forked from tsai/budibase
Keviin Åberg Kultalahti
5 years ago
104 changed files with 786 additions and 985 deletions
@ -1 +1,12 @@ |
|||||
# Budibase Authentication Library |
# Budibase Core backend library |
||||
|
|
||||
|
This library contains core functionality, like auth and security features |
||||
|
which are shared between backend services. |
||||
|
|
||||
|
#### Note about top level JS files |
||||
|
For the purposes of being able to do say `require("@budibase/auth/permissions")` we need to |
||||
|
specify the exports at the top-level of the module. |
||||
|
|
||||
|
For these files they should be limited to a single `require` of the file that should |
||||
|
be exported and then a single `module.exports = ...` to export the file in |
||||
|
commonJS. |
||||
@ -0,0 +1 @@ |
|||||
|
module.exports = require("./src/db/utils") |
||||
@ -0,0 +1 @@ |
|||||
|
module.exports = require("./src/security/permissions") |
||||
@ -0,0 +1,4 @@ |
|||||
|
module.exports = { |
||||
|
Client: require("./src/redis"), |
||||
|
utils: require("./src/redis/utils"), |
||||
|
} |
||||
@ -0,0 +1 @@ |
|||||
|
module.exports = require("./src/security/roles") |
||||
@ -0,0 +1,74 @@ |
|||||
|
const { getDB } = require(".") |
||||
|
|
||||
|
class Replication { |
||||
|
/** |
||||
|
* |
||||
|
* @param {String} source - the DB you want to replicate or rollback to |
||||
|
* @param {String} target - the DB you want to replicate to, or rollback from |
||||
|
*/ |
||||
|
constructor({ source, target }) { |
||||
|
this.source = getDB(source) |
||||
|
this.target = getDB(target) |
||||
|
} |
||||
|
|
||||
|
promisify(operation, opts = {}) { |
||||
|
return new Promise(resolve => { |
||||
|
operation(this.target, opts) |
||||
|
.on("denied", function (err) { |
||||
|
// a document failed to replicate (e.g. due to permissions)
|
||||
|
throw new Error(`Denied: Document failed to replicate ${err}`) |
||||
|
}) |
||||
|
.on("complete", function (info) { |
||||
|
return resolve(info) |
||||
|
}) |
||||
|
.on("error", function (err) { |
||||
|
throw new Error(`Replication Error: ${err}`) |
||||
|
}) |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
/** |
||||
|
* Two way replication operation, intended to be promise based. |
||||
|
* @param {Object} opts - PouchDB replication options |
||||
|
*/ |
||||
|
sync(opts) { |
||||
|
this.replication = this.promisify(this.source.sync, opts) |
||||
|
return this.replication |
||||
|
} |
||||
|
|
||||
|
/** |
||||
|
* One way replication operation, intended to be promise based. |
||||
|
* @param {Object} opts - PouchDB replication options |
||||
|
*/ |
||||
|
replicate(opts) { |
||||
|
this.replication = this.promisify(this.source.replicate.to, opts) |
||||
|
return this.replication |
||||
|
} |
||||
|
|
||||
|
/** |
||||
|
* Set up an ongoing live sync between 2 CouchDB databases. |
||||
|
* @param {Object} opts - PouchDB replication options |
||||
|
*/ |
||||
|
subscribe(opts = {}) { |
||||
|
this.replication = this.source.replicate |
||||
|
.to(this.target, { |
||||
|
live: true, |
||||
|
retry: true, |
||||
|
...opts, |
||||
|
}) |
||||
|
.on("error", function (err) { |
||||
|
throw new Error(`Replication Error: ${err}`) |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
async rollback() { |
||||
|
await this.target.destroy() |
||||
|
