From aca310e72124f55a2cf623215b2f861b1bff5022 Mon Sep 17 00:00:00 2001 From: Adria Navarro Date: Tue, 3 Sep 2024 17:21:13 +0200 Subject: [PATCH 01/42] Tidy code --- .../middleware/triggerRowActionAuthorised.ts | 20 +++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/packages/server/src/middleware/triggerRowActionAuthorised.ts b/packages/server/src/middleware/triggerRowActionAuthorised.ts index be5c6a97e1..6a3d1e3a5d 100644 --- a/packages/server/src/middleware/triggerRowActionAuthorised.ts +++ b/packages/server/src/middleware/triggerRowActionAuthorised.ts @@ -1,5 +1,5 @@ import { Next } from "koa" -import { Ctx } from "@budibase/types" +import { UserCtx } from "@budibase/types" import { paramSubResource } from "./resourceId" import { docIds } from "@budibase/backend-core" import * as utils from "../db/utils" @@ -9,9 +9,11 @@ export function triggerRowActionAuthorised( sourcePath: string, actionPath: string ) { - return async (ctx: Ctx, next: Next) => { + function extractResourceIds(ctx: UserCtx) { + ctx = { ...ctx } // Reusing the existing middleware to extract the value paramSubResource(sourcePath, actionPath)(ctx, () => {}) + const { resourceId: sourceId, subResourceId: rowActionId } = ctx const isTableId = docIds.isTableId(sourceId) @@ -23,18 +25,24 @@ export function triggerRowActionAuthorised( const tableId = isTableId ? sourceId : utils.extractViewInfoFromID(sourceId).tableId + const viewId = isTableId ? undefined : sourceId + return { tableId, viewId, rowActionId } + } + + return async (ctx: UserCtx, next: Next) => { + const { tableId, viewId, rowActionId } = extractResourceIds(ctx) const rowAction = await sdk.rowActions.get(tableId, rowActionId) - if (isTableId && !rowAction.permissions.table.runAllowed) { + if (!viewId && !rowAction.permissions.table.runAllowed) { ctx.throw( 403, - `Row action '${rowActionId}' is not enabled for table '${sourceId}'` + `Row action '${rowActionId}' is not enabled for table '${tableId}'` ) - } else if (isViewId && !rowAction.permissions.views[sourceId]?.runAllowed) { + } else if (viewId && !rowAction.permissions.views[viewId]?.runAllowed) { ctx.throw( 403, - `Row action '${rowActionId}' is not enabled for view '${sourceId}'` + `Row action '${rowActionId}' is not enabled for view '${viewId}'` ) } From 623b385d8a60df20993eb02211663cbbbb368c30 Mon Sep 17 00:00:00 2001 From: Adria Navarro Date: Tue, 3 Sep 2024 17:53:25 +0200 Subject: [PATCH 02/42] Promisify middleware --- .../src/middleware/triggerRowActionAuthorised.ts | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/packages/server/src/middleware/triggerRowActionAuthorised.ts b/packages/server/src/middleware/triggerRowActionAuthorised.ts index 6a3d1e3a5d..2f94e46589 100644 --- a/packages/server/src/middleware/triggerRowActionAuthorised.ts +++ b/packages/server/src/middleware/triggerRowActionAuthorised.ts @@ -5,16 +5,24 @@ import { docIds } from "@budibase/backend-core" import * as utils from "../db/utils" import sdk from "../sdk" +async function executeMiddleware( + ctx: UserCtx, + delegate: (ctx: UserCtx, next: any) => any +) { + await new Promise(r => delegate(ctx, () => r())) +} + export function triggerRowActionAuthorised( sourcePath: string, actionPath: string ) { - function extractResourceIds(ctx: UserCtx) { + async function extractResourceIds(ctx: UserCtx) { ctx = { ...ctx } // Reusing the existing middleware to extract the value - paramSubResource(sourcePath, actionPath)(ctx, () => {}) + await executeMiddleware(ctx, paramSubResource(sourcePath, actionPath)) - const { resourceId: sourceId, subResourceId: rowActionId } = ctx + const sourceId: string = ctx.resourceId + const rowActionId: String = ctx.subResourceId const isTableId = docIds.isTableId(sourceId) const isViewId = utils.isViewID(sourceId) From 00119f9d731f8e0c0f2784af4d468f31d03c25ef Mon Sep 17 00:00:00 2001 From: Adria Navarro Date: Wed, 4 Sep 2024 10:16:59 +0200 Subject: [PATCH 