/api/routes/model.js
index f1ec46dbe5..b5ab9b3f95 100644
--- a/packages/server/src/api/routes/model.js
+++ b/packages/server/src/api/routes/model.js
@@ -1,17 +1,21 @@
 const Router = require("@koa/router")
 const modelController = require("../controllers/model")
 const authorized = require("../../middleware/authorized")
-const { BUILDER } = require("../../utilities/accessLevels")
+const { BUILDER, READ_MODEL } = require("../../utilities/accessLevels")
 
 const router = Router()
 
 router
-  .get("/api/:instanceId/models", authorized(BUILDER), modelController.fetch)
-  .get("/api/:instanceId/models/:id", authorized(BUILDER), modelController.find)
-  .post("/api/:instanceId/models", authorized(BUILDER), modelController.create)
+  .get("/api/models", modelController.fetch)
+  .get(
+    "/api/models/:id",
+    authorized(READ_MODEL, ctx => ctx.params.id),
+    modelController.find
+  )
+  .post("/api/models", authorized(BUILDER), modelController.create)
   // .patch("/api/:instanceId/models", controller.update)
   .delete(
-    "/api/:instanceId/models/:modelId/:revId",
+    "/api/models/:modelId/:revId",
     authorized(BUILDER),
     modelController.destroy
   )
diff --git a/packages/server/src/api/routes/record.js b/packages/server/src/api/routes/record.js
index d555d3d8c8..deba513aa9 100644
--- a/packages/server/src/api/routes/record.js
+++ b/packages/server/src/api/routes/record.js
@@ -7,28 +7,28 @@ const router = Router()
 
 router
   .get(
-    "/api/:instanceId/:modelId/records",
+    "/api/:modelId/records",
     authorized(READ_MODEL, ctx => ctx.params.modelId),
     recordController.fetchModelRecords
   )
   .get(
-    "/api/:instanceId/:modelId/records/:recordId",
+    "/api/:modelId/records/:recordId",
     authorized(READ_MODEL, ctx => ctx.params.modelId),
     recordController.find
   )
-  .post("/api/:instanceId/records/search", recordController.search)
+  .post("/api/records/search", recordController.search)
   .post(
-    "/api/:instanceId/:modelId/records",
+    "/api/:modelId/records",
     authorized(WRITE_MODEL, ctx => ctx.params.modelId),
     recordController.save
   )
   .post(
-    "/api/:instanceId/:modelId/records/validate",
+    "/api/:modelId/records/validate",
     authorized(WRITE_MODEL, ctx => ctx.params.modelId),
     recordController.validate
   )
   .delete(
-    "/api/:instanceId/:modelId/records/:recordId/:revId",
+    "/api/:modelId/records/:recordId/:revId",
     authorized(WRITE_MODEL, ctx => ctx.params.modelId),
     recordController.destroy
   )
diff --git a/packages/server/src/api/routes/screen.js b/packages/server/src/api/routes/screen.js
index 19823aab68..60e29bf363 100644
--- a/packages/server/src/api/routes/screen.js
+++ b/packages/server/src/api/routes/screen.js
@@ -6,12 +6,8 @@ const { BUILDER } = require("../../utilities/accessLevels")
 const router = Router()
 
 router
-  .get("/api/:instanceId/screens", authorized(BUILDER), controller.fetch)
-  .post("/api/:instanceId/screens", authorized(BUILDER), controller.save)
-  .delete(
-    "/api/:instanceId/:screenId/:revId",
-    authorized(BUILDER),
-    controller.destroy
-  )
+  .get("/api/screens", authorized(BUILDER), controller.fetch)
+  .post("/api/screens", authorized(BUILDER), controller.save)
+  .delete("/api/:screenId/:revId", authorized(BUILDER), controller.destroy)
 
 module.exports = router
diff --git a/packages/server/src/api/routes/tests/accesslevel.spec.js b/packages/server/src/api/routes/tests/accesslevel.spec.js
index ef2d1575cd..9cd3495ed8 100644
--- a/packages/server/src/api/routes/tests/accesslevel.spec.js
+++ b/packages/server/src/api/routes/tests/accesslevel.spec.js
@@ -36,8 +36,8 @@ describe("/accesslevels", () => {
 
   beforeEach(async () => {
     instanceId = (await createInstance(request, appId))._id
-    model = await createModel(request, instanceId)
-    view = await createView(request, instanceId)
+    model = await createModel(request, appId, instanceId)
+    view = await createView(request, appId, instanceId)
   })
 
   describe("create", () => {
@@ -46,7 +46,7 @@ describe("/accesslevels", () => {
       const res = await request
         .post(`/api/${instanceId}/accesslevels`)
         .send({ name: "user" })
-        .set(defaultHeaders)
+        .set(defaultHeaders(appId, instanceId))
         .expect('Content-Type', /json/)
         .expect(200)
 
@@ -64,7 +64,7 @@ describe("/accesslevels", () => {
       const createRes = await request
         .post(`/api/${instanceId}/accesslevels`)
         .send({ name: "user", permissions: [ { itemId: model._id, name: READ_MODEL }] })
-        .set(defaultHeaders)
+        .set(defaultHeaders(appId, instanceId))
         .expect('Content-Type', /json/)
         .expect(200)
 
@@ -72,7 +72,7 @@ describe("/accesslevels", () => {
 
       const res = await request
         .get(`/api/${instanceId}/accesslevels`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(appId, instanceId))
         .expect('Content-Type', /json/)
         .expect(200)
 
@@ -97,7 +97,7 @@ describe("/accesslevels", () => {
       const createRes = await request
         .post(`/api/${instanceId}/accesslevels`)
         .send({ name: "user", permissions: [ { itemId: model._id, name: READ_MODEL } ] })
-        .set(defaultHeaders)
+        .set(defaultHeaders(appId, instanceId))
         .expect('Content-Type', /json/)
         .expect(200)
 
@@ -105,12 +105,12 @@ describe("/accesslevels", () => {
 
       await request
         .delete(`/api/${instanceId}/accesslevels/${customLevel._id}/${customLevel._rev}`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(appId, instanceId))
         .expect(200)
 
       await request
         .get(`/api/${instanceId}/accesslevels/${customLevel._id}`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(appId, instanceId))
         .expect(404)      
     })
   })
@@ -120,7 +120,7 @@ describe("/accesslevels", () => {
       const createRes = await request
         .post(`/api/${instanceId}/accesslevels`)
         .send({ name: "user", permissions: [ { itemId: model._id, name: READ_MODEL }] })
-        .set(defaultHeaders)
+        .set(defaultHeaders(appId, instanceId))
         .expect('Content-Type', /json/)
         .expect(200)
 
@@ -132,13 +132,13 @@ describe("/accesslevels", () => {
           _rev: customLevel._rev,
           addedPermissions:  [ { itemId: model._id, name: WRITE_MODEL } ] 
         })
-        .set(defaultHeaders)
+        .set(defaultHeaders(appId, instanceId))
         .expect('Content-Type', /json/)
         .expect(200)
 
       const finalRes = await request
         .get(`/api/${instanceId}/accesslevels/${customLevel._id}`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(appId, instanceId))
         .expect(200) 
 
       expect(finalRes.body.permissions.length).toBe(2)
@@ -156,7 +156,7 @@ describe("/accesslevels", () => {
             { itemId: model._id, name: WRITE_MODEL },
           ] 
         })
-        .set(defaultHeaders)
+        .set(defaultHeaders(appId, instanceId))
         .expect('Content-Type', /json/)
         .expect(200)
 
@@ -168,13 +168,13 @@ describe("/accesslevels", () => {
           _rev: customLevel._rev,
           removedPermissions:  [ { itemId: model._id, name: WRITE_MODEL }] 
         })
-        .set(defaultHeaders)
+        .set(defaultHeaders(appId, instanceId))
         .expect('Content-Type', /json/)
         .expect(200)
 
       const finalRes = await request
         .get(`/api/${instanceId}/accesslevels/${customLevel._id}`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(appId, instanceId))
         .expect(200) 
 
       expect(finalRes.body.permissions.length).toBe(1)
diff --git a/packages/server/src/api/routes/tests/application.spec.js b/packages/server/src/api/routes/tests/application.spec.js
index 7f64419778..0bde24a02f 100644
--- a/packages/server/src/api/routes/tests/application.spec.js
+++ b/packages/server/src/api/routes/tests/application.spec.js
@@ -34,14 +34,14 @@ describe("/applications", () => {
       const res = await request
         .post("/api/applications")
         .send({ name: "My App" })
-        .set(defaultHeaders)
+        .set(defaultHeaders())
         .expect('Content-Type', /json/)
         .expect(200)
       expect(res.res.statusMessage).toEqual("Application My App created successfully")
       expect(res.body._id).toBeDefined()
     })
 
-    it("should apply authorization to endpoint", async () => {
+    fit("should apply authorization to endpoint", async () => {
       const otherApplication = await createApplication(request) 
       const instance = await createInstance(request, otherApplication._id)
       await builderEndpointShouldBlockNormalUsers({
@@ -49,6 +49,7 @@ describe("/applications", () => {
         method: "POST",
         url: `/api/applications`,
         instanceId: instance._id,
+        appId: otherApplication._id,
         body: { name: "My App" }
       })
     })
@@ -63,7 +64,7 @@ describe("/applications", () => {
 
       const res = await request
         .get("/api/applications")
-        .set(defaultHeaders)
+        .set(defaultHeaders())
         .expect('Content-Type', /json/)
         .expect(200)
 
@@ -77,13 +78,13 @@ describe("/applications", () => {
       const blah = await request
         .post("/api/applications")
         .send({ name: "app2", clientId: "new_client"})
-        .set(defaultHeaders)
+        .set(defaultHeaders())
         .expect('Content-Type', /json/)
         //.expect(200)
 
       const client1Res = await request
         .get(`/api/applications?clientId=${TEST_CLIENT_ID}`)
-        .set(defaultHeaders)
+        .set(defaultHeaders())
         .expect('Content-Type', /json/)
         .expect(200)
       
@@ -92,7 +93,7 @@ describe("/applications", () => {
 
       const client2Res = await request
         .get(`/api/applications?clientId=new_client`)
-        .set(defaultHeaders)
+        .set(defaultHeaders())
         .expect('Content-Type', /json/)
         .expect(200)
       
@@ -109,6 +110,7 @@ describe("/applications", () => {
         method: "GET",
         url: `/api/applications`,
         instanceId: instance._id,
+        appId: otherApplication._id,
       })
     })
   })
diff --git a/packages/server/src/api/routes/tests/couchTestUtils.js b/packages/server/src/api/routes/tests/couchTestUtils.js
index e21d459d3a..ebf09e392d 100644
--- a/packages/server/src/api/routes/tests/couchTestUtils.js
+++ b/packages/server/src/api/routes/tests/couchTestUtils.js
@@ -4,8 +4,12 @@ const supertest = require("supertest")
 const app = require("../../../app")
 const {
   POWERUSER_LEVEL_ID,
+  ANON_LEVEL_ID,
+  BUILDER_LEVEL_ID,
   generateAdminPermissions,
 } = require("../../../utilities/accessLevels")
+const jwt = require("jsonwebtoken")
+const env = require("../../../environment")
 
 const TEST_CLIENT_ID = "test-client-id"
 