await this.replicate() |
||||
|
} |
||||
|
|
||||
|
cancel() { |
||||
|
this.replication.cancel() |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
module.exports = Replication |
||||
@ -1,80 +0,0 @@ |
|||||
const AWS = require("aws-sdk") |
|
||||
const fetch = require("node-fetch") |
|
||||
const env = require("../../../environment") |
|
||||
const { |
|
||||
deployToObjectStore, |
|
||||
performReplication, |
|
||||
fetchCredentials, |
|
||||
} = require("./utils") |
|
||||
|
|
||||
/** |
|
||||
* Verifies the users API key and |
|
||||
* Verifies that the deployment fits within the quota of the user |
|
||||
* Links to the "check-api-key" lambda. |
|
||||
* @param {object} deployment - information about the active deployment, including the appId and quota. |
|
||||
*/ |
|
||||
exports.preDeployment = async function (deployment) { |
|
||||
const json = await fetchCredentials(env.DEPLOYMENT_CREDENTIALS_URL, { |
|
||||
apiKey: env.BUDIBASE_API_KEY, |
|
||||
appId: deployment.getAppId(), |
|
||||
quota: deployment.getQuota(), |
|
||||
}) |
|
||||
|
|
||||
// set credentials here, means any time we're verified we're ready to go
|
|
||||
if (json.credentials) { |
|
||||
AWS.config.update({ |
|
||||
accessKeyId: json.credentials.AccessKeyId, |
|
||||
secretAccessKey: json.credentials.SecretAccessKey, |
|
||||
sessionToken: json.credentials.SessionToken, |
|
||||
}) |
|
||||
} |
|
||||
|
|
||||
return json |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* Finalises the deployment, updating the quota for the user API key |
|
||||
* The verification process returns the levels to update to. |
|
||||
* Calls the "deployment-success" lambda. |
|
||||
* @param {object} deployment information about the active deployment, including the quota info. |
|
||||
* @returns {Promise<object>} The usage has been updated against the user API key. |
|
||||
*/ |
|
||||
exports.postDeployment = async function (deployment) { |
|
||||
const DEPLOYMENT_SUCCESS_URL = |
|
||||
env.DEPLOYMENT_CREDENTIALS_URL + "deploy/success" |
|
||||
|
|
||||
const response = await fetch(DEPLOYMENT_SUCCESS_URL, { |
|
||||
method: "POST", |
|
||||
body: JSON.stringify({ |
|
||||
apiKey: env.BUDIBASE_API_KEY, |
|
||||
quota: deployment.getQuota(), |
|
||||
}), |
|
||||
headers: { |
|
||||
"Content-Type": "application/json", |
|
||||
Accept: "application/json", |
|
||||
}, |
|
||||
}) |
|
||||
|
|
||||
if (response.status !== 200) { |
|
||||
throw new Error(`Error updating deployment quota for API Key`) |
|
||||
} |
|
||||
|
|
||||
return await response.json() |
|
||||
} |
|
||||
|
|
||||
exports.deploy = async function (deployment) { |
|
||||
const appId = deployment.getAppId() |
|
||||
const { bucket, accountId } = deployment.getVerification() |
|
||||
const metadata = { accountId } |
|
||||
await deployToObjectStore(appId, bucket, metadata) |
|
||||
} |
|
||||
|
|
||||
exports.replicateDb = async function (deployment) { |
|
||||
const appId = deployment.getAppId() |
|
||||
const verification = deployment.getVerification() |
|
||||
return performReplication( |
|
||||
appId, |
|
||||
verification.couchDbSession, |
|
||||
env.DEPLOYMENT_DB_URL |
|
||||
) |
|
||||
} |
|
||||
@ -1,39 +0,0 @@ |
|||||
const PouchDB = require("../../../db") |
|
||||
const { |
|
||||
DocumentTypes, |
|
||||
SEPARATOR, |
|
||||