03/42] Guard permission --- .../src/api/routes/tests/rowAction.spec.ts | 32 ++++++++ packages/server/src/middleware/authorized.ts | 2 +- .../middleware/triggerRowActionAuthorised.ts | 74 ++++++++++++------- 3 files changed, 81 insertions(+), 27 deletions(-) diff --git a/packages/server/src/api/routes/tests/rowAction.spec.ts b/packages/server/src/api/routes/tests/rowAction.spec.ts index 40ba2c1811..003488c008 100644 --- a/packages/server/src/api/routes/tests/rowAction.spec.ts +++ b/packages/server/src/api/routes/tests/rowAction.spec.ts @@ -742,5 +742,37 @@ describe("/rowsActions", () => { }), ]) }) + + const { PUBLIC, ...nonPublicRoles } = roles.BUILTIN_ROLE_IDS + + it.each(Object.values(nonPublicRoles))( + "rejects if the user does not have table read permission", + async role => { + await config.api.permission.add({ + level: PermissionLevel.READ, + resourceId: tableId, + roleId: role, + }) + + const normalUser = await config.createUser({ + admin: { global: false }, + builder: {}, + }) + await config.withUser(normalUser, async () => { + await config.publish() + await config.api.rowAction.trigger( + tableId, + rowAction.id, + { + rowId: row._id!, + }, + { status: 403, body: { message: "User does not have permission" } } + ) + + const automationLogs = await getAutomationLogs() + expect(automationLogs).toBeEmpty() + }) + } + ) }) }) diff --git a/packages/server/src/middleware/authorized.ts b/packages/server/src/middleware/authorized.ts index b23a9846b7..3bead7f80d 100644 --- a/packages/server/src/middleware/authorized.ts +++ b/packages/server/src/middleware/authorized.ts @@ -88,7 +88,7 @@ const authorized = opts = { schema: false }, resourcePath?: string ) => - async (ctx: any, next: any) => { + async (ctx: UserCtx, next: any) => { // webhooks don't need authentication, each webhook unique // also internal requests (between services) don't need authorized if (isWebhookEndpoint(ctx) || ctx.internal) { diff --git a/packages/server/src/middleware/triggerRowActionAuthorised.ts b/packages/server/src/middleware/triggerRowActionAuthorised.ts index 2f94e46589..4cee167350 100644 --- a/packages/server/src/middleware/triggerRowActionAuthorised.ts +++ b/packages/server/src/middleware/triggerRowActionAuthorised.ts @@ -1,44 +1,64 @@ import { Next } from "koa" -import { UserCtx } from "@budibase/types" +import { PermissionLevel, PermissionType, UserCtx } from "@budibase/types" import { paramSubResource } from "./resourceId" import { docIds } from "@budibase/backend-core" import * as utils from "../db/utils" import sdk from "../sdk" - -async function executeMiddleware( - ctx: UserCtx, - delegate: (ctx: UserCtx, next: any) => any -) { - await new Promise(r => delegate(ctx, () => r())) -} +import { authorizedResource } from "./authorized" export function triggerRowActionAuthorised( sourcePath: string, actionPath: string ) { - async function extractResourceIds(ctx: UserCtx) { - ctx = { ...ctx } - // Reusing the existing middleware to extract the value - await executeMiddleware(ctx, paramSubResource(sourcePath, actionPath)) + return async (ctx: UserCtx, next: Next) => { + async function getResourceIds() { + // Reusing the existing middleware to extract the value + await paramSubResource(sourcePath, actionPath)(ctx, () => {}) - const sourceId: string = ctx.resourceId - const rowActionId: String = ctx.subResourceId + const sourceId: string = ctx.resourceId + const rowActionId: string = ctx.subResourceId - const isTableId = docIds.isTableId(sourceId) - const isViewId = utils.isViewID(sourceId) - if (!isTableId && !isViewId) { - ctx.throw(400, `'${sourceId}' is not a valid source id`) + const isTableId = docIds.isTableId(sourceId) + const isViewId = utils.isViewID(sourceId) + if (!isTableId && !isViewId) { + ctx.throw(400, `'${sourceId}' is not a valid source id`) + } + + const tableId = isTableId + ? sourceId + : utils.extractViewInfoFromID(sourceId).tableId + const