@@ -20,13 +24,24 @@ exports.supertest = async () => {
   return { request, server }
 }
 
-exports.defaultHeaders = {
-  Accept: "application/json",
-  Cookie: ["builder:token=test-admin-secret"],
-  "x-user-agent": "Budibase Builder",
+exports.defaultHeaders = (appId, instanceId) => {
+  const builderUser = {
+    userId: "BUILDER",
+    accessLevelId: BUILDER_LEVEL_ID,
+    appId,
+    instanceId,
+  }
+
+  const builderToken = jwt.sign(builderUser, env.JWT_SECRET)
+
+  return {
+    Accept: "application/json",
+    Cookie: [`builder:token=${builderToken}`],
+    "x-user-agent": "Budibase Builder",
+  }
 }
 
-exports.createModel = async (request, instanceId, model) => {
+exports.createModel = async (request, appId, instanceId, model) => {
   model = model || {
     name: "TestModel",
     type: "model",
@@ -43,19 +58,19 @@ exports.createModel = async (request, instanceId, model) => {
 
   const res = await request
     .post(`/api/${instanceId}/models`)
-    .set(exports.defaultHeaders)
+    .set(exports.defaultHeaders(appId, instanceId))
     .send(model)
   return res.body
 }
 
-exports.createView = async (request, instanceId, view) => {
+exports.createView = async (request, appId, instanceId, view) => {
   view = view || {
     map: "function(doc) { emit(doc[doc.key], doc._id); } ",
   }
 
   const res = await request
     .post(`/api/${instanceId}/views`)
-    .set(exports.defaultHeaders)
+    .set(exports.defaultHeaders(appId, instanceId))
     .send(view)
   return res.body
 }
@@ -65,7 +80,7 @@ exports.createClientDatabase = async id => await create(id || TEST_CLIENT_ID)
 exports.createApplication = async (request, name = "test_application") => {
   const res = await request
     .post("/api/applications")
-    .set(exports.defaultHeaders)
+    .set(exports.defaultHeaders())
     .send({
       name,
     })
@@ -76,8 +91,8 @@ exports.destroyClientDatabase = async () => await destroy(TEST_CLIENT_ID)
 
 exports.createInstance = async (request, appId) => {
   const res = await request
-    .post(`/api/${appId}/instances`)
-    .set(exports.defaultHeaders)
+    .post(`/api/instances`)
+    .set(exports.defaultHeaders(appId))
     .send({
       name: "test-instance",
     })
@@ -86,13 +101,14 @@ exports.createInstance = async (request, appId) => {
 
 exports.createUser = async (
   request,
+  appId,
   instanceId,
   username = "babs",
   password = "babs_password"
 ) => {
   const res = await request
-    .post(`/api/${instanceId}/users`)
-    .set(exports.defaultHeaders)
+    .post(`/api/users`)
+    .set(exports.defaultHeaders(appId, instanceId))
     .send({
       name: "Bill",
       username,
@@ -104,6 +120,7 @@ exports.createUser = async (
 
 const createUserWithOnePermission = async (
   request,
+  appId,
   instanceId,
   permName,
   itemId
@@ -115,17 +132,19 @@ const createUserWithOnePermission = async (
 
   return await createUserWithPermissions(
     request,
+    appId,
     instanceId,
     permissions,
     "onePermOnlyUser"
   )
 }
 
-const createUserWithAdminPermissions = async (request, instanceId) => {
+const createUserWithAdminPermissions = async (request, appId, instanceId) => {
   let permissions = await generateAdminPermissions(instanceId)
 
   return await createUserWithPermissions(
     request,
+    appId,
     instanceId,
     permissions,
     "adminUser"
@@ -134,6 +153,7 @@ const createUserWithAdminPermissions = async (request, instanceId) => {
 
 const createUserWithAllPermissionExceptOne = async (
   request,
+  appId,
   instanceId,
   permName,
   itemId
@@ -145,6 +165,7 @@ const createUserWithAllPermissionExceptOne = async (
 
   return await createUserWithPermissions(
     request,
+    appId,
     instanceId,
     permissions,
     "allPermsExceptOneUser"
@@ -153,6 +174,7 @@ const createUserWithAllPermissionExceptOne = async (
 
 const createUserWithPermissions = async (
   request,
+  appId,
   instanceId,
   permissions,
   username
@@ -160,12 +182,12 @@ const createUserWithPermissions = async (
   const accessRes = await request
     .post(`/api/${instanceId}/accesslevels`)
     .send({ name: "TestLevel", permissions })
-    .set(exports.defaultHeaders)
+    .set(exports.defaultHeaders(appId, instanceId))
 
   const password = `password_${username}`
   await request
     .post(`/api/${instanceId}/users`)
-    .set(exports.defaultHeaders)
+    .set(exports.defaultHeaders(appId, instanceId))
     .send({
       name: username,
       username,
@@ -173,12 +195,20 @@ const createUserWithPermissions = async (
       accessLevelId: accessRes.body._id,
     })
 
-  const db = new CouchDB(instanceId)
-  const designDoc = await db.get("_design/database")
+  //const db = new CouchDB(instanceId)
+  //const designDoc = await db.get("_design/database")
+
+  const anonUser = {
+    userId: "ANON",
+    accessLevelId: ANON_LEVEL_ID,
+    appId: appId,
+  }
+
+  const anonToken = jwt.sign(anonUser, env.JWT_SECRET)
 
   const loginResult = await request
     .post(`/api/authenticate`)
-    .set({ Cookie: `budibase:appid=${designDoc.metadata.applicationId}` })
+    .set({ Cookie: `budibase:token=${anonToken}` })
     .send({ username, password })
 
   // returning necessary request headers
@@ -193,12 +223,14 @@ exports.testPermissionsForEndpoint = async ({
   method,
   url,
   body,
+  appId,
   instanceId,
   permissionName,
   itemId,
 }) => {
   const headers = await createUserWithOnePermission(
     request,
+    appId,
     instanceId,
     permissionName,
     itemId
@@ -210,6 +242,7 @@ exports.testPermissionsForEndpoint = async ({
 
   const noPermsHeaders = await createUserWithAllPermissionExceptOne(
     request,
+    appId,
     instanceId,
     permissionName,
     itemId
@@ -225,9 +258,14 @@ exports.builderEndpointShouldBlockNormalUsers = async ({
   method,
   url,
   body,
+  appId,
   instanceId,
 }) => {
-  const headers = await createUserWithAdminPermissions(request, instanceId)
+  const headers = await createUserWithAdminPermissions(
+    request,
+    appId,
+    instanceId
+  )
 
   await createRequest(request, method, url, body)
     .set(headers)
diff --git a/packages/server/src/api/routes/tests/instance.spec.js b/packages/server/src/api/routes/tests/instance.spec.js
index 0b8bd44cb6..3bbed4d8e6 100644
--- a/packages/server/src/api/routes/tests/instance.spec.js
+++ b/packages/server/src/api/routes/tests/instance.spec.js
@@ -24,9 +24,9 @@ describe("/instances", () => {
 
     it("returns a success message when the instance database is successfully created", async () => {
       const res = await request
-        .post(`/api/${TEST_APP_ID}/instances`)
+        .post(`/api/instances`)
         .send({ name: "test-instance" })
-        .set(defaultHeaders)
+        .set(defaultHeaders(TEST_APP_ID))
         .expect('Content-Type', /json/)
         .expect(200)
 
@@ -42,7 +42,7 @@ describe("/instances", () => {
       const instance = await createInstance(request, TEST_APP_ID);
       const res = await request
         .delete(`/api/instances/${instance._id}`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(TEST_APP_ID))
         .expect(200)
 
       expect(res.res.statusMessage).toEqual(`Instance Database ${instance._id} successfully destroyed.`);
diff --git a/packages/server/src/api/routes/tests/model.spec.js b/packages/server/src/api/routes/tests/model.spec.js
index 7134245fb3..f4708be58d 100644
--- a/packages/server/src/api/routes/tests/model.spec.js
+++ b/packages/server/src/api/routes/tests/model.spec.js
@@ -41,7 +41,7 @@ describe("/models", () => {
             name: { type: "string" }
           }
         })
-        .set(defaultHeaders)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
         .end(async (err, res) => {
@@ -73,13 +73,13 @@ describe("/models", () => {
 
     beforeEach(async () => {
       instance = await createInstance(request, app._id)
-      testModel = await createModel(request, instance._id, testModel)
+      testModel = await createModel(request, app._id, instance._id, testModel)
     });
 
     it("returns all the models for that instance in the response body", done => {
       request
         .get(`/api/${instance._id}/models`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
         .end(async (_, res) => {
@@ -105,7 +105,7 @@ describe("/models", () => {
 
     beforeEach(async () => {
       instance = await createInstance(request, app._id)
-      testModel = await createModel(request, instance._id, testModel)
+      testModel = await createModel(request, app._id, instance._id, testModel)
     });
 
     afterEach(() => {
@@ -115,7 +115,7 @@ describe("/models", () => {
     it("returns a success response when a model is deleted.", async done => {
       request
         .delete(`/api/${instance._id}/models/${testModel._id}/${testModel._rev}`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
         .end(async (_, res) => {
@@ -125,7 +125,7 @@ describe("/models", () => {
       })
 
     it("deletes linked references to the model after deletion", async done => {
-      const linkedModel = await createModel(request, instance._id, {
+      const linkedModel = await createModel(request, app._id, instance._id, {
         name: "LinkedModel",
         type: "model",
         key: "name",
@@ -148,7 +148,7 @@ describe("/models", () => {
 
       request
         .delete(`/api/${instance._id}/models/${testModel._id}/${testModel._rev}`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
         .end(async (_, res) => {
diff --git a/packages/server/src/api/routes/tests/record.spec.js b/packages/server/src/api/routes/tests/record.spec.js
index 22ac67ecdc..c856cfc47a 100644
--- a/packages/server/src/api/routes/tests/record.spec.js
+++ b/packages/server/src/api/routes/tests/record.spec.js
@@ -27,7 +27,7 @@ describe("/records", () => {
 
   beforeEach(async () => {
     instance = await createInstance(request, app._id)
-    model = await createModel(request, instance._id)
+    model = await createModel(request, app._id, instance._id)
     record = {
       name: "Test Contact",
       status: "new",
@@ -39,13 +39,13 @@ describe("/records", () => {
 
     const createRecord = async r => 
       await request
-        .post(`/api/${instance._id}/${model._id}/records`)
+        .post(`/api/${model._id}/records`)
         .send(r || record)
-        .set(defaultHeaders)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
 
-    it("returns a success message when the record is created", async () => {
+    fit("returns a success message when the record is created", async () => {
       const res = await createRecord()
       expect(res.res.statusMessage).toEqual(`${model.name} created successfully`)           
       expect(res.body.name).toEqual("Test Contact")
@@ -57,14 +57,14 @@ describe("/records", () => {
       const existing = rec.body
 
       const res = await request
-        .post(`/api/${instance._id}/${model._id}/records`)
+        .post(`/api/${model._id}/records`)
         .send({
           _id: existing._id,
           _rev: existing._rev,
           modelId: model._id,
           name: "Updated Name",
         })
-        .set(defaultHeaders)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
       