UNICODE_MAX, |
|
||||
ViewNames, |
|
||||
} = require("../../../db/utils") |
|
||||
|
|
||||
exports.getAppQuota = async function (appId) { |
|
||||
const db = new PouchDB(appId) |
|
||||
|
|
||||
const rows = await db.allDocs({ |
|
||||
startkey: DocumentTypes.ROW + SEPARATOR, |
|
||||
endkey: DocumentTypes.ROW + SEPARATOR + UNICODE_MAX, |
|
||||
}) |
|
||||
|
|
||||
const users = await db.allDocs({ |
|
||||
startkey: DocumentTypes.USER + SEPARATOR, |
|
||||
endkey: DocumentTypes.USER + SEPARATOR + UNICODE_MAX, |
|
||||
}) |
|
||||
|
|
||||
const existingRows = rows.rows.length |
|
||||
const existingUsers = users.rows.length |
|
||||
|
|
||||
const designDoc = await db.get("_design/database") |
|
||||
|
|
||||
let views = 0 |
|
||||
for (let viewName of Object.keys(designDoc.views)) { |
|
||||
if (Object.values(ViewNames).indexOf(viewName) === -1) { |
|
||||
views++ |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
return { |
|
||||
rows: existingRows, |
|
||||
users: existingUsers, |
|
||||
views: views, |
|
||||
} |
|
||||
} |
|
||||
@ -1,60 +0,0 @@ |
|||||
const AWS = require("aws-sdk") |
|
||||
const { |
|
||||
deployToObjectStore, |
|
||||
performReplication, |
|
||||
fetchCredentials, |
|
||||
} = require("./utils") |
|
||||
const { |
|
||||
getWorkerUrl, |
|
||||
getCouchUrl, |
|
||||
getSelfHostKey, |
|
||||
} = require("../../../utilities/builder/hosting") |
|
||||
|
|
||||
exports.preDeployment = async function () { |
|
||||
const url = `${await getWorkerUrl()}/api/deploy` |
|
||||
try { |
|
||||
const json = await fetchCredentials(url, { |
|
||||
selfHostKey: await getSelfHostKey(), |
|
||||
}) |
|
||||
|
|
||||
// response contains:
|
|
||||
// couchDbSession, bucket, objectStoreSession
|
|
||||
|
|
||||
// set credentials here, means any time we're verified we're ready to go
|
|
||||
if (json.objectStoreSession) { |
|
||||
AWS.config.update({ |
|
||||
accessKeyId: json.objectStoreSession.accessKeyId, |
|
||||
secretAccessKey: json.objectStoreSession.secretAccessKey, |
|
||||
}) |
|
||||
} |
|
||||
|
|
||||
return json |
|
||||
} catch (err) { |
|
||||
throw { |
|
||||
message: "Unauthorised to deploy, check self hosting key", |
|
||||
status: 401, |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
exports.postDeployment = async function () { |
|
||||
// we don't actively need to do anything after deployment in self hosting
|
|
||||
} |
|
||||
|
|
||||
exports.deploy = async function (deployment) { |
|
||||
const appId = deployment.getAppId() |
|
||||
const verification = deployment.getVerification() |
|
||||
// no metadata, aws has account ID in metadata
|
|
||||
const metadata = {} |
|
||||
await deployToObjectStore(appId, verification.bucket, metadata) |
|
||||
} |
|
||||
|
|
||||
exports.replicateDb = async function (deployment) { |
|
||||
const appId = deployment.getAppId() |
|
||||
const verification = deployment.getVerification() |
|
||||
return performReplication( |
|
||||
appId, |
|
||||
verification.couchDbSession, |
|
||||
await getCouchUrl() |
|
||||
) |
|
||||
} |
|
||||
@ -1,136 +0,0 @@ |
|||||
const { join } = require("../../../utilities/centralPath") |
|
||||
const fs = require("fs") |
|
||||
const { budibaseAppsDir } = require("../../../utilities/budibaseDir") |
|
||||
const fetch = require("node-fetch") |
|
||||