viewId = isTableId ? undefined : sourceId + return { tableId, viewId, rowActionId } } - const tableId = isTableId - ? sourceId - : utils.extractViewInfoFromID(sourceId).tableId - const viewId = isTableId ? undefined : sourceId - return { tableId, viewId, rowActionId } - } + async function guardResourcePermissions( + ctx: UserCtx, + tableId: string, + viewId?: string + ) { + const { params } = ctx + try { + if (!viewId) { + ctx.params = { tableId } + await authorizedResource( + PermissionType.TABLE, + PermissionLevel.READ, + "tableId" + )(ctx, () => {}) + } else { + ctx.params = { viewId } + await authorizedResource( + PermissionType.VIEW, + PermissionLevel.READ, + "__viewId" + )(ctx, () => {}) + } + } finally { + ctx.params = params + } + } - return async (ctx: UserCtx, next: Next) => { - const { tableId, viewId, rowActionId } = extractResourceIds(ctx) + const { tableId, viewId, rowActionId } = await getResourceIds() const rowAction = await sdk.rowActions.get(tableId, rowActionId) @@ -54,6 +74,8 @@ export function triggerRowActionAuthorised( ) } + await guardResourcePermissions(ctx, tableId, viewId) + // Enrich tableId ctx.params.tableId = tableId return next() From 92a0740cef6bd46c36243f44a2dae104afc7f1a2 Mon Sep 17 00:00:00 2001 From: Adria Navarro Date: Wed, 4 Sep 2024 11:10:56 +0200 Subject: [PATCH 04/42] Proper guarding --- .../middleware/triggerRowActionAuthorised.ts | 46 ++++--------------- 1 file changed, 10 insertions(+), 36 deletions(-) diff --git a/packages/server/src/middleware/triggerRowActionAuthorised.ts b/packages/server/src/middleware/triggerRowActionAuthorised.ts index 4cee167350..17f22b7000 100644 --- a/packages/server/src/middleware/triggerRowActionAuthorised.ts +++ b/packages/server/src/middleware/triggerRowActionAuthorised.ts @@ -1,6 +1,5 @@ import { Next } from "koa" import { PermissionLevel, PermissionType, UserCtx } from "@budibase/types" -import { paramSubResource } from "./resourceId" import { docIds } from "@budibase/backend-core" import * as utils from "../db/utils" import sdk from "../sdk" @@ -12,11 +11,8 @@ export function triggerRowActionAuthorised( ) { return async (ctx: UserCtx, next: Next) => { async function getResourceIds() { - // Reusing the existing middleware to extract the value - await paramSubResource(sourcePath, actionPath)(ctx, () => {}) - - const sourceId: string = ctx.resourceId - const rowActionId: string = ctx.subResourceId + const sourceId: string = ctx.params[sourcePath] + const rowActionId: string = ctx.params[actionPath] const isTableId = docIds.isTableId(sourceId) const isViewId = utils.isViewID(sourceId) @@ -31,37 +27,17 @@ export function triggerRowActionAuthorised( return { tableId, viewId, rowActionId } } - async function guardResourcePermissions( - ctx: UserCtx, - tableId: string, - viewId?: string - ) { - const { params } = ctx - try { - if (!viewId) { - ctx.params = { tableId } - await authorizedResource( - PermissionType.TABLE, - PermissionLevel.READ, - "tableId" - )(ctx, () => {}) - } else { - ctx.params = { viewId } - await authorizedResource( - PermissionType.VIEW, - PermissionLevel.READ, - "__viewId" - )(ctx, () => {}) - } - } finally { - ctx.params = params - } - } - const { tableId, viewId, rowActionId } = await getResourceIds() - const rowAction = await sdk.rowActions.get(tableId, rowActionId) + // Check if the user has permissions to the table/view + await authorizedResource( + !viewId ? PermissionType.TABLE : PermissionType.VIEW, + PermissionLevel.READ, + sourcePath + )(ctx, () => {}) + // Check is the row action can run for the given view/table + const rowAction = await sdk.rowActions.get(tableId, rowActionId) if (!viewId && !rowAction.permissions.table.runAllowed) { ctx.throw( 403, @@ -74,8 +50,6 @@ export function triggerRowActionAuthorised( ) } - await guardResourcePermissions(ctx, tableId, viewId) - // Enrich tableId ctx.params.tableId = tableId return next() From 