@@ -77,8 +77,8 @@ describe("/records", () => {
       const existing = rec.body
 
       const res = await request
-        .get(`/api/${instance._id}/${model._id}/records/${existing._id}`)
-        .set(defaultHeaders)
+        .get(`/api/${model._id}/records/${existing._id}`)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
 
@@ -100,8 +100,8 @@ describe("/records", () => {
       await createRecord(newRecord)
 
       const res = await request
-        .get(`/api/${instance._id}/${model._id}/records`)
-        .set(defaultHeaders)
+        .get(`/api/${model._id}/records`)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
 
@@ -122,8 +122,8 @@ describe("/records", () => {
       const recordIds = [record.body._id, secondRecord.body._id]
 
       const res = await request
-        .post(`/api/${instance._id}/records/search`)
-        .set(defaultHeaders)
+        .post(`/api/records/search`)
+        .set(defaultHeaders(app._id, instance._id))
         .send({
           keys: recordIds
         })
@@ -137,8 +137,8 @@ describe("/records", () => {
     it("load should return 404 when record does not exist", async () => {
       await createRecord()
       await request
-        .get(`/api/${instance._id}/${model._id}/records/not-a-valid-id`)
-        .set(defaultHeaders)
+        .get(`/api/${model._id}/records/not-a-valid-id`)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(404)
     })
@@ -147,9 +147,9 @@ describe("/records", () => {
   describe("validate", () => {
     it("should return no errors on valid record", async () => {
       const result = await request
-        .post(`/api/${instance._id}/${model._id}/records/validate`)
+        .post(`/api/${model._id}/records/validate`)
         .send({ name: "ivan" })
-        .set(defaultHeaders)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
       
@@ -159,9 +159,9 @@ describe("/records", () => {
 
     it("should errors on invalid record", async () => {
       const result = await request
-        .post(`/api/${instance._id}/${model._id}/records/validate`)
+        .post(`/api/${model._id}/records/validate`)
         .send({ name: 1 })
-        .set(defaultHeaders)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
       
diff --git a/packages/server/src/api/routes/tests/user.spec.js b/packages/server/src/api/routes/tests/user.spec.js
index d950f03c3d..4900946e45 100644
--- a/packages/server/src/api/routes/tests/user.spec.js
+++ b/packages/server/src/api/routes/tests/user.spec.js
@@ -36,11 +36,11 @@ describe("/users", () => {
   describe("fetch", () => {    
 
     it("returns a list of users from an instance db", async () => {
-      await createUser(request, instance._id, "brenda", "brendas_password")
-      await createUser(request, instance._id, "pam", "pam_password")
+      await createUser(request, app._id, instance._id, "brenda", "brendas_password")
+      await createUser(request, app._id, instance._id, "pam", "pam_password")
       const res = await request
-        .get(`/api/${instance._id}/users`)
-        .set(defaultHeaders)
+        .get(`/api/users`)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
       
@@ -50,7 +50,7 @@ describe("/users", () => {
     })
 
     it("should apply authorization to endpoint", async () => {
-      await createUser(request, instance._id, "brenda", "brendas_password")
+      await createUser(request, app._id, instance._id, "brenda", "brendas_password")
       await testPermissionsForEndpoint({
         request,
         method: "GET",
@@ -67,7 +67,7 @@ describe("/users", () => {
     it("returns a success message when a user is successfully created", async () => {
       const res = await request
         .post(`/api/${instance._id}/users`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(app._id, instance._id))
         .send({ name: "Bill", username: "bill", password: "bills_password", accessLevelId: POWERUSER_LEVEL_ID })
         .expect(200)
         .expect('Content-Type', /json/)
diff --git a/packages/server/src/api/routes/tests/view.spec.js b/packages/server/src/api/routes/tests/view.spec.js
index b8fd47972a..db521ef53b 100644
--- a/packages/server/src/api/routes/tests/view.spec.js
+++ b/packages/server/src/api/routes/tests/view.spec.js
@@ -40,7 +40,7 @@ describe("/views", () => {
       }`,
       reduce: `function(keys, values) { }`
     })
-    .set(defaultHeaders)
+    .set(defaultHeaders(app._id, instance._id))
     .expect('Content-Type', /json/)
     .expect(200)
 
@@ -56,14 +56,14 @@ describe("/views", () => {
   describe("fetch", () => {
 
     beforeEach(async () => {
-      model = await createModel(request, instance._id);
+      model = await createModel(request, app._id, instance._id);
     });
 
     it("should only return custom views", async () => {
       const view = await createView()
       const res = await request
         .get(`/api/${instance._id}/views`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
       expect(res.body.length).toBe(1)
diff --git a/packages/server/src/api/routes/tests/workflow.spec.js b/packages/server/src/api/routes/tests/workflow.spec.js
index 1f345698bf..bcd1f67120 100644
--- a/packages/server/src/api/routes/tests/workflow.spec.js
+++ b/packages/server/src/api/routes/tests/workflow.spec.js
@@ -64,7 +64,7 @@ describe("/workflows", () => {
     it("returns a success message when the workflow is successfully created", async () => {
       const res = await request
         .post(`/api/${instance._id}/workflows`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(app._id, instance._id))
         .send(TEST_WORKFLOW)
         .expect('Content-Type', /json/)
         .expect(200)
@@ -93,7 +93,7 @@ describe("/workflows", () => {
 
       const res = await request
         .put(`/api/${instance._id}/workflows`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(app._id, instance._id))
         .send(workflow)
         .expect('Content-Type', /json/)
         .expect(200)
@@ -108,7 +108,7 @@ describe("/workflows", () => {
       await createWorkflow();
       const res = await request
         .get(`/api/${instance._id}/workflows`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
 
@@ -130,7 +130,7 @@ describe("/workflows", () => {
       await createWorkflow();
       const res = await request
         .delete(`/api/${instance._id}/workflows/${workflow.id}/${workflow.rev}`)
-        .set(defaultHeaders)
+        .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
 
diff --git a/packages/server/src/api/routes/user.js b/packages/server/src/api/routes/user.js
index 20e17c7473..3c560d3f80 100644
--- a/packages/server/src/api/routes/user.js
+++ b/packages/server/src/api/routes/user.js
@@ -6,19 +6,11 @@ const { USER_MANAGEMENT, LIST_USERS } = require("../../utilities/accessLevels")
 const router = Router()
 
 router
-  .get("/api/:instanceId/users", authorized(LIST_USERS), controller.fetch)
-  .get(
-    "/api/:instanceId/users/:username",
-    authorized(USER_MANAGEMENT),
-    controller.find
-  )
-  .post(
-    "/api/:instanceId/users",
-    authorized(USER_MANAGEMENT),
-    controller.create
-  )
+  .get("/api/users", authorized(LIST_USERS), controller.fetch)
+  .get("/api/users/:username", authorized(USER_MANAGEMENT), controller.find)
+  .post("/api/users", authorized(USER_MANAGEMENT), controller.create)
   .delete(
-    "/api/:instanceId/users/:username",
+    "/api/users/:username",
     authorized(USER_MANAGEMENT),
     controller.destroy
   )
diff --git a/packages/server/src/api/routes/view.js b/packages/server/src/api/routes/view.js
index 193ece1cdf..5a73eea22e 100644
--- a/packages/server/src/api/routes/view.js
+++ b/packages/server/src/api/routes/view.js
@@ -8,13 +8,13 @@ const router = Router()
 
 router
   .get(
-    "/api/:instanceId/views/:viewName",
+    "/api/views/:viewName",
     authorized(READ_VIEW, ctx => ctx.params.viewName),
     recordController.fetchView
   )
-  .get("/api/:instanceId/views", authorized(BUILDER), viewController.fetch)
+  .get("/api/views", authorized(BUILDER), viewController.fetch)
   // .patch("/api/:databaseId/views", controller.update);
   // .delete("/api/:instanceId/views/:viewId/:revId", controller.destroy);
-  .post("/api/:instanceId/views", authorized(BUILDER), viewController.create)
+  .post("/api/views", authorized(BUILDER), viewController.create)
 
 module.exports = router
diff --git a/packages/server/src/api/routes/workflow.js b/packages/server/src/api/routes/workflow.js
index fcb1d6e182..987e18a60f 100644
--- a/packages/server/src/api/routes/workflow.js
+++ b/packages/server/src/api/routes/workflow.js
@@ -6,20 +6,16 @@ const { BUILDER } = require("../../utilities/accessLevels")
 const router = Router()
 
 router
-  .get("/api/:instanceId/workflows", authorized(BUILDER), controller.fetch)
+  .get("/api/workflows", authorized(BUILDER), controller.fetch)
   .get("/api/workflows/:id", authorized(BUILDER), controller.find)
   .get(
-    "/api/:instanceId/workflows/:id/:action",
+    "/api/workflows/:id/:action",
     authorized(BUILDER),
     controller.fetchActionScript
   )
-  .put("/api/:instanceId/workflows", authorized(BUILDER), controller.update)
-  .post("/api/:instanceId/workflows", authorized(BUILDER), controller.create)
+  .put("/api/workflows", authorized(BUILDER), controller.update)
+  .post("/api/workflows", authorized(BUILDER), controller.create)
   .post("/api/workflows/action", controller.executeAction)
-  .delete(
-    "/api/:instanceId/workflows/:id/:rev",
-    authorized(BUILDER),
-    controller.destroy
-  )
+  .delete("/api/workflows/:id/:rev", authorized(BUILDER), controller.destroy)
 
 module.exports = router
diff --git a/packages/server/src/middleware/authenticated.js b/packages/server/src/middleware/authenticated.js
index d0ce1e2f30..0a3c9c8ef9 100644
--- a/packages/server/src/middleware/authenticated.js
+++ b/packages/server/src/middleware/authenticated.js
@@ -1,10 +1,11 @@
 const jwt = require("jsonwebtoken")
 const STATUS_CODES = require("../utilities/statusCodes")
-const env = require("../environment")
 const accessLevelController = require("../api/controllers/accesslevel")
 const {
   ADMIN_LEVEL_ID,
   POWERUSER_LEVEL_ID,
+  BUILDER_LEVEL_ID,
+  ANON_LEVEL_ID,
 } = require("../utilities/accessLevels")
 
 module.exports = async (ctx, next) => {
@@ -21,10 +22,19 @@ module.exports = async (ctx, next) => {
   const shouldAuthAsBuilder = isBuilderAgent && builderToken
 
   if (shouldAuthAsBuilder) {
-    const builderTokenValid = builderToken === env.ADMIN_SECRET
-
-    ctx.isAuthenticated = builderTokenValid
-    ctx.isBuilder = builderTokenValid
+    try {
+      const jwtPayload = jwt.verify(builderToken, ctx.config.jwtSecret)
+      ctx.isAuthenticated = jwtPayload.accessLevelId === BUILDER_LEVEL_ID
+      ctx.user = {
+        ...jwtPayload,
+        accessLevel: await getAccessLevel(
+          jwtPayload.instanceId,
+          jwtPayload.accessLevelId
+        ),
+      }
+    } catch (_) {
+      // empty: do nothing
+    }
 
     await next()
     return
@@ -46,7 +56,7 @@ module.exports = async (ctx, next) => {
         jwtPayload.accessLevelId
       ),
     }
-    ctx.isAuthenticated = true
+    ctx.isAuthenticated = ctx.user.accessLevelId !== ANON_LEVEL_ID
   } catch (err) {
     ctx.throw(err.status || STATUS_CODES.FORBIDDEN, err.text)
   }
@@ -57,7 +67,9 @@ module.exports = async (ctx, next) => {
 const getAccessLevel = async (instanceId, accessLevelId) => {
   if (
     accessLevelId === POWERUSER_LEVEL_ID ||
-    accessLevelId === ADMIN_LEVEL_ID
+    accessLevelId === ADMIN_LEVEL_ID ||
+    accessLevelId === BUILDER_LEVEL_ID ||
+    accessLevelId === ANON_LEVEL_ID
   ) {
     return {
       _id: accessLevelId,
diff --git a/packages/server/src/middleware/authorized.js b/packages/server/src/middleware/authorized.js
index b07715af36..b452d63cf5 100644
--- a/packages/server/src/middleware/authorized.js
+++ b/packages/server/src/middleware/authorized.js
@@ -2,6 +2,7 @@ const {
   adminPermissions,
   ADMIN_LEVEL_ID,
   POWERUSER_LEVEL_ID,
+  BUILDER_LEVEL_ID,
   BUILDER,
 } = require("../utilities/accessLevels")
 