const PouchDB = require("../../../db") |
|
||||
const CouchDB = require("pouchdb") |
|
||||
const { upload } = require("../../../utilities/fileSystem") |
|
||||
const { attachmentsRelativeURL } = require("../../../utilities") |
|
||||
|
|
||||
// TODO: everything in this file is to be removed
|
|
||||
|
|
||||
function walkDir(dirPath, callback) { |
|
||||
for (let filename of fs.readdirSync(dirPath)) { |
|
||||
const filePath = `${dirPath}/${filename}` |
|
||||
const stat = fs.lstatSync(filePath) |
|
||||
|
|
||||
if (stat.isFile()) { |
|
||||
callback(filePath) |
|
||||
} else { |
|
||||
walkDir(filePath, callback) |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
exports.fetchCredentials = async function (url, body) { |
|
||||
const response = await fetch(url, { |
|
||||
method: "POST", |
|
||||
body: JSON.stringify(body), |
|
||||
headers: { "Content-Type": "application/json" }, |
|
||||
}) |
|
||||
|
|
||||
const json = await response.json() |
|
||||
if (json.errors) { |
|
||||
throw new Error(json.errors) |
|
||||
} |
|
||||
|
|
||||
if (response.status !== 200) { |
|
||||
throw new Error( |
|
||||
`Error fetching temporary credentials: ${JSON.stringify(json)}` |
|
||||
) |
|
||||
} |
|
||||
|
|
||||
return json |
|
||||
} |
|
||||
|
|
||||
exports.prepareUpload = async function ({ s3Key, bucket, metadata, file }) { |
|
||||
const response = await upload({ |
|
||||
bucket, |
|
||||
metadata, |
|
||||
filename: s3Key, |
|
||||
path: file.path, |
|
||||
type: file.type, |
|
||||
}) |
|
||||
|
|
||||
// don't store a URL, work this out on the way out as the URL could change
|
|
||||
return { |
|
||||
size: file.size, |
|
||||
name: file.name, |
|
||||
url: attachmentsRelativeURL(response.Key), |
|
||||
extension: [...file.name.split(".")].pop(), |
|
||||
key: response.Key, |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
exports.deployToObjectStore = async function (appId, bucket, metadata) { |
|
||||
const appAssetsPath = join(budibaseAppsDir(), appId, "public") |
|
||||
|
|
||||
let uploads = [] |
|
||||
|
|
||||
// Upload HTML, CSS and JS for each page of the web app
|
|
||||
walkDir(appAssetsPath, function (filePath) { |
|
||||
const filePathParts = filePath.split("/") |
|
||||
const appAssetUpload = exports.prepareUpload({ |
|
||||
bucket, |
|
||||
file: { |
|
||||
path: filePath, |
|
||||
name: filePathParts.pop(), |
|
||||
}, |
|
||||
s3Key: filePath.replace(appAssetsPath, `assets/${appId}`), |
|
||||
metadata, |
|
||||
}) |
|
||||
uploads.push(appAssetUpload) |
|
||||
}) |
|
||||
|
|
||||
// Upload file attachments
|
|
||||
const db = new PouchDB(appId) |
|
||||
let fileUploads |
|
||||
try { |
|
||||
fileUploads = await db.get("_local/fileuploads") |
|
||||
} catch (err) { |
|
||||
fileUploads = { _id: "_local/fileuploads", uploads: [] } |
|
||||
} |
|
||||
|
|
||||
for (let file of fileUploads.uploads) { |
|
||||
if (file.uploaded) continue |
|
||||
|
|
||||
const attachmentUpload = exports.prepareUpload({ |
|
||||
file, |
|
||||
s3Key: `assets/${appId}/attachments/${file.processedFileName}`, |
|
||||
bucket, |
|
||||
metadata, |
|
||||
}) |
|
||||
|
|
||||
uploads.push(attachmentUpload) |
|
||||
|
|
||||
// mark file as uploaded
|
|
||||
file.uploaded = true |
|
||||
} |
|
||||
|
|
||||
db.put(fileUploads) |
|
||||
|
|
||||
try { |
|
||||