11e8d576e2a11553be011b7b4f357ac6aadd9a44 Mon Sep 17 00:00:00 2001 From: Adria Navarro Date: Wed, 4 Sep 2024 11:11:10 +0200 Subject: [PATCH 05/42] Extra tests --- .../src/api/routes/tests/rowAction.spec.ts | 115 +++++++++++++----- 1 file changed, 85 insertions(+), 30 deletions(-) diff --git a/packages/server/src/api/routes/tests/rowAction.spec.ts b/packages/server/src/api/routes/tests/rowAction.spec.ts index 003488c008..6dad230751 100644 --- a/packages/server/src/api/routes/tests/rowAction.spec.ts +++ b/packages/server/src/api/routes/tests/rowAction.spec.ts @@ -743,36 +743,91 @@ describe("/rowsActions", () => { ]) }) - const { PUBLIC, ...nonPublicRoles } = roles.BUILTIN_ROLE_IDS - - it.each(Object.values(nonPublicRoles))( - "rejects if the user does not have table read permission", - async role => { - await config.api.permission.add({ - level: PermissionLevel.READ, - resourceId: tableId, - roleId: role, - }) - - const normalUser = await config.createUser({ - admin: { global: false }, - builder: {}, - }) - await config.withUser(normalUser, async () => { - await config.publish() - await config.api.rowAction.trigger( - tableId, - rowAction.id, - { - rowId: row._id!, - }, - { status: 403, body: { message: "User does not have permission" } } - ) - - const automationLogs = await getAutomationLogs() - expect(automationLogs).toBeEmpty() - }) + describe("role permission checks", () => { + function createUser(role: string) { + return config.createUser({ + admin: { global: false }, + builder: {}, + roles: { [config.getProdAppId()]: role }, + }) } - ) + + function getRolesHigherThan(role: string) { + const result = Object.values(roles.BUILTIN_ROLE_IDS).filter( + r => r !== role && roles.lowerBuiltinRoleID(r, role) === role + ) + return result + } + function getRolesLowerThan(role: string) { + const result = Object.values(roles.BUILTIN_ROLE_IDS).filter( + r => r !== role && roles.lowerBuiltinRoleID(r, role) === r + ) + return result + } + + const allowedRoleConfig = Object.values(roles.BUILTIN_ROLE_IDS).flatMap( + r => [r, ...getRolesLowerThan(r)].map(p => [r, p]) + ) + + const disallowedRoleConfig = Object.values( + roles.BUILTIN_ROLE_IDS + ).flatMap(r => getRolesHigherThan(r).map(p => [r, p])) + + it.each(allowedRoleConfig)( + "allows triggering if the user has table read permission (user %s, table %s)", + async (userRole, resourcePermission) => { + await config.api.permission.add({ + level: PermissionLevel.READ, + resourceId: tableId, + roleId: resourcePermission, + }) + + const normalUser = await createUser(userRole) + + await config.withUser(normalUser, async () => { + await config.publish() + await config.api.rowAction.trigger( + tableId, + rowAction.id, + { + rowId: row._id!, + }, + { status: 200 } + ) + }) + } + ) + + it.each(disallowedRoleConfig)( + "rejects if the user does not have table read permission (user %s, table %s)", + async (userRole, resourcePermission) => { + await config.api.permission.add({ + level: PermissionLevel.READ, + resourceId: tableId, + roleId: resourcePermission, + }) + + const normalUser = await createUser(userRole) + + await config.withUser(normalUser, async () => { + await config.publish() + await config.api.rowAction.trigger( + tableId, + rowAction.id, + { + rowId: row._id!, + }, + { + status: 403, + body: { message: "User does not have permission" }, + } + ) + + const automationLogs = await getAutomationLogs() + expect(automationLogs).toBeEmpty() + }) + } + ) + }) }) }) From f4f503690d28ac374868bad31dc86a14cc429008 Mon Sep 17 00:00:00 2001 From: Adria Navarro Date: Wed, 4 Sep 2024 12:23:15 +0200 Subject: [PATCH 06/42] Dynamic tests --- .../src/api/routes/tests/rowAction.spec.ts | 83 +++++++++++++------ 1 file changed, 58 insertions(+), 25 deletions(-) diff --git a/packages/server/src/api/routes/tests/rowAction.spec.ts b/packages/server/src/api/routes/tests/rowAction.spec.ts index 6dad230751..b6901dd28f 100644 --- a/packages/server/src/api/routes/tests/rowAction.spec.ts +++ b/packages/server/src/api/routes/tests/rowAction.spec.ts @@ -9,7 +9,7 @@ import { RowActionResponse, } from "@budibase/types" import * as setup from "./utilities" -import { generator } from "@budibase/backend-core/tests" +import { generator, mocks } from "@budibase/backend-core/tests" import { Expectations } from "../../../tests/utilities/api/base" import { roles } from "@budibase/backend-core" import { automations } from "@budibase/pro" @@ -743,7 +743,34 @@ describe("/rowsActions", () => { ]) }) - describe("role permission checks", () => { + describe.each([ + ["table", async () => tableId], + [ + "view", + async () => { + const viewId = ( + await config.api.viewV2.create( + setup.structures.viewV2.createRequest(tableId) + ) + ).id + + await config.api.rowAction.setViewPermission( + tableId, + viewId, + rowAction.id + ) + return viewId + }, + ], + ])("role permission checks (for %s)", (_, getResourceId) => { + beforeAll(() => { + mocks.licenses.useViewPermissions() + }) + + afterAll(() => { + mocks.licenses.useCloudFree() + }) + function createUser(role: string) { return config.createUser({ admin: { global: false }, @@ -752,33 +779,38 @@ describe("/rowsActions", () => { }) } - function getRolesHigherThan(role: string) { - const result = Object.values(roles.BUILTIN_ROLE_IDS).filter( - r => r !== role && roles.lowerBuiltinRoleID(r, role) === role + const allowedRoleConfig = (() => { + function getRolesLowerThan(role: string) { + const result = Object.values(roles.BUILTIN_ROLE_IDS).filter( + r => r !== role && roles.lowerBuiltinRoleID(r, role) === r + ) + return result + } + return Object.values(roles.BUILTIN_ROLE_IDS).flatMap(r => + [r, ...getRolesLowerThan(r)].map(p => [r, p]) ) - return result - } - function getRolesLowerThan(role: string) { - const result = Object.values(roles.BUILTIN_ROLE_IDS).filter( - r => r !== role && roles.lowerBuiltinRoleID(r, role) === r + })() + + const disallowedRoleConfig = (() => { + function getRolesHigherThan(role: string) { + const result = Object.values(roles.BUILTIN_ROLE_IDS).filter( + r => r !== role && roles.lowerBuiltinRoleID(r, role) === role + ) + return result + } + return Object.values(roles.BUILTIN_ROLE_IDS).flatMap(r => + getRolesHigherThan(r).map(p => [r, p]) ) - return result - } - - const allowedRoleConfig = Object.values(roles.BUILTIN_ROLE_IDS).flatMap( - r => [r, ...getRolesLowerThan(r)].map(p => [r, p]) - ) - - const disallowedRoleConfig = Object.values( - roles.BUILTIN_ROLE_IDS - ).flatMap(r => getRolesHigherThan(r).map(p => [r, p])) + })() it.each(allowedRoleConfig)( - "allows triggering if the user has table read permission (user %s, table %s)", + "allows triggering if the user has read permission (user %s, table %s)", async (userRole, resourcePermission) => { + const resourceId = await getResourceId() + await config.api.permission.add({ level: PermissionLevel.READ, - resourceId: tableId, + resourceId, roleId: resourcePermission, }) @@ -787,7 +819,7 @@ describe("/rowsActions", () => { await config.withUser(normalUser, async () => { await config.publish() await config.api.rowAction.trigger( - tableId, + resourceId, rowAction.id, { rowId: row._id!, @@ -801,9 +833,10 @@ describe("/rowsActions", () => { it.each(disallowedRoleConfig)( "rejects if the user does not have table read permission (user %s, table %s)", async (userRole, resourcePermission) => { + const resourceId = await getResourceId() await config.api.permission.add({ level: PermissionLevel.READ, - resourceId: tableId, + resourceId, roleId: resourcePermission, }) @@ -812,7 +845,7 @@ describe("/rowsActions", () => { await config.withUser(normalUser, async () => { await config.publish() await config.api.rowAction.trigger( - tableId, + resourceId, rowAction.id, { rowId: row._id!, From 19963f496f9034c4674f6231336daf71947e5216 Mon Sep 17 00:00:00 2001 From: Adria Navarro Date: Wed, 