@@ -10,7 +11,11 @@ module.exports = (permName, getItemId) => async (ctx, next) => {
     ctx.throw(403, "Session not authenticated")
   }
 
-  if (ctx.isBuilder) {
+  if (!ctx.user) {
+    ctx.throw(403, "User not found")
+  }
+
+  if (ctx.user.accessLevel._id === BUILDER_LEVEL_ID) {
     await next()
     return
   }
@@ -20,10 +25,6 @@ module.exports = (permName, getItemId) => async (ctx, next) => {
     return
   }
 
-  if (!ctx.user) {
-    ctx.throw(403, "User not found")
-  }
-
   const permissionId = ({ name, itemId }) => name + (itemId ? `-${itemId}` : "")
 
   if (ctx.user.accessLevel._id === ADMIN_LEVEL_ID) {
diff --git a/packages/server/src/utilities/accessLevels.js b/packages/server/src/utilities/accessLevels.js
index 9fff76e531..d609d6fa2c 100644
--- a/packages/server/src/utilities/accessLevels.js
+++ b/packages/server/src/utilities/accessLevels.js
@@ -5,6 +5,8 @@ const workflowController = require("../api/controllers/workflow")
 // Access Level IDs
 const ADMIN_LEVEL_ID = "ADMIN"
 const POWERUSER_LEVEL_ID = "POWER_USER"
+const BUILDER_LEVEL_ID = "BUILDER"
+const ANON_LEVEL_ID = "ANON"
 
 // Permissions
 const READ_MODEL = "read-model"
@@ -28,7 +30,7 @@ const generateAdminPermissions = async instanceId => [
 
 const generatePowerUserPermissions = async instanceId => {
   const fetchModelsCtx = {
-    params: {
+    user: {
       instanceId,
     },
   }
@@ -36,7 +38,7 @@ const generatePowerUserPermissions = async instanceId => {
   const models = fetchModelsCtx.body
 
   const fetchViewsCtx = {
-    params: {
+    user: {
       instanceId,
     },
   }
@@ -44,7 +46,7 @@ const generatePowerUserPermissions = async instanceId => {
   const views = fetchViewsCtx.body
 
   const fetchWorkflowsCtx = {
-    params: {
+    user: {
       instanceId,
     },
   }
@@ -83,6 +85,8 @@ const generatePowerUserPermissions = async instanceId => {
 module.exports = {
   ADMIN_LEVEL_ID,
   POWERUSER_LEVEL_ID,
+  BUILDER_LEVEL_ID,
+  ANON_LEVEL_ID,
   READ_MODEL,
   WRITE_MODEL,
   READ_VIEW,
diff --git a/packages/server/src/utilities/builder/setBuilderToken.js b/packages/server/src/utilities/builder/setBuilderToken.js
new file mode 100644
index 0000000000..12622d5522
--- /dev/null
+++ b/packages/server/src/utilities/builder/setBuilderToken.js
@@ -0,0 +1,19 @@
+const { BUILDER_LEVEL_ID } = require("../accessLevels")
+const jwt = require("jsonwebtoken")
+
+module.exports = (ctx, appId, instanceId) => {
+  const builderUser = {
+    userId: "BUILDER",
+    accessLevelId: BUILDER_LEVEL_ID,
+    instanceId,
+    appId,
+  }
+
+  const token = jwt.sign(builderUser, ctx.config.jwtSecret, {
+    expiresIn: "30 days",
+  })
+
+  var expiry = new Date()
+  expiry.setDate(expiry.getDate() + 30)
+  ctx.cookies.set("builder:token", token, { expires: expiry, httpOnly: false })
+}
diff --git a/packages/standard-components/src/DataChart.svelte b/packages/standard-components/src/DataChart.svelte
index 3f7aafd8a8..bccfc6314a 100644
--- a/packages/standard-components/src/DataChart.svelte
+++ b/packages/standard-components/src/DataChart.svelte
@@ -8,7 +8,6 @@
   fcRoot(FusionCharts, Charts, FusionTheme)
 
   export let _bb
-  export let _instanceId
   export let model
   export let type = "column2d"
 
@@ -25,7 +24,7 @@
   }
 
   async function fetchData() {
-    const FETCH_RECORDS_URL = `/api/${_instanceId}/views/all_${model}`
+    const FETCH_RECORDS_URL = `/api/views/all_${model}`
     const response = await _bb.api.get(FETCH_RECORDS_URL)
     if (response.status === 200) {
       const json = await response.json()
diff --git a/packages/standard-components/src/DataForm.svelte b/packages/standard-components/src/DataForm.svelte
index 6a9788458e..dc97c6971d 100644
--- a/packages/standard-components/src/DataForm.svelte
+++ b/packages/standard-components/src/DataForm.svelte
@@ -2,7 +2,6 @@
   import { onMount } from "svelte"
 
   export let _bb
-  export let _instanceId
   export let model
 
   let username
@@ -21,14 +20,14 @@
   $: fields = Object.keys(schema)
 
   async function fetchModel() {
-    const FETCH_MODEL_URL = `/api/${_instanceId}/models/${model}`
+    const FETCH_MODEL_URL = `/api/models/${model}`
     const response = await _bb.api.get(FETCH_MODEL_URL)
     modelDef = await response.json()
     schema = modelDef.schema
   }
 
   async function save() {
-    const SAVE_RECORD_URL = `/api/${_instanceId}/${model}/records`
+    const SAVE_RECORD_URL = `/api/${model}/records`
     const response = await _bb.api.post(SAVE_RECORD_URL, newModel)
     const json = await response.json()
 
diff --git a/packages/standard-components/src/DataList.svelte b/packages/standard-components/src/DataList.svelte
index 03bcd5ccc4..3f30558227 100644
--- a/packages/standard-components/src/DataList.svelte
+++ b/packages/standard-components/src/DataList.svelte
@@ -2,7 +2,6 @@
   import { onMount } from "svelte"
 
   export let _bb
-  export let _instanceId
   export let model
   export let layout = "list"
 
@@ -12,7 +11,7 @@
   async function fetchData() {
     if (!model || !model.length) return
 
-    const FETCH_RECORDS_URL = `/api/${_instanceId}/views/all_${model}`
+    const FETCH_RECORDS_URL = `/api/views/all_${model}`
     const response = await _bb.api.get(FETCH_RECORDS_URL)
     if (response.status === 200) {
       const json = await response.json()
diff --git a/packages/standard-components/src/DataTable.svelte b/packages/standard-components/src/DataTable.svelte
index 90716383da..188671b06a 100644
--- a/packages/standard-components/src/DataTable.svelte
+++ b/packages/standard-components/src/DataTable.svelte
@@ -3,14 +3,13 @@
 
   export let _bb
   export let onLoad
-  export let _instanceId
   export let model
 
   let headers = []
   let store = _bb.store
 
   async function fetchData() {
-    const FETCH_RECORDS_URL = `/api/${_instanceId}/views/all_${model}`
+    const FETCH_RECORDS_URL = `/api/views/all_${model}`
 
     const response = await _bb.api.get(FETCH_RECORDS_URL)
     if (response.status === 200) {
diff --git a/packages/standard-components/src/List.svelte b/packages/standard-components/src/List.svelte
index 7720094999..9e4ddd6c99 100644
--- a/packages/standard-components/src/List.svelte
+++ b/packages/standard-components/src/List.svelte
@@ -2,7 +2,6 @@
   import { onMount } from "svelte"
 
   export let _bb
-  export let _instanceId
   export let model
   export let layout = "list"
 
@@ -13,7 +12,7 @@
   async function fetchData() {
     if (!model || !model.length) return
 
-    const FETCH_RECORDS_URL = `/api/${_instanceId}/views/all_${model}`
+    const FETCH_RECORDS_URL = `/api/views/all_${model}`
     const response = await _bb.api.get(FETCH_RECORDS_URL)
     if (response.status === 200) {
       const json = await response.json()

From 2436ea525d94bca888d6ed67aa20fc8106382b74 Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Thu, 18 Jun 2020 20:41:37 +0100
Subject: [PATCH 09/15] fixing broken tests

---
 packages/server/src/api/routes/model.js       |  2 +-
 .../src/api/routes/tests/accesslevel.spec.js  | 24 +++++++++----------
 .../src/api/routes/tests/application.spec.js  |  2 +-
 .../src/api/routes/tests/couchTestUtils.js    | 14 +++++------
 .../server/src/api/routes/tests/model.spec.js | 17 +++++++------
 .../src/api/routes/tests/record.spec.js       |  2 +-
 .../server/src/api/routes/tests/user.spec.js  |  8 ++++---
 .../server/src/api/routes/tests/view.spec.js  |  4 ++--
 .../src/api/routes/tests/workflow.spec.js     | 17 +++++++------
 .../server/src/middleware/authenticated.js    |  2 ++
 10 files changed, 51 insertions(+), 41 deletions(-)

diff --git a/packages/server/src/api/routes/model.js b/packages/server/src/api/routes/model.js
index b5ab9b3f95..10882aa057 100644
--- a/packages/server/src/api/routes/model.js
+++ b/packages/server/src/api/routes/model.js
@@ -6,7 +6,7 @@ const { BUILDER, READ_MODEL } = require("../../utilities/accessLevels")
 const router = Router()
 
 router
-  .get("/api/models", modelController.fetch)
+  .get("/api/models", authorized(BUILDER), modelController.fetch)
   .get(
     "/api/models/:id",
     authorized(READ_MODEL, ctx => ctx.params.id),
diff --git a/packages/server/src/api/routes/tests/accesslevel.spec.js b/packages/server/src/api/routes/tests/accesslevel.spec.js
index 9cd3495ed8..81ab6a78ad 100644
--- a/packages/server/src/api/routes/tests/accesslevel.spec.js
+++ b/packages/server/src/api/routes/tests/accesslevel.spec.js
@@ -44,7 +44,7 @@ describe("/accesslevels", () => {
 
     it("returns a success message when level is successfully created", async () => {
       const res = await request
-        .post(`/api/${instanceId}/accesslevels`)
+        .post(`/api/accesslevels`)
         .send({ name: "user" })
         .set(defaultHeaders(appId, instanceId))
         .expect('Content-Type', /json/)
@@ -62,7 +62,7 @@ describe("/accesslevels", () => {
 