return await Promise.all(uploads) |
|
||||
} catch (err) { |
|
||||
console.error("Error uploading budibase app assets to s3", err) |
|
||||
throw err |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
exports.performReplication = (appId, session, dbUrl) => { |
|
||||
return new Promise((resolve, reject) => { |
|
||||
const local = new PouchDB(appId) |
|
||||
|
|
||||
const remote = new CouchDB(`${dbUrl}/${appId}`, { |
|
||||
fetch: function (url, opts) { |
|
||||
opts.headers.set("Cookie", `${session};`) |
|
||||
return CouchDB.fetch(url, opts) |
|
||||
}, |
|
||||
}) |
|
||||
|
|
||||
const replication = local.sync(remote) |
|
||||
|
|
||||
replication.on("complete", () => resolve()) |
|
||||
replication.on("error", err => reject(err)) |
|
||||
}) |
|
||||
} |
|
||||
@ -1,86 +0,0 @@ |
|||||
const CouchDB = require("../../db") |
|
||||
const { StaticDatabases } = require("../../db/utils") |
|
||||
const { getDeployedApps } = require("../../utilities/workerRequests") |
|
||||
|
|
||||
const PROD_HOSTING_URL = "app.budi.live" |
|
||||
|
|
||||
function getProtocol(hostingInfo) { |
|
||||
return hostingInfo.useHttps ? "https://" : "http://" |
|
||||
} |
|
||||
|
|
||||
async function getURLWithPath(pathIfSelfHosted) { |
|
||||
const hostingInfo = await exports.getHostingInfo() |
|
||||
const protocol = getProtocol(hostingInfo) |
|
||||
const path = |
|
||||
hostingInfo.type === exports.HostingTypes.SELF ? pathIfSelfHosted : "" |
|
||||
return `${protocol}${hostingInfo.hostingUrl}${path}` |
|
||||
} |
|
||||
|
|
||||
exports.HostingTypes = { |
|
||||
CLOUD: "cloud", |
|
||||
SELF: "self", |
|
||||
} |
|
||||
|
|
||||
exports.getHostingInfo = async () => { |
|
||||
const db = new CouchDB(StaticDatabases.BUILDER_HOSTING.name) |
|
||||
let doc |
|
||||
try { |
|
||||
doc = await db.get(StaticDatabases.BUILDER_HOSTING.baseDoc) |
|
||||
} catch (err) { |
|
||||
// don't write this doc, want to be able to update these default props
|
|
||||
// for our servers with a new release without needing to worry about state of
|
|
||||
// PouchDB in peoples installations
|
|
||||
doc = { |
|
||||
_id: StaticDatabases.BUILDER_HOSTING.baseDoc, |
|
||||
type: exports.HostingTypes.CLOUD, |
|
||||
hostingUrl: PROD_HOSTING_URL, |
|
||||
selfHostKey: "", |
|
||||
templatesUrl: "prod-budi-templates.s3-eu-west-1.amazonaws.com", |
|
||||
useHttps: true, |
|
||||
} |
|
||||
} |
|
||||
return doc |
|
||||
} |
|
||||
|
|
||||
exports.getAppUrl = async appId => { |
|
||||
const hostingInfo = await exports.getHostingInfo() |
|
||||
const protocol = getProtocol(hostingInfo) |
|
||||
let url |
|
||||
if (hostingInfo.type === exports.HostingTypes.CLOUD) { |
|
||||
url = `${protocol}${appId}.${hostingInfo.hostingUrl}` |
|
||||
} else { |
|
||||
url = `${protocol}${hostingInfo.hostingUrl}/app` |
|
||||
} |
|
||||
return url |
|
||||
} |
|
||||
|
|
||||
exports.getWorkerUrl = async () => { |
|
||||
return getURLWithPath("/worker") |
|
||||
} |
|
||||
|
|
||||
exports.getMinioUrl = async () => { |
|
||||
return getURLWithPath("/") |
|
||||
} |
|
||||
|
|
||||
exports.getCouchUrl = async () => { |
|
||||
return getURLWithPath("/db") |
|
||||
} |
|
||||
|
|
||||
exports.getSelfHostKey = async () => { |
|
||||
const hostingInfo = await exports.getHostingInfo() |
|
||||
return hostingInfo.selfHostKey |
|
||||