4 Sep 2024 12:26:12 +0200 Subject: [PATCH 07/42] Add extra tests --- .../src/api/routes/tests/rowAction.spec.ts | 40 ++++++++++++++----- 1 file changed, 30 insertions(+), 10 deletions(-) diff --git a/packages/server/src/api/routes/tests/rowAction.spec.ts b/packages/server/src/api/routes/tests/rowAction.spec.ts index b6901dd28f..e0fbcb2847 100644 --- a/packages/server/src/api/routes/tests/rowAction.spec.ts +++ b/packages/server/src/api/routes/tests/rowAction.spec.ts @@ -744,9 +744,12 @@ describe("/rowsActions", () => { }) describe.each([ - ["table", async () => tableId], [ - "view", + "table", + async () => ({ permissionResource: tableId, triggerResouce: tableId }), + ], + [ + "view (with implicit views)", async () => { const viewId = ( await config.api.viewV2.create( @@ -759,10 +762,27 @@ describe("/rowsActions", () => { viewId, rowAction.id ) - return viewId + return { permissionResource: viewId, triggerResouce: viewId } }, ], - ])("role permission checks (for %s)", (_, getResourceId) => { + [ + "view (without implicit views)", + async () => { + const viewId = ( + await config.api.viewV2.create( + setup.structures.viewV2.createRequest(tableId) + ) + ).id + + await config.api.rowAction.setViewPermission( + tableId, + viewId, + rowAction.id + ) + return { permissionResource: tableId, triggerResouce: viewId } + }, + ], + ])("role permission checks (for %s)", (_, getResources) => { beforeAll(() => { mocks.licenses.useViewPermissions() }) @@ -806,11 +826,11 @@ describe("/rowsActions", () => { it.each(allowedRoleConfig)( "allows triggering if the user has read permission (user %s, table %s)", async (userRole, resourcePermission) => { - const resourceId = await getResourceId() + const { permissionResource, triggerResouce } = await getResources() await config.api.permission.add({ level: PermissionLevel.READ, - resourceId, + resourceId: permissionResource, roleId: resourcePermission, }) @@ -819,7 +839,7 @@ describe("/rowsActions", () => { await config.withUser(normalUser, async () => { await config.publish() await config.api.rowAction.trigger( - resourceId, + triggerResouce, rowAction.id, { rowId: row._id!, @@ -833,10 +853,10 @@ describe("/rowsActions", () => { it.each(disallowedRoleConfig)( "rejects if the user does not have table read permission (user %s, table %s)", async (userRole, resourcePermission) => { - const resourceId = await getResourceId() + const { permissionResource, triggerResouce } = await getResources() await config.api.permission.add({ level: PermissionLevel.READ, - resourceId, + resourceId: permissionResource, roleId: resourcePermission, }) @@ -845,7 +865,7 @@ describe("/rowsActions", () => { await config.withUser(normalUser, async () => { await config.publish() await config.api.rowAction.trigger( - resourceId, + triggerResouce, rowAction.id, { rowId: row._id!, From 2553432ec960656212d951a53420b7eee6eec6ed Mon Sep 17 00:00:00 2001 From: Sam Rose Date: Wed, 4 Sep 2024 14:21:25 +0100 Subject: [PATCH 08/42] wip --- .../server/src/integrations/googlesheets.ts | 4 +- .../integrations/tests/googlesheets.spec.ts | 98 +++++++++++-------- 2 files changed, 58 insertions(+), 44 deletions(-) diff --git a/packages/server/src/integrations/googlesheets.ts b/packages/server/src/integrations/googlesheets.ts index f8f5209890..b257a5da9b 100644 --- a/packages/server/src/integrations/googlesheets.ts +++ b/packages/server/src/integrations/googlesheets.ts @@ -31,7 +31,7 @@ import { cache, configs, context, HTTPError } from "@budibase/backend-core" import { dataFilters, utils } from "@budibase/shared-core" import { GOOGLE_SHEETS_PRIMARY_KEY } from "../constants" -interface GoogleSheetsConfig { +export interface GoogleSheetsConfig { spreadsheetId: string auth: OAuthClientConfig continueSetupId?: string @@ -157,7 +157,7 @@ const SCHEMA: Integration = { }, } -class GoogleSheetsIntegration implements DatasourcePlus { +export class GoogleSheetsIntegration