     it("should list custom levels, plus 2 default levels", async () => {
       const createRes = await request
-        .post(`/api/${instanceId}/accesslevels`)
+        .post(`/api/accesslevels`)
         .send({ name: "user", permissions: [ { itemId: model._id, name: READ_MODEL }] })
         .set(defaultHeaders(appId, instanceId))
         .expect('Content-Type', /json/)
@@ -71,7 +71,7 @@ describe("/accesslevels", () => {
       const customLevel = createRes.body
 
       const res = await request
-        .get(`/api/${instanceId}/accesslevels`)
+        .get(`/api/accesslevels`)
         .set(defaultHeaders(appId, instanceId))
         .expect('Content-Type', /json/)
         .expect(200)
@@ -95,7 +95,7 @@ describe("/accesslevels", () => {
   describe("destroy", () => {
     it("should delete custom access level", async () => {
       const createRes = await request
-        .post(`/api/${instanceId}/accesslevels`)
+        .post(`/api/accesslevels`)
         .send({ name: "user", permissions: [ { itemId: model._id, name: READ_MODEL } ] })
         .set(defaultHeaders(appId, instanceId))
         .expect('Content-Type', /json/)
@@ -104,12 +104,12 @@ describe("/accesslevels", () => {
       const customLevel = createRes.body
 
       await request
-        .delete(`/api/${instanceId}/accesslevels/${customLevel._id}/${customLevel._rev}`)
+        .delete(`/api/accesslevels/${customLevel._id}/${customLevel._rev}`)
         .set(defaultHeaders(appId, instanceId))
         .expect(200)
 
       await request
-        .get(`/api/${instanceId}/accesslevels/${customLevel._id}`)
+        .get(`/api/accesslevels/${customLevel._id}`)
         .set(defaultHeaders(appId, instanceId))
         .expect(404)      
     })
@@ -118,7 +118,7 @@ describe("/accesslevels", () => {
   describe("patch", () => {
     it("should add given permissions", async () => {
       const createRes = await request
-        .post(`/api/${instanceId}/accesslevels`)
+        .post(`/api/accesslevels`)
         .send({ name: "user", permissions: [ { itemId: model._id, name: READ_MODEL }] })
         .set(defaultHeaders(appId, instanceId))
         .expect('Content-Type', /json/)
@@ -127,7 +127,7 @@ describe("/accesslevels", () => {
       const customLevel = createRes.body
 
       await request
-        .patch(`/api/${instanceId}/accesslevels/${customLevel._id}`)
+        .patch(`/api/accesslevels/${customLevel._id}`)
         .send({
           _rev: customLevel._rev,
           addedPermissions:  [ { itemId: model._id, name: WRITE_MODEL } ] 
@@ -137,7 +137,7 @@ describe("/accesslevels", () => {
         .expect(200)
 
       const finalRes = await request
-        .get(`/api/${instanceId}/accesslevels/${customLevel._id}`)
+        .get(`/api/accesslevels/${customLevel._id}`)
         .set(defaultHeaders(appId, instanceId))
         .expect(200) 
 
@@ -148,7 +148,7 @@ describe("/accesslevels", () => {
 
     it("should remove given permissions", async () => {
       const createRes = await request
-        .post(`/api/${instanceId}/accesslevels`)
+        .post(`/api/accesslevels`)
         .send({ 
           name: "user", 
           permissions: [ 
@@ -163,7 +163,7 @@ describe("/accesslevels", () => {
       const customLevel = createRes.body
 
       await request
-        .patch(`/api/${instanceId}/accesslevels/${customLevel._id}`)
+        .patch(`/api/accesslevels/${customLevel._id}`)
         .send({
           _rev: customLevel._rev,
           removedPermissions:  [ { itemId: model._id, name: WRITE_MODEL }] 
@@ -173,7 +173,7 @@ describe("/accesslevels", () => {
         .expect(200)
 
       const finalRes = await request
-        .get(`/api/${instanceId}/accesslevels/${customLevel._id}`)
+        .get(`/api/accesslevels/${customLevel._id}`)
         .set(defaultHeaders(appId, instanceId))
         .expect(200) 
 
diff --git a/packages/server/src/api/routes/tests/application.spec.js b/packages/server/src/api/routes/tests/application.spec.js
index 0bde24a02f..d22ab02016 100644
--- a/packages/server/src/api/routes/tests/application.spec.js
+++ b/packages/server/src/api/routes/tests/application.spec.js
@@ -41,7 +41,7 @@ describe("/applications", () => {
       expect(res.body._id).toBeDefined()
     })
 
-    fit("should apply authorization to endpoint", async () => {
+    it("should apply authorization to endpoint", async () => {
       const otherApplication = await createApplication(request) 
       const instance = await createInstance(request, otherApplication._id)
       await builderEndpointShouldBlockNormalUsers({
diff --git a/packages/server/src/api/routes/tests/couchTestUtils.js b/packages/server/src/api/routes/tests/couchTestUtils.js
index ebf09e392d..9b8aedd453 100644
--- a/packages/server/src/api/routes/tests/couchTestUtils.js
+++ b/packages/server/src/api/routes/tests/couchTestUtils.js
@@ -57,7 +57,7 @@ exports.createModel = async (request, appId, instanceId, model) => {
   }
 
   const res = await request
-    .post(`/api/${instanceId}/models`)
+    .post(`/api/models`)
     .set(exports.defaultHeaders(appId, instanceId))
     .send(model)
   return res.body
@@ -69,7 +69,7 @@ exports.createView = async (request, appId, instanceId, view) => {
   }
 
   const res = await request
-    .post(`/api/${instanceId}/views`)
+    .post(`/api/views`)
     .set(exports.defaultHeaders(appId, instanceId))
     .send(view)
   return res.body
@@ -80,10 +80,10 @@ exports.createClientDatabase = async id => await create(id || TEST_CLIENT_ID)
 exports.createApplication = async (request, name = "test_application") => {
   const res = await request
     .post("/api/applications")
-    .set(exports.defaultHeaders())
     .send({
       name,
     })
+    .set(exports.defaultHeaders())
   return res.body
 }
 
@@ -92,10 +92,10 @@ exports.destroyClientDatabase = async () => await destroy(TEST_CLIENT_ID)
 exports.createInstance = async (request, appId) => {
   const res = await request
     .post(`/api/instances`)
-    .set(exports.defaultHeaders(appId))
     .send({
-      name: "test-instance",
+      name: "test-instance2",
     })
+    .set(exports.defaultHeaders(appId))
   return res.body
 }
 
@@ -180,13 +180,13 @@ const createUserWithPermissions = async (
   username
 ) => {
   const accessRes = await request
-    .post(`/api/${instanceId}/accesslevels`)
+    .post(`/api/accesslevels`)
     .send({ name: "TestLevel", permissions })
     .set(exports.defaultHeaders(appId, instanceId))
 
   const password = `password_${username}`
   await request
-    .post(`/api/${instanceId}/users`)
+    .post(`/api/users`)
     .set(exports.defaultHeaders(appId, instanceId))
     .send({
       name: username,
diff --git a/packages/server/src/api/routes/tests/model.spec.js b/packages/server/src/api/routes/tests/model.spec.js
index f4708be58d..4d4e7aeb08 100644
--- a/packages/server/src/api/routes/tests/model.spec.js
+++ b/packages/server/src/api/routes/tests/model.spec.js
@@ -33,7 +33,7 @@ describe("/models", () => {
 
     it("returns a success message when the model is successfully created", done => {
       request
-        .post(`/api/${instance._id}/models`)
+        .post(`/api/models`)
         .send({ 
           name: "TestModel",
           key: "name",
@@ -55,8 +55,9 @@ describe("/models", () => {
         await builderEndpointShouldBlockNormalUsers({
           request,
           method: "POST",
-          url: `/api/${instance._id}/models`,
+          url: `/api/models`,
           instanceId: instance._id,
+          appId: app._id,
           body: { 
             name: "TestModel",
             key: "name",
@@ -78,7 +79,7 @@ describe("/models", () => {
 
     it("returns all the models for that instance in the response body", done => {
       request
-        .get(`/api/${instance._id}/models`)
+        .get(`/api/models`)
         .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
@@ -94,8 +95,9 @@ describe("/models", () => {
         await builderEndpointShouldBlockNormalUsers({
           request,
           method: "GET",
-          url: `/api/${instance._id}/models`,
+          url: `/api/models`,
           instanceId: instance._id,
+          appId: app._id,
         })
       })
     });
@@ -114,7 +116,7 @@ describe("/models", () => {
 
     it("returns a success response when a model is deleted.", async done => {
       request
-        .delete(`/api/${instance._id}/models/${testModel._id}/${testModel._rev}`)
+        .delete(`/api/models/${testModel._id}/${testModel._rev}`)
         .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
@@ -147,7 +149,7 @@ describe("/models", () => {
       })
 
       request
-        .delete(`/api/${instance._id}/models/${testModel._id}/${testModel._rev}`)
+        .delete(`/api/models/${testModel._id}/${testModel._rev}`)
         .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
@@ -163,8 +165,9 @@ describe("/models", () => {
       await builderEndpointShouldBlockNormalUsers({
         request,
         method: "DELETE",
-        url: `/api/${instance._id}/models/${testModel._id}/${testModel._rev}`,
+        url: `/api/models/${testModel._id}/${testModel._rev}`,
         instanceId: instance._id,
+        appId: app._id,
       })
     })
 
diff --git a/packages/server/src/api/routes/tests/record.spec.js b/packages/server/src/api/routes/tests/record.spec.js
index c856cfc47a..62cf205b1c 100644
--- a/packages/server/src/api/routes/tests/record.spec.js
+++ b/packages/server/src/api/routes/tests/record.spec.js
@@ -45,7 +45,7 @@ describe("/records", () => {
         .expect('Content-Type', /json/)
         .expect(200)
 
