From e8e331e578e05d033b23fb438fc4ebb249aaa32d Mon Sep 17 00:00:00 2001
From: mike12345567 <me@michaeldrury.co.uk>
Date: Tue, 21 Sep 2021 16:07:04 +0100
Subject: [PATCH] Removing use of db.post as its dangerous to allow the
 possibility of _id being auto-generated, these docs would be lost as we
 couldn't query them out by the usual id mechanism.

---
 .../src/middleware/passport/tests/third-party-common.spec.js  | 2 +-
 packages/auth/src/middleware/passport/third-party-common.js   | 2 +-
 packages/server/src/api/controllers/datasource.js             | 4 ++--
 packages/server/src/api/controllers/row/internal.js           | 1 -
 packages/server/src/api/controllers/table/index.js            | 2 +-
 packages/worker/src/api/controllers/global/workspaces.js      | 2 +-
 6 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/packages/auth/src/middleware/passport/tests/third-party-common.spec.js b/packages/auth/src/middleware/passport/tests/third-party-common.spec.js
index ff38a01fbb..1ace65ba40 100644
--- a/packages/auth/src/middleware/passport/tests/third-party-common.spec.js
+++ b/packages/auth/src/middleware/passport/tests/third-party-common.spec.js
@@ -104,7 +104,7 @@ describe("third party common", () => {
           _id: id,
           email: email,
         }
-        const response = await db.post(dbUser)
+        const response = await db.put(dbUser)
         dbUser._rev = response.rev
       }
 
diff --git a/packages/auth/src/middleware/passport/third-party-common.js b/packages/auth/src/middleware/passport/third-party-common.js
index 7c03944232..c25aa3e0b0 100644
--- a/packages/auth/src/middleware/passport/third-party-common.js
+++ b/packages/auth/src/middleware/passport/third-party-common.js
@@ -71,7 +71,7 @@ exports.authenticateThirdParty = async function (
   dbUser = await syncUser(dbUser, thirdPartyUser)
 
   // create or sync the user
-  const response = await db.post(dbUser)
+  const response = await db.put(dbUser)
   dbUser._rev = response.rev
 
   // authenticate
diff --git a/packages/server/src/api/controllers/datasource.js b/packages/server/src/api/controllers/datasource.js
index 38b6e68932..4a2fd7d86a 100644
--- a/packages/server/src/api/controllers/datasource.js
+++ b/packages/server/src/api/controllers/datasource.js
@@ -51,7 +51,7 @@ exports.buildSchemaFromDb = async function (ctx) {
   await connector.buildSchema(datasource._id, datasource.entities)
   datasource.entities = connector.tables
 
-  const response = await db.post(datasource)
+  const response = await db.put(datasource)
   datasource._rev = response.rev
 
   ctx.body = datasource
@@ -89,7 +89,7 @@ exports.save = async function (ctx) {
     ...ctx.request.body,
   }
 
-  const response = await db.post(datasource)
+  const response = await db.put(datasource)
   datasource._rev = response.rev
 
   // Drain connection pools when configuration is changed
diff --git a/packages/server/src/api/controllers/row/internal.js b/packages/server/src/api/controllers/row/internal.js
index b663cc9e32..f8960129c2 100644
--- a/packages/server/src/api/controllers/row/internal.js
+++ b/packages/server/src/api/controllers/row/internal.js
@@ -197,7 +197,6 @@ exports.fetchView = async ctx => {
     throw "View does not exist."
   }
   let response
-  // TODO: make sure not self hosted in Cloud
   if (env.SELF_HOSTED) {
     response = await db.query(`database/${viewName}`, {
       include_docs: !calculation,
diff --git a/packages/server/src/api/controllers/table/index.js b/packages/server/src/api/controllers/table/index.js
index 60b5167f66..c7b72cf1c8 100644
--- a/packages/server/src/api/controllers/table/index.js
+++ b/packages/server/src/api/controllers/table/index.js
@@ -145,7 +145,7 @@ exports.save = async function (ctx) {
   if (updatedRows && updatedRows.length !== 0) {
     await db.bulkDocs(updatedRows)
   }
-  const result = await db.post(tableToSave)
+  const result = await db.put(tableToSave)
   tableToSave._rev = result.rev
 
   tableToSave = await tableSaveFunctions.after(tableToSave)
diff --git a/packages/worker/src/api/controllers/global/workspaces.js b/packages/worker/src/api/controllers/global/workspaces.js
index 95a1ec296d..48a710c92d 100644
--- a/packages/worker/src/api/controllers/global/workspaces.js
+++ b/packages/worker/src/api/controllers/global/workspaces.js
@@ -11,7 +11,7 @@ exports.save = async function (ctx) {
   }
 
   try {
-    const response = await db.post(workspaceDoc)
+    const response = await db.put(workspaceDoc)
     ctx.body = {
       _id: response.id,
       _rev: response.rev,