implements DatasourcePlus { private readonly config: GoogleSheetsConfig private readonly spreadsheetId: string private client: GoogleSpreadsheet = undefined! diff --git a/packages/server/src/integrations/tests/googlesheets.spec.ts b/packages/server/src/integrations/tests/googlesheets.spec.ts index e9d5290b2c..685345660d 100644 --- a/packages/server/src/integrations/tests/googlesheets.spec.ts +++ b/packages/server/src/integrations/tests/googlesheets.spec.ts @@ -2,49 +2,48 @@ import { setEnv as setCoreEnv } from "@budibase/backend-core" import type { GoogleSpreadsheetWorksheet } from "google-spreadsheet" import nock from "nock" -jest.mock("google-auth-library") -const { OAuth2Client } = require("google-auth-library") - -const setCredentialsMock = jest.fn() -const getAccessTokenMock = jest.fn() - -OAuth2Client.mockImplementation(() => { - return { - setCredentials: setCredentialsMock, - getAccessToken: getAccessTokenMock, - } -}) - -jest.mock("google-spreadsheet") -const { GoogleSpreadsheet } = require("google-spreadsheet") - -const sheetsByTitle: { [title: string]: GoogleSpreadsheetWorksheet } = {} -const sheetsByIndex: GoogleSpreadsheetWorksheet[] = [] -const mockGoogleIntegration = { - useOAuth2Client: jest.fn(), - loadInfo: jest.fn(), - sheetsByTitle, - sheetsByIndex, -} - -GoogleSpreadsheet.mockImplementation(() => mockGoogleIntegration) - import { structures } from "@budibase/backend-core/tests" import TestConfiguration from "../../tests/utilities/TestConfiguration" -import GoogleSheetsIntegration from "../googlesheets" -import { FieldType, Table, TableSchema, TableSourceType } from "@budibase/types" +import { GoogleSheetsConfig, GoogleSheetsIntegration } from "../googlesheets" +import { + Datasource, + FieldType, + SourceName, + Table, + TableSchema, + TableSourceType, +} from "@budibase/types" import { generateDatasourceID } from "../../db/utils" describe("Google Sheets Integration", () => { - let integration: any, - config = new TestConfiguration() - let cleanupEnv: () => void + const config = new TestConfiguration() - beforeAll(() => { + let integration: GoogleSheetsIntegration + let cleanupEnv: () => void + let table: Table + let datasource: Datasource + + const datasourceConfig: GoogleSheetsConfig = { + spreadsheetId: "randomId", + auth: { + appId: "appId", + accessToken: "accessToken", + refreshToken: "refreshToken", + }, + } + + beforeAll(async () => { cleanupEnv = setCoreEnv({ GOOGLE_CLIENT_ID: "test", GOOGLE_CLIENT_SECRET: "test", }) + + datasource = await config.api.datasource.create({ + name: "Test Datasource", + type: "datasource", + source: SourceName.GOOGLE_SHEETS, + config: datasourceConfig, + }) }) afterAll(async () => { @@ -53,17 +52,32 @@ describe("Google Sheets Integration", () => { }) beforeEach(async () => { - integration = new GoogleSheetsIntegration.integration({ - spreadsheetId: "randomId", - auth: { - appId: "appId", - accessToken: "accessToken", - refreshToken: "refreshToken", - }, - }) await config.init() - jest.clearAllMocks() + integration = new GoogleSheetsIntegration(datasourceConfig) + + table = await config.api.table.save({ + name: "Test Table", + type: "table", + sourceId: generateDatasourceID(), + sourceType: TableSourceType.EXTERNAL, + schema: { + name: { + name: "name", + type: FieldType.STRING, + constraints: { + type: "string", + }, + }, + description: { + name: "description", + type: FieldType.STRING, + constraints: { + type: "string", + }, + }, + }, + }) nock.cleanAll() nock("https://www.googleapis.com/").post("/oauth2/v4/token").reply(200, { From b1b861139dbb1d607978395e5df2d9f468054316 Mon Sep 17 00:00:00 2001 From: Peter Clement Date: Thu, 5 Sep 2024 14:25:04 +0100 Subject: [PATCH 09/42] feature flag the branch action definition --- packages/backend-core/src/features/index.ts | 1 + packages/server/src/automations/actions.ts | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/packages/backend-core/src/features/index.ts