} |
|
||||
|
|
||||
exports.getTemplatesUrl = async (appId, type, name) => { |
|
||||
const hostingInfo = await exports.getHostingInfo() |
|
||||
const protocol = getProtocol(hostingInfo) |
|
||||
let path |
|
||||
if (type && name) { |
|
||||
path = `templates/type/${name}.tar.gz` |
|
||||
} else { |
|
||||
path = "manifest.json" |
|
||||
} |
|
||||
return `${protocol}${hostingInfo.templatesUrl}/${path}` |
|
||||
} |
|
||||
|
|
||||
exports.getDeployedApps = getDeployedApps |
|
||||
@ -0,0 +1,54 @@ |
|||||
|
const { Client, utils } = require("@budibase/auth/redis") |
||||
|
const { getGlobalIDFromUserMetadataID } = require("../db/utils") |
||||
|
|
||||
|
const APP_DEV_LOCK_SECONDS = 600 |
||||
|
const DB_NAME = utils.Databases.DEV_LOCKS |
||||
|
let devAppClient |
||||
|
|
||||
|
// we init this as we want to keep the connection open all the time
|
||||
|
// reduces the performance hit
|
||||
|
exports.init = async () => { |
||||
|
devAppClient = await new Client(DB_NAME).init() |
||||
|
} |
||||
|
|
||||
|
exports.doesUserHaveLock = async (devAppId, user) => { |
||||
|
const value = await devAppClient.get(devAppId) |
||||
|
if (!value) { |
||||
|
return true |
||||
|
} |
||||
|
// make sure both IDs are global
|
||||
|
const expected = getGlobalIDFromUserMetadataID(value._id) |
||||
|
const userId = getGlobalIDFromUserMetadataID(user._id) |
||||
|
return expected === userId |
||||
|
} |
||||
|
|
||||
|
exports.getAllLocks = async () => { |
||||
|
const locks = await devAppClient.scan() |
||||
|
return locks.map(lock => ({ |
||||
|
appId: lock.key, |
||||
|
user: lock.value, |
||||
|
})) |
||||
|
} |
||||
|
|
||||
|
exports.updateLock = async (devAppId, user) => { |
||||
|
// make sure always global user ID
|
||||
|
const globalId = getGlobalIDFromUserMetadataID(user._id) |
||||
|
const inputUser = { |
||||
|
...user, |
||||
|
userId: globalId, |
||||
|
_id: globalId, |
||||
|
} |
||||
|
await devAppClient.store(devAppId, inputUser, APP_DEV_LOCK_SECONDS) |
||||
|
} |
||||
|
|
||||
|
exports.clearLock = async (devAppId, user) => { |
||||
|
const value = await devAppClient.get(devAppId) |
||||
|
if (!value) { |
||||
|
return |
||||
|
} |
||||
|
const userId = getGlobalIDFromUserMetadataID(user._id) |
||||
|
if (value._id !== userId) { |
||||
|
throw "User does not hold lock, cannot clear it." |
||||
|
} |
||||
|
await devAppClient.delete(devAppId) |
||||
|
} |
||||
@ -0,0 +1,24 @@ |
|||||
|
const { getAllRoles } = require("@budibase/auth/roles") |
||||
|
const { getAllApps } = require("@budibase/auth/db") |
||||
|
|
||||
|
exports.fetch = async ctx => { |
||||
|
// always use the dev apps as they'll be most up to date (true)
|
||||
|
const apps = await getAllApps(true) |
||||
|
const promises = [] |
||||
|
for (let app of apps) { |
||||
|
promises.push(getAllRoles(app._id)) |
||||
|
} |
||||
|
const roles = await Promise.all(promises) |
||||
|
const response = {} |
||||
|
for (let app of apps) { |
||||
|
response[app._id] = roles.shift() |
||||
|
} |
||||
|
ctx.body = response |
||||
|
} |
||||
|
|
||||
|
exports.find = async ctx => { |
||||
|
const appId = ctx.params.appId |
||||
|
ctx.body = { |
||||
|
roles: await getAllRoles(appId) |
||||
|
} |
||||
|
} |
||||
Some files were not shown because too many files changed in this diff
Loading…
Reference in new issue