Commit Graph

622 Commits

Author SHA1 Message Date
Shrikant Sharat Kandula
140bfed24f
Disable the direct create methods for pages and applications (#109)
* Disable the direct `create` methods for pages and applications
* Create differently named versions of create methods to avoid ambiguity
* Removed unused pageService in DatasourceServiceTest
* Rename createPlain method to createDefault to better convey intent
2020-07-16 15:13:03 +05:30
Trisha Anand
04db3d4242
Bug Fix : Execute Action is not open for execution in public application. (#105)
* Opening the execute path & fetching db without permissions during execute path.
2020-07-15 21:36:35 +05:30
Trisha Anand
936c013b3b
Bug fixes : 401 for public applications + Empty set of actions for get in case cookies is anonymous (#104)
* Bug fixes :
1. Get actions in view mode should be open for unauthorized requests. Fixed that.
2. set transient fields in action is called post fetching all the actions (after taking care of all the permissions). At this point, we shouldnt be using permissions to fetch datasource.
2020-07-15 20:15:10 +05:30
Trisha Anand
20ae5fa546
Adding timeout in ActionViewDTO for the client to use to programmatically timeout on the execution request (#103)
* Adding timeout in ActionViewDTO for the client to use to programmatically timeout on the execution request.
2020-07-15 18:44:55 +05:30
Trisha Anand
6bfed87e40
Added pageId to action view dto (#101)
* Added pageId in the ActionViewDTO and NPE check for setting the json path keys.

* Checking for both json path keys being null and not empty before copying the json path keys into action view dto.
2020-07-15 17:53:38 +05:30
Trisha Anand
212e98c4ba
Fixing test cases failing due to non unique names. (#100) 2020-07-15 16:42:53 +05:30
Arpit Mohan
6c16cba4b9
Adding null checks before encrypting or decrypting the password in AuthenticationDTO object (#99)
This ensures that we don't run in NPE
2020-07-15 16:29:05 +05:30
Arpit Mohan
c15f83dbc3
Adding configuration variables for MAIL_FROM and REPLY_TO in EmailConfig (#97)
The MAIL_FROM & REPLY_TO addresses default to appsmith@localhost. This should be changed in the generated docker.env file during deployment to actual values.

Most email providers will not send emails unless they originate from a valid sender ID.
2020-07-15 15:47:33 +05:30
Trisha Anand
fd0f23b9cc
Database credentials encryption in MongoDB (#80)
* Encrypting the password stored in AuthenticationDTO for every db.

* Adding comment to the properties file to denote that adding encryption salt and password are mandatory to the server coming up.

* Added the encryption salt and password to server.yml to allow the github actions to succeed.

* Adding database migration to encrypt the existing passwords for authentication object (used for storing db connection username/password)

Changes to the installation script install.sh:

1. Instead of overwriting the existing encryption password or salt, giving the user an option to conserve the previous encryption credentials to ensure that the developer users do not lose access to their database configurations (passwords).
2. Added another file for writing encryption credentials (encryption.env) to ensure that we dont delete the encryption password and salt by mistake.
2020-07-14 14:45:08 +05:30
Trisha Anand
56acb5c9fd
New endpoint added to get actions by applicationId in view mode. (#88)
* New endpoint added to get actions by applicationId in view mode. Only id, name and jsonPathKeys are returned in view mode.
2020-07-13 23:27:49 +05:30
Shrikant Sharat Kandula
4796b6edba
Add maven-license-plugin to the project (#73) 2020-07-10 15:58:04 +05:30
Trisha Anand
4a720b80e2
Removing the marketplace basic auth credentials which was hard coded into the code to environment variable. (#71) 2020-07-09 22:38:21 +05:30
Trisha Anand
8734067cad
Resolving the dependabot vulnerabilities. (#69) 2020-07-09 21:12:16 +05:30
Arpit Mohan
ed00c59068 Adding instructions on how to test the code in app/server/README 2020-07-09 17:54:12 +05:30
trishaanand
9eedb15620
Updating anonymous user permissions for application and associated pages & actions when public access is modified (#57)
* On setting an application to public view, correct permissions are assigned to the application and its pages & actions.

* If anonymous user is allowed a certain permission, the all users (anonymous/logged in) should be allowed the certain permission.
2020-07-09 11:21:39 +05:30
trishaanand
53b61b4942
Skeleton code added for changing application view between public and private to help with client development. (#56) 2020-07-08 17:13:42 +05:30
trishaanand
a5a3a5f4a2
Bug fix - In case of invited user signing up on Appsmith, the password is getting doubly hashed leading to sign in breaking for this user. (#51)
* Bug fix is working. Added a test case which is not working.