-    fit("returns a success message when the record is created", async () => {
+    it("returns a success message when the record is created", async () => {
       const res = await createRecord()
       expect(res.res.statusMessage).toEqual(`${model.name} created successfully`)           
       expect(res.body.name).toEqual("Test Contact")
diff --git a/packages/server/src/api/routes/tests/user.spec.js b/packages/server/src/api/routes/tests/user.spec.js
index 4900946e45..a17e6fe275 100644
--- a/packages/server/src/api/routes/tests/user.spec.js
+++ b/packages/server/src/api/routes/tests/user.spec.js
@@ -54,8 +54,9 @@ describe("/users", () => {
       await testPermissionsForEndpoint({
         request,
         method: "GET",
-        url: `/api/${instance._id}/users`,
+        url: `/api/users`,
         instanceId: instance._id,
+        appId: app._id,
         permissionName: LIST_USERS,
       })
     })
@@ -66,7 +67,7 @@ describe("/users", () => {
 
     it("returns a success message when a user is successfully created", async () => {
       const res = await request
-        .post(`/api/${instance._id}/users`)
+        .post(`/api/users`)
         .set(defaultHeaders(app._id, instance._id))
         .send({ name: "Bill", username: "bill", password: "bills_password", accessLevelId: POWERUSER_LEVEL_ID })
         .expect(200)
@@ -81,8 +82,9 @@ describe("/users", () => {
         request,
         method: "POST",
         body: { name: "brandNewUser", username: "brandNewUser", password: "yeeooo", accessLevelId: POWERUSER_LEVEL_ID },
-        url: `/api/${instance._id}/users`,
+        url: `/api/users`,
         instanceId: instance._id,
+        appId: app._id,
         permissionName: USER_MANAGEMENT,
       })
     })
diff --git a/packages/server/src/api/routes/tests/view.spec.js b/packages/server/src/api/routes/tests/view.spec.js
index db521ef53b..5a889bed67 100644
--- a/packages/server/src/api/routes/tests/view.spec.js
+++ b/packages/server/src/api/routes/tests/view.spec.js
@@ -30,7 +30,7 @@ describe("/views", () => {
 
   const createView = async () => 
     await request
-    .post(`/api/${instance._id}/views`)
+    .post(`/api/views`)
     .send({ 
       name: "TestView",
       map: `function(doc) {
@@ -62,7 +62,7 @@ describe("/views", () => {
     it("should only return custom views", async () => {
       const view = await createView()
       const res = await request
-        .get(`/api/${instance._id}/views`)
+        .get(`/api/views`)
         .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
diff --git a/packages/server/src/api/routes/tests/workflow.spec.js b/packages/server/src/api/routes/tests/workflow.spec.js
index bcd1f67120..f8b38c53ec 100644
--- a/packages/server/src/api/routes/tests/workflow.spec.js
+++ b/packages/server/src/api/routes/tests/workflow.spec.js
@@ -63,7 +63,7 @@ describe("/workflows", () => {
   describe("create", () => {
     it("returns a success message when the workflow is successfully created", async () => {
       const res = await request
-        .post(`/api/${instance._id}/workflows`)
+        .post(`/api/workflows`)
         .set(defaultHeaders(app._id, instance._id))
         .send(TEST_WORKFLOW)
         .expect('Content-Type', /json/)
@@ -77,8 +77,9 @@ describe("/workflows", () => {
       await builderEndpointShouldBlockNormalUsers({
         request,
         method: "POST",
-        url: `/api/${instance._id}/workflows`,
+        url: `/api/workflows`,
         instanceId: instance._id,
+        appId: app._id,
         body: TEST_WORKFLOW
       })
     })
@@ -92,7 +93,7 @@ describe("/workflows", () => {
       workflow.name = "Updated Name";
 
       const res = await request
-        .put(`/api/${instance._id}/workflows`)
+        .put(`/api/workflows`)
         .set(defaultHeaders(app._id, instance._id))
         .send(workflow)
         .expect('Content-Type', /json/)
@@ -107,7 +108,7 @@ describe("/workflows", () => {
     it("return all the workflows for an instance", async () => {
       await createWorkflow();
       const res = await request
-        .get(`/api/${instance._id}/workflows`)
+        .get(`/api/workflows`)
         .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
@@ -119,8 +120,9 @@ describe("/workflows", () => {
       await builderEndpointShouldBlockNormalUsers({
         request,
         method: "GET",
-        url: `/api/${instance._id}/workflows`,
+        url: `/api/workflows`,
         instanceId: instance._id,
+        appId: app._id,
       })
     })
   })
@@ -129,7 +131,7 @@ describe("/workflows", () => {
     it("deletes a workflow by its ID", async () => {
       await createWorkflow();
       const res = await request
-        .delete(`/api/${instance._id}/workflows/${workflow.id}/${workflow.rev}`)
+        .delete(`/api/workflows/${workflow.id}/${workflow.rev}`)
         .set(defaultHeaders(app._id, instance._id))
         .expect('Content-Type', /json/)
         .expect(200)
@@ -142,8 +144,9 @@ describe("/workflows", () => {
       await builderEndpointShouldBlockNormalUsers({
         request,
         method: "DELETE",
-        url: `/api/${instance._id}/workflows/${workflow.id}/${workflow._rev}`,
+        url: `/api/workflows/${workflow.id}/${workflow._rev}`,
         instanceId: instance._id,
+        appId: app._id,
       })
     })
   })
diff --git a/packages/server/src/middleware/authenticated.js b/packages/server/src/middleware/authenticated.js
index 0a3c9c8ef9..2318512eea 100644
--- a/packages/server/src/middleware/authenticated.js
+++ b/packages/server/src/middleware/authenticated.js
@@ -81,6 +81,8 @@ const getAccessLevel = async (instanceId, accessLevelId) => {
   const findAccessContext = {
     params: {
       levelId: accessLevelId,
+    },
+    user: {
       instanceId,
     },
   }

From bd927564b28f9484d249a53c66314b4e2178b350 Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Fri, 19 Jun 2020 07:04:55 +0100
Subject: [PATCH 10/15] client - should recognise new cookie format

---
 packages/client/src/render/getAppId.js      | 4 +++-
 packages/client/tests/screenRouting.spec.js | 6 +++---
 packages/client/tests/testAppDef.js         | 2 +-
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/packages/client/src/render/getAppId.js b/packages/client/src/render/getAppId.js
index 75753e381d..8ac2dbc79b 100644
--- a/packages/client/src/render/getAppId.js
+++ b/packages/client/src/render/getAppId.js
@@ -2,8 +2,10 @@ export const getAppId = cookie => {
   const base64Token = cookie
     .split(";")
     .find(c => c.trim().startsWith("budibase:token"))
-    .split("=")[1]
+    .substring(lengthOfKey)
 
   const user = JSON.parse(atob(base64Token.split(".")[1]))
   return user.appId
 }
+
+const lengthOfKey = "budibase:token=".length
diff --git a/packages/client/tests/screenRouting.spec.js b/packages/client/tests/screenRouting.spec.js
index d0b2c1b4d5..3e4818961d 100644
--- a/packages/client/tests/screenRouting.spec.js
+++ b/packages/client/tests/screenRouting.spec.js
@@ -18,7 +18,7 @@ describe("screenRouting", () => {
 
   it("should load correct screen, for initial URL, when appRootPath is something", async () => {
     const { page, screens } = pageWith3Screens()
-    const { dom } = await load(page, screens, "/TEST_APP_ID/screen2", "localhost")
+    const { dom } = await load(page, screens, "/TEST_APP_ID/screen2", "127.0.0.1")
 
     const rootDiv = dom.window.document.body.children[0]
     expect(rootDiv.children.length).toBe(1)
@@ -50,8 +50,8 @@ describe("screenRouting", () => {
     const { dom, app } = await load(
       page,
       screens,
-      "/testApp/screen2",
-      "/testApp"
+      "/TEST_APP_ID/screen2",
+      "127.0.0.1"
     )
 
     app.routeTo()("/screen3")
diff --git a/packages/client/tests/testAppDef.js b/packages/client/tests/testAppDef.js
index bafba601e9..76bb3784b0 100644
--- a/packages/client/tests/testAppDef.js
+++ b/packages/client/tests/testAppDef.js
@@ -7,7 +7,7 @@ export const load = async (page, screens, url, host = "test.com") => {
 
   const fullUrl = `http://${host}${url}`
   const cookieJar = new jsdom.CookieJar()
-  const cookie = btoa('{}{"appId":"TEST_APP_ID"}signature')
+  const cookie = `${btoa("{}")}.${btoa('{"appId":"TEST_APP_ID"}')}.signature`
   cookieJar.setCookie(
     `budibase:token=${cookie};domain=${host};path=/`,
     fullUrl,

From eb2b6ec56f1491231454a70046ece06334496017 Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Fri, 19 Jun 2020 16:59:46 +0100
Subject: [PATCH 11/15] removed x-user-agent

---
 packages/client/src/render/getAppId.js          | 11 ++++++-----
 packages/client/src/render/screenRouter.js      |  2 +-
 packages/client/src/state/bbComponentApi.js     |  6 +++---
 packages/server/src/api/controllers/auth.js     |  9 +++++++--
 packages/server/src/api/controllers/static.js   |  8 ++++++--
 packages/server/src/middleware/authenticated.js |  6 +-----
 packages/server/src/utilities/accessLevels.js   |  1 +
 7 files changed, 25 insertions(+), 18 deletions(-)

diff --git a/packages/client/src/render/getAppId.js b/packages/client/src/render/getAppId.js
index 8ac2dbc79b..6d3df8eac2 100644
--- a/packages/client/src/render/getAppId.js
+++ b/packages/client/src/render/getAppId.js
@@ -1,8 +1,9 @@
-export const getAppId = cookie => {
-  const base64Token = cookie
-    .split(";")
-    .find(c => c.trim().startsWith("budibase:token"))
-    .substring(lengthOfKey)
+export const getAppId = docCookie => {
+  const cookie =
+    docCookie.split(";").find(c => c.trim().startsWith("budibase:token")) ||
+    docCookie.split(";").find(c => c.trim().startsWith("builder:token"))
+
+  const base64Token = cookie.substring(lengthOfKey)
 
   const user = JSON.parse(atob(base64Token.split(".")[1]))
   return user.appId
diff --git a/packages/client/src/render/screenRouter.js b/packages/client/src/render/screenRouter.js
index ae11c10949..fb0b005096 100644
--- a/packages/client/src/render/screenRouter.js
+++ b/packages/client/src/render/screenRouter.js
@@ -79,7 +79,7 @@ export const screenRouter = ({ screens, onScreenSelected, window }) => {
     )
       return
 
-    const target = x.target || "_self"
+    const target = (x && x.target) || "_self"
     if (!y || target !== "_self" || x.host !== location.host) return
 
     e.preventDefault()
diff --git a/packages/client/src/state/bbComponentApi.js b/packages/client/src/state/bbComponentApi.js
index b022ddca27..112e3e8534 100644
--- a/packages/client/src/state/bbComponentApi.js
+++ b/packages/client/src/state/bbComponentApi.js
@@ -9,16 +9,16 @@ export const bbFactory = ({
   componentLibraries,
   onScreenSlotRendered,
 }) => {
-  const apiCall = method => (url, body) =>
-    fetch(url, {
+  const apiCall = method => (url, body) => {
+    return fetch(url, {
       method: method,
       headers: {
         "Content-Type": "application/json",
-        "x-user-agent": "Budibase Builder",
       },
       body: body && JSON.stringify(body),
       credentials: "same-origin",
     })
+  }
 
   const api = {
     post: apiCall("POST"),
diff --git a/packages/server/src/api/controllers/auth.js b/packages/server/src/api/controllers/auth.js
index 88eb86c472..e9570e270f 100644
--- a/packages/server/src/api/controllers/auth.js
+++ b/packages/server/src/api/controllers/auth.js
@@ -55,9 +55,14 @@ exports.authenticate = async ctx => {
       expiresIn: "1 day",
     })
 
-    const ONE_DAY_FROM_NOW = new Date(Date.now() + 24 * 3600)
+    const expires = new Date()
+    expires.setDate(expires.getDate() + 1)
 