b/packages/backend-core/src/features/index.ts index 49f8044e8f..5951bbc292 100644 --- a/packages/backend-core/src/features/index.ts +++ b/packages/backend-core/src/features/index.ts @@ -267,6 +267,7 @@ export class FlagSet, T extends { [key: string]: V }> { // default values set correctly and their types flow through the system. export const flags = new FlagSet({ DEFAULT_VALUES: Flag.boolean(env.isDev()), + AUTOMATION_BRANCHING: Flag.boolean(env.isDev()), SQS: Flag.boolean(env.isDev()), [FeatureFlag.ENRICHED_RELATIONSHIPS]: Flag.boolean(false), }) diff --git a/packages/server/src/automations/actions.ts b/packages/server/src/automations/actions.ts index 2058723faa..a9b839fedd 100644 --- a/packages/server/src/automations/actions.ts +++ b/packages/server/src/automations/actions.ts @@ -16,6 +16,7 @@ import * as delay from "./steps/delay" import * as queryRow from "./steps/queryRows" import * as loop from "./steps/loop" import * as collect from "./steps/collect" +import * as branch from "./steps/branch" import * as triggerAutomationRun from "./steps/triggerAutomationRun" import env from "../environment" import { @@ -25,9 +26,11 @@ import { Hosting, ActionImplementation, AutomationStepDefinition, + FeatureFlag, } from "@budibase/types" import sdk from "../sdk" import { getAutomationPlugin } from "../utilities/fileSystem" +import { features } from "@budibase/backend-core" type ActionImplType = ActionImplementations< typeof env.SELF_HOSTED extends "true" ? Hosting.SELF : Hosting.CLOUD @@ -98,6 +101,9 @@ if (env.SELF_HOSTED) { } export async function getActionDefinitions() { + if (await features.flags.isEnabled("AUTOMATION_BRANCHING")) { + BUILTIN_ACTION_DEFINITIONS["BRANCH"] = branch.definition + } const actionDefinitions = BUILTIN_ACTION_DEFINITIONS if (env.SELF_HOSTED) { const plugins = await sdk.plugins.fetch(PluginType.AUTOMATION) From 528a21643cae6434b28e1ee999b75b1641372267 Mon Sep 17 00:00:00 2001 From: melohagan <101575380+melohagan@users.noreply.github.com> Date: Fri, 6 Sep 2024 09:01:05 +0100 Subject: [PATCH 10/42] Fix: unable to upgrade plan (#14527) * Don't allow admin users to select themselves * Disable upgrade button for non account holders --- .../portal/_components/LockedFeature.svelte | 25 ++++++++++++++++--- .../builder/portal/users/users/index.svelte | 7 ++++-- 2 files changed, 27 insertions(+), 5 deletions(-) diff --git a/packages/builder/src/pages/builder/portal/_components/LockedFeature.svelte b/packages/builder/src/pages/builder/portal/_components/LockedFeature.svelte index e6f4075e2e..1df724099b 100644 --- a/packages/builder/src/pages/builder/portal/_components/LockedFeature.svelte +++ b/packages/builder/src/pages/builder/portal/_components/LockedFeature.svelte @@ -1,10 +1,12 @@ @@ -36,8 +40,9 @@ {:else}
+ {#if upgradeDisabled} + +
+ +
+ + {/if}
{/if} @@ -67,7 +82,11 @@ justify-content: flex-start; gap: var(--spacing-m); } - + .icon { + position: relative; + display: flex; + justify-content: center; + } .buttons { display: flex; flex-direction: row; diff --git a/packages/builder/src/pages/builder/portal/users/users/index.svelte b/packages/builder/src/pages/builder/portal/users/users/index.svelte index b91b2129e6..a1d5496ff6 100644 --- a/packages/builder/src/pages/builder/portal/users/users/index.svelte +++ b/packages/builder/src/pages/builder/portal/users/users/index.svelte @@ -127,7 +127,10 @@ name: user.firstName ? user.firstName + " " + user.lastName : "", userGroups, __selectable: - role.value === Constants.BudibaseRoles.Owner ? false : undefined, + role.value === Constants.BudibaseRoles.Owner || + $auth.user?.email === user.email + ? false + : true, apps: [...new Set(Object.keys(user.roles))], access: role.sortOrder, } @@ -392,7 +395,7 @@ allowSelectRows={!readonly} {customRenderers} loading={!$fetch.loaded || !groupsLoaded} - defaultSortColumn={"access"} + defaultSortColumn={"__selectable"} />