* Code cleanup. Test case fixed. Now, when we set the user to enabled, we also store the password that has been passed to the flatMap.

* Minor code cleanup.
2020-07-08 13:16:13 +05:30
trishaanand
765f1c7164
Get user profile should return anonymousUser instead of 401 unauthorized in case the API is called without logging in. (#50)
This will help us display the 404 page on the client reliably.
2020-07-08 11:54:00 +05:30
Shrikant Sharat Kandula
ff3c0c0451 Fix column ordering not being consistent in responses from PostgresPlugin 2020-07-07 10:56:56 +05:30
Shrikant Sharat Kandula
8c113834d6
Fix error when dealing with null value columns in Postgres plugin (#46) 2020-07-07 10:52:09 +05:30
trishaanand
c9703ea3b1
Special 404 handling and adding a few paths to the unauthenticated list to allow for public applications (#45)
* 404 error added for a few API calls which would be specially handled on the frontend to display an ACL 404 error.

* Putting everything except GET actions, GET pages, and GET applications behind authenticated. This ensures that in the future public applications (view only) would not lead to 401 but any other page would.

* Code formatted.
2020-07-06 20:21:07 +05:30
Shrikant Sharat Kandula
afe0dfdc75
Dates from Postgres queries now show up as ISO date strings (#5)
* Dates from Postgres queries now show up as ISO date strings
* Use constant for date column name in PostgresPlugin
* Fix formats for more date-time types on Postgres
* Add support for time and timestamp data types in Postgres plugin
* Add support for timestamptz column data type in Postgres plugin
* Add support for interval data type in PostgresPlugin
2020-07-06 18:52:41 +05:30
Shrikant Sharat Kandula
f0658d69b2
Read RapidAPI variables directly form environment (#38) 2020-07-06 14:56:39 +05:30
Shrikant Sharat Kandula
56547ec02f
Move application configuration to be loaded from environment variables (#23)
* Move application configuration to be loaded from environment variables
* Remove unused sentry.properties
* Make missing value sentinel a constant and ignore all *.env files
* Removed now-used ACL properties
* Prefix RapidAPI environment variable with APPSMITH_
* Fix application properties not being loaded into static fields
* Remove application-test.properties file
* Add required env variables for test in GitHub
* Quote URLs for MongoDB and Redis in test config
* Change RAPIDAPI to RAPID_API in environment variable names
* Source .env file in the root of repo in start script
2020-07-06 14:35:56 +05:30
trishaanand
4a05ba6ac5
An invited user on signup should be set to enabled and should not lead to duplicate key exception. (#36) 2020-07-06 12:46:46 +05:30
Arpit Mohan
3035ec9bef
Adding the Github action workflow for the server code (#24)
* Adding the Github action workflow for the server code

* Modifying the redis endpoint in application-test.properties to point to localhost because the Docker service exposes ports to the host
2020-07-03 14:40:57 +05:30
Arpit Mohan
fdeed757ff
Fixing the move action API by removing invocations to subscribe (#17)
* Fixing the move action API by removing invocations to subscribe

Calling subscribe() inside function calls is an anti-pattern and we shouldn't be doing it.
The reactiveContext is not called if the subscribe() function is called in the middle of execution flows. This breaks DB queries.

* Added test case for move action.

Co-authored-by: Trisha Anand <trisha@appsmith.com>
2020-07-02 15:41:45 +05:30
Shrikant Sharat Kandula
0dd1114917
Clean up MongoDB object types before sending data to client (#8) 2020-07-01 16:40:39 +05:30
Shrikant Sharat Kandula
95b9860bf9
Give appropriate error when method is invalid in cURL command (#1) 2020-07-01 12:37:59 +05:30
Trisha Anand
930e577f98 Bug Fix : When page name is updated, the policies should not get overwrritten. Changed the base service function to reset the empty policies to null in case the update is not used to update the policies. 2020-06-27 19:45:24 +00:00
Trisha Anand
76e3db497c Bug fix : Google SSO for sign up led to the organization id for personal organization not getting set up. 2020-06-26 11:59:33 +00:00
Arpit Mohan
bbf0aef450 Merge branch 'bug/embedded-datasource-without-organization-id' into 'release'
When organizationId is null in a datasource, fail with the right error message

The