-    ctx.cookies.set("budibase:token", token, { expires: ONE_DAY_FROM_NOW })
+    ctx.cookies.set("budibase:token", token, {
+      expires,
+      path: "/",
+      httpOnly: false,
+    })
 
     ctx.body = {
       token,
diff --git a/packages/server/src/api/controllers/static.js b/packages/server/src/api/controllers/static.js
index 181af162c5..2f0ea8f4b0 100644
--- a/packages/server/src/api/controllers/static.js
+++ b/packages/server/src/api/controllers/static.js
@@ -6,10 +6,13 @@ const {
 } = require("../../utilities/budibaseDir")
 const setBuilderToken = require("../../utilities/builder/setBuilderToken")
 const { ANON_LEVEL_ID } = require("../../utilities/accessLevels")
+const jwt = require("jsonwebtoken")
 
 exports.serveBuilder = async function(ctx) {
   let builderPath = resolve(__dirname, "../../../builder")
-  setBuilderToken(ctx)
+  if (ctx.file === "index.html") {
+    setBuilderToken(ctx)
+  }
   await send(ctx, ctx.file, { root: ctx.devPath || builderPath })
 }
 
@@ -24,11 +27,12 @@ exports.serveApp = async function(ctx) {
   // only set the appId cookie for /appId .. we COULD check for valid appIds
   // but would like to avoid that DB hit
   if (looksLikeAppId(ctx.params.appId) && !ctx.isAuthenticated) {
-    const anonToken = {
+    const anonUser = {
       userId: "ANON",
       accessLevelId: ANON_LEVEL_ID,
       appId: ctx.params.appId,
     }
+    const anonToken = jwt.sign(anonUser, ctx.config.jwtSecret)
     ctx.cookies.set("budibase:token", anonToken, {
       path: "/",
       httpOnly: false,
diff --git a/packages/server/src/middleware/authenticated.js b/packages/server/src/middleware/authenticated.js
index 2318512eea..36e2776abe 100644
--- a/packages/server/src/middleware/authenticated.js
+++ b/packages/server/src/middleware/authenticated.js
@@ -16,12 +16,8 @@ module.exports = async (ctx, next) => {
 
   const appToken = ctx.cookies.get("budibase:token")
   const builderToken = ctx.cookies.get("builder:token")
-  const isBuilderAgent = ctx.headers["x-user-agent"] === "Budibase Builder"
 
-  // all admin api access should auth with buildertoken and 'Budibase Builder user agent
-  const shouldAuthAsBuilder = isBuilderAgent && builderToken
-
-  if (shouldAuthAsBuilder) {
+  if (builderToken) {
     try {
       const jwtPayload = jwt.verify(builderToken, ctx.config.jwtSecret)
       ctx.isAuthenticated = jwtPayload.accessLevelId === BUILDER_LEVEL_ID
diff --git a/packages/server/src/utilities/accessLevels.js b/packages/server/src/utilities/accessLevels.js
index d609d6fa2c..50ae559d07 100644
--- a/packages/server/src/utilities/accessLevels.js
+++ b/packages/server/src/utilities/accessLevels.js
@@ -94,6 +94,7 @@ module.exports = {
   USER_MANAGEMENT,
   BUILDER,
   LIST_USERS,
+  adminPermissions,
   generateAdminPermissions,
   generatePowerUserPermissions,
 }

From 4ba1329983412fc070ccc842a606fb2cd68ea12e Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Fri, 19 Jun 2020 17:19:30 +0100
Subject: [PATCH 12/15] instance Id is gone from API module

---
 packages/builder/src/builderStore/api.js      | 30 +++++--------------
 .../builder/src/builderStore/store/backend.js |  4 +--
 .../src/builderStore/store/workflow/index.js  | 16 +++++-----
 .../ModelDataTable/ModelDataTable.svelte      |  4 +--
 .../components/database/ModelDataTable/api.js | 16 +++++-----
 .../CreateEditModel/CreateEditModel.svelte    |  3 +-
 .../modals/CreateEditRecord.svelte            |  3 --
 .../modals/CreateEditView.svelte              |  2 +-
 .../ModelDataTable/modals/CreateUser.svelte   |  3 +-
 .../ModelDataTable/modals/DeleteRecord.svelte |  3 +-
 .../nav/SchemaManagementDrawer.svelte         |  2 +-
 .../src/components/nav/UsersList.svelte       |  3 +-
 .../src/api/routes/tests/couchTestUtils.js    |  1 -
 13 files changed, 33 insertions(+), 57 deletions(-)

diff --git a/packages/builder/src/builderStore/api.js b/packages/builder/src/builderStore/api.js
index 795aaf8cd7..116222409f 100644
--- a/packages/builder/src/builderStore/api.js
+++ b/packages/builder/src/builderStore/api.js
@@ -1,10 +1,6 @@
-const apiCall = (method, instanceId) => async (url, body) => {
+const apiCall = method => async (url, body) => {
   const headers = {
     "Content-Type": "application/json",
-    "x-user-agent": "Budibase Builder",
-  }
-  if (instanceId) {
-    headers["x-budibase-instanceid"] = instanceId
   }
   const response = await fetch(url, {
     method: method,
@@ -21,20 +17,10 @@ export const patch = apiCall("PATCH")
 export const del = apiCall("DELETE")
 export const put = apiCall("PUT")
 
-// usage: api(instanceId).post(...) ... will supply instance Id in header
-const api = instanceId => ({
-  post: apiCall("POST", instanceId),
-  get: apiCall("GET", instanceId),
-  patch: apiCall("PATCH", instanceId),
-  delete: apiCall("DELETE", instanceId),
-  put: apiCall("PUT", instanceId),
-})
-
-// usage: api.post(...)... will not supply instanceid in header
-api.post = apiCall("POST")
-api.get = apiCall("GET")
-api.patch = apiCall("PATCH")
-api.delete = apiCall("DELETE")
-api.put = apiCall("PUT")
-
-export default api
+export default {
+  post: apiCall("POST"),
+  get: apiCall("GET"),
+  patch: apiCall("PATCH"),
+  delete: apiCall("DELETE"),
+  put: apiCall("PUT"),
+}
diff --git a/packages/builder/src/builderStore/store/backend.js b/packages/builder/src/builderStore/store/backend.js
index 6efb980506..53bdaa3360 100644
--- a/packages/builder/src/builderStore/store/backend.js
+++ b/packages/builder/src/builderStore/store/backend.js
@@ -24,8 +24,8 @@ export const getBackendUiStore = () => {
   store.actions = {
     database: {
       select: async db => {
-        const modelsResponse = await api(db._id).get(`/api/models`)
-        const viewsResponse = await api(db._id).get(`/api/views`)
+        const modelsResponse = await api.get(`/api/models`)
+        const viewsResponse = await api.get(`/api/views`)
         const models = await modelsResponse.json()
         const views = await viewsResponse.json()
         store.update(state => {
diff --git a/packages/builder/src/builderStore/store/workflow/index.js b/packages/builder/src/builderStore/store/workflow/index.js
index 7c814c27ee..d794868df3 100644
--- a/packages/builder/src/builderStore/store/workflow/index.js
+++ b/packages/builder/src/builderStore/store/workflow/index.js
@@ -12,7 +12,7 @@ const workflowActions = store => ({
       return state
     })
   },
-  create: async ({ instanceId, name }) => {
+  create: async ({ name }) => {
     const workflow = {
       name,
       definition: {
@@ -20,7 +20,7 @@ const workflowActions = store => ({
       },
     }
     const CREATE_WORKFLOW_URL = `/api/workflows`
-    const response = await api(instanceId).post(CREATE_WORKFLOW_URL, workflow)
+    const response = await api.post(CREATE_WORKFLOW_URL, workflow)
     const json = await response.json()
     store.update(state => {
       state.workflows = state.workflows.concat(json.workflow)
@@ -28,9 +28,9 @@ const workflowActions = store => ({
       return state
     })
   },
-  save: async ({ instanceId, workflow }) => {
+  save: async ({ workflow }) => {
     const UPDATE_WORKFLOW_URL = `/api/workflows`
-    const response = await api(instanceId).put(UPDATE_WORKFLOW_URL, workflow)
+    const response = await api.put(UPDATE_WORKFLOW_URL, workflow)
     const json = await response.json()
     store.update(state => {
       const existingIdx = state.workflows.findIndex(
@@ -42,9 +42,9 @@ const workflowActions = store => ({
       return state
     })
   },
-  update: async ({ instanceId, workflow }) => {
+  update: async ({ workflow }) => {
     const UPDATE_WORKFLOW_URL = `/api/workflows`
-    const response = await api(instanceId).put(UPDATE_WORKFLOW_URL, workflow)
+    const response = await api.put(UPDATE_WORKFLOW_URL, workflow)
     const json = await response.json()
     store.update(state => {
       const existingIdx = state.workflows.findIndex(
@@ -55,10 +55,10 @@ const workflowActions = store => ({
       return state
     })
   },
-  delete: async ({ instanceId, workflow }) => {
+  delete: async ({ workflow }) => {
     const { _id, _rev } = workflow
     const DELETE_WORKFLOW_URL = `/api/workflows/${_id}/${_rev}`
-    await api(instanceId).delete(DELETE_WORKFLOW_URL)
+    await api.delete(DELETE_WORKFLOW_URL)
 
     store.update(state => {
       const existingIdx = state.workflows.findIndex(
diff --git a/packages/builder/src/components/database/ModelDataTable/ModelDataTable.svelte b/packages/builder/src/components/database/ModelDataTable/ModelDataTable.svelte
index f1d49894a0..8eb6defa8f 100644
--- a/packages/builder/src/components/database/ModelDataTable/ModelDataTable.svelte
+++ b/packages/builder/src/components/database/ModelDataTable/ModelDataTable.svelte
@@ -53,12 +53,10 @@
   let views = []
   let currentPage = 0
 
-  $: instanceId = $backendUiStore.selectedDatabase._id
-
   $: {
     if ($backendUiStore.selectedView) {
       api
-        .fetchDataForView($backendUiStore.selectedView, instanceId)
+        .fetchDataForView($backendUiStore.selectedView)
         .then(records => {
           data = records || []
           headers = Object.keys($backendUiStore.selectedModel.schema).filter(
diff --git a/packages/builder/src/components/database/ModelDataTable/api.js b/packages/builder/src/components/database/ModelDataTable/api.js
index 9fb6651983..f50290b091 100644
--- a/packages/builder/src/components/database/ModelDataTable/api.js
+++ b/packages/builder/src/components/database/ModelDataTable/api.js
@@ -1,8 +1,8 @@
 import api from "builderStore/api"
 
-export async function createUser(user, instanceId) {
+export async function createUser(user) {
   const CREATE_USER_URL = `/api/users`
-  const response = await api(instanceId).post(CREATE_USER_URL, user)
+  const response = await api.post(CREATE_USER_URL, user)
   return await response.json()
 }
 
@@ -14,22 +14,22 @@ export async function createDatabase(appname, instanceName) {
   return await response.json()
 }
 
-export async function deleteRecord(record, instanceId) {
+export async function deleteRecord(record) {
   const DELETE_RECORDS_URL = `/api/${record._modelId}/records/${record._id}/${record._rev}`
-  const response = await api(instanceId).delete(DELETE_RECORDS_URL)
+  const response = await api.delete(DELETE_RECORDS_URL)
   return response
 }
 
-export async function saveRecord(record, instanceId, modelId) {
+export async function saveRecord(record, modelId) {
   const SAVE_RECORDS_URL = `/api/${modelId}/records`
-  const response = await api(instanceId).post(SAVE_RECORDS_URL, record)
+  const response = await api.post(SAVE_RECORDS_URL, record)
 
   return await response.json()
 }
 
-export async function fetchDataForView(viewName, instanceId) {
+export async function fetchDataForView(viewName) {
   const FETCH_RECORDS_URL = `/api/views/${viewName}`
 
-  const response = await api(instanceId).get(FETCH_RECORDS_URL)
+  const response = await api.get(FETCH_RECORDS_URL)
   return await response.json()
 }
diff --git a/packages/builder/src/components/database/ModelDataTable/modals/CreateEditModel/CreateEditModel.svelte b/packages/builder/src/components/database/ModelDataTable/modals/CreateEditModel/CreateEditModel.svelte
index 6fb6cc8a2f..9e80ec4ca1 100644
--- a/packages/builder/src/components/database/ModelDataTable/modals/CreateEditModel/CreateEditModel.svelte
+++ b/packages/builder/src/components/database/ModelDataTable/modals/CreateEditModel/CreateEditModel.svelte
@@ -18,7 +18,6 @@
   let fieldToEdit
 
   $: modelFields = model.schema ? Object.entries(model.schema) : []
-  $: instanceId = $backendUiStore.selectedDatabase._id
 
   function editField() {}
 
@@ -28,7 +27,7 @@
 
   async function saveModel() {
     const SAVE_MODEL_URL = `/api/models`
-    const response = await api(instanceId).post(SAVE_MODEL_URL, model)
+    const response = await api.post(SAVE_MODEL_URL, model)
     const newModel = await response.json()
     backendUiStore.actions.models.create(newModel)
     onClosed()
diff --git a/packages/builder/src/components/database/ModelDataTable/modals/CreateEditRecord.svelte b/packages/builder/src/components/database/ModelDataTable/modals/CreateEditRecord.svelte
index 62688d58e3..a97cdc0ca1 100644
--- a/packages/builder/src/components/database/ModelDataTable/modals/CreateEditRecord.svelte
+++ b/packages/builder/src/components/database/ModelDataTable/modals/CreateEditRecord.svelte
@@ -14,8 +14,6 @@
   let errors = []
   let selectedModel
 
-  $: instanceId = $backendUiStore.selectedDatabase._id
-
   $: modelSchema = $backendUiStore.selectedModel
     ? Object.entries($backendUiStore.selectedModel.schema)
     : []
@@ -49,7 +47,6 @@
         ...record,
         modelId: $backendUiStore.selectedModel._id,
       },
-      instanceId,
       $backendUiStore.selectedModel._id
     )
     if (recordResponse.errors) {
diff --git a/packages/builder/src/components/database/ModelDataTable/modals/CreateEditView.svelte b/packages/builder/src/components/database/ModelDataTable/modals/CreateEditView.svelte
index 6f9f5dac1a..53cb3e2cc6 100644
--- a/packages/builder/src/components/database/ModelDataTable/modals/CreateEditView.svelte
+++ b/packages/builder/src/components/database/ModelDataTable/modals/CreateEditView.svelte
@@ -30,7 +30,7 @@
 
   async function saveView() {
     const SAVE_VIEW_URL = `/api/views`
-    const response = await api(instanceId).post(SAVE_VIEW_URL, view)
+    const response = await api.post(SAVE_VIEW_URL, view)
     backendUiStore.update(state => {
       state.views = [...state.views, response.view]
       return state
diff --git a/packages/builder/src/components/database/ModelDataTable/modals/CreateUser.svelte b/packages/builder/src/components/database/ModelDataTable/modals/CreateUser.svelte
index d5c924405f..60b77111d3 100644
--- a/packages/builder/src/components/database/ModelDataTable/modals/CreateUser.svelte
+++ b/packages/builder/src/components/database/ModelDataTable/modals/CreateUser.svelte
@@ -10,12 +10,11 @@
   let accessLevelId
 
   $: valid = username && password && accessLevelId
-  $: instanceId = $backendUiStore.selectedDatabase._id
   $: appId = $store.appId
 
   async function createUser() {
     const user = { name: username, username, password, accessLevelId }
-    const response = await api.createUser(user, instanceId)
+    const response = await api.createUser(user)
     backendUiStore.actions.users.create(response)
     onClosed()
   }
diff --git a/packages/builder/src/components/database/ModelDataTable/modals/DeleteRecord.svelte b/packages/builder/src/components/database/ModelDataTable/modals/DeleteRecord.svelte
index 05ecfcd85f..aa192b32eb 100644
--- a/packages/builder/src/components/database/ModelDataTable/modals/DeleteRecord.svelte
+++ b/packages/builder/src/components/database/ModelDataTable/modals/DeleteRecord.svelte
@@ -6,7 +6,6 @@
   export let record
   export let onClosed
 
-  $: instanceId = $backendUiStore.selectedDatabase._id
 </script>
 
 <section>
@@ -25,7 +24,7 @@
     <ActionButton
       alert
       on:click={async () => {
-        await api.deleteRecord(record, instanceId)
+        await api.deleteRecord(record)
         backendUiStore.actions.records.delete(record)
         onClosed()
       }}>
diff --git a/packages/builder/src/components/nav/SchemaManagementDrawer.svelte b/packages/builder/src/components/nav/SchemaManagementDrawer.svelte
index de7d010894..9465c85140 100644
--- a/packages/builder/src/components/nav/SchemaManagementDrawer.svelte
+++ b/packages/builder/src/components/nav/SchemaManagementDrawer.svelte
@@ -53,7 +53,7 @@
 
   async function deleteModel(modelToDelete) {
     const DELETE_MODEL_URL = `/api/models/${node._id}/${node._rev}`
-    const response = await api(instanceId).delete(DELETE_MODEL_URL)
+    const response = await api.delete(DELETE_MODEL_URL)
     backendUiStore.update(state => {
       state.models = state.models.filter(
         model => model._id !== modelToDelete._id
diff --git a/packages/builder/src/components/nav/UsersList.svelte b/packages/builder/src/components/nav/UsersList.svelte
index 29bc4a4ed3..e213aa066c 100644
--- a/packages/builder/src/components/nav/UsersList.svelte
+++ b/packages/builder/src/components/nav/UsersList.svelte
@@ -12,12 +12,11 @@
 
   $: currentAppInfo = {
     appname: $store.appname,
-    instanceId: $backendUiStore.selectedDatabase._id,
   }
 
   async function fetchUsers() {
     const FETCH_USERS_URL = `/api/users`
-    const response = await api(currentAppInfo.instanceId).get(FETCH_USERS_URL)
+    const response = await api.get(FETCH_USERS_URL)
     const users = await response.json()
     backendUiStore.update(state => {
       state.users = users
diff --git a/packages/server/src/api/routes/tests/couchTestUtils.js b/packages/server/src/api/routes/tests/couchTestUtils.js
index 9b8aedd453..17f096ec6b 100644
--- a/packages/server/src/api/routes/tests/couchTestUtils.js
+++ b/packages/server/src/api/routes/tests/couchTestUtils.js
@@ -37,7 +37,6 @@ exports.defaultHeaders = (appId, instanceId) => {
   return {
     Accept: "application/json",
     Cookie: [`builder:token=${builderToken}`],
-    "x-user-agent": "Budibase Builder",
   }
 }
 

From 31f8d3bee2149fddc4c6835d512750e016f5f274 Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Fri, 19 Jun 2020 17:21:24 +0100
Subject: [PATCH 13/15] codereview: looksLikeAppId as variable

---
 packages/server/src/api/controllers/static.js | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/packages/server/src/api/controllers/static.js b/packages/server/src/api/controllers/static.js
index 2f0ea8f4b0..67ec8e391a 100644
--- a/packages/server/src/api/controllers/static.js
+++ b/packages/server/src/api/controllers/static.js
@@ -26,7 +26,8 @@ exports.serveApp = async function(ctx) {
   )
   // only set the appId cookie for /appId .. we COULD check for valid appIds
   // but would like to avoid that DB hit
-  if (looksLikeAppId(ctx.params.appId) && !ctx.isAuthenticated) {
+  const looksLikeAppId = /^[0-9a-f]{32}$/.test(ctx.params.appId)
+  if (looksLikeAppId && !ctx.isAuthenticated) {
     const anonUser = {
       userId: "ANON",
       accessLevelId: ANON_LEVEL_ID,
@@ -74,5 +75,3 @@ exports.serveComponentLibrary = async function(ctx) {
 
   await send(ctx, "/index.js", { root: componentLibraryPath })
 }
-
-const looksLikeAppId = appId => /^[0-9a-f]{32}$/.test(appId)

From af0ed48774aca643d2121c6a0364f0d5db5803e1 Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Sat, 20 Jun 2020 20:30:00 +0100
Subject: [PATCH 14/15] bugfix: workflow still passing instanceId to api()

---
 packages/builder/src/builderStore/store/workflow/index.js     | 4 ++--
 .../workflow/WorkflowPanel/WorkflowList/WorkflowList.svelte   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/builder/src/builderStore/store/workflow/index.js b/packages/builder/src/builderStore/store/workflow/index.js
index d794868df3..9d50f85661 100644
--- a/packages/builder/src/builderStore/store/workflow/index.js
+++ b/packages/builder/src/builderStore/store/workflow/index.js
@@ -3,9 +3,9 @@ import api from "../../api"
 import Workflow from "./Workflow"
 
 const workflowActions = store => ({
-  fetch: async instanceId => {
+  fetch: async () => {
     const WORKFLOWS_URL = `/api/workflows`
-    const workflowResponse = await api(instanceId).get(WORKFLOWS_URL)
+    const workflowResponse = await api.get(WORKFLOWS_URL)
     const json = await workflowResponse.json()
     store.update(state => {
       state.workflows = json
diff --git a/packages/builder/src/components/workflow/WorkflowPanel/WorkflowList/WorkflowList.svelte b/packages/builder/src/components/workflow/WorkflowPanel/WorkflowList/WorkflowList.svelte
index f4c0f2ebf8..ece0a47016 100644
--- a/packages/builder/src/components/workflow/WorkflowPanel/WorkflowList/WorkflowList.svelte
+++ b/packages/builder/src/components/workflow/WorkflowPanel/WorkflowList/WorkflowList.svelte
@@ -22,7 +22,7 @@
   }
 
   onMount(() => {
-    workflowStore.actions.fetch($backendUiStore.selectedDatabase._id)
+    workflowStore.actions.fetch()
   })
 </script>
 

From ff2c2340e2a5a377d33886ad3f55769f10449395 Mon Sep 17 00:00:00 2001
From: Michael Shanks <mike@budibase.com>
Date: Sun, 21 Jun 2020 06:01:29 +0100
Subject: [PATCH 15/15] bugfix:Dataform throwing error

---
 packages/standard-components/src/DataForm.svelte | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/standard-components/src/DataForm.svelte b/packages/standard-components/src/DataForm.svelte
index dc97c6971d..6188165aa7 100644
--- a/packages/standard-components/src/DataForm.svelte
+++ b/packages/standard-components/src/DataForm.svelte
@@ -32,7 +32,7 @@
     const json = await response.json()
 
     store.update(state => {
-      state[model._id] = [...state[model], json]
+      state[model] = state[model] ? [...state[model], json] : [json]
       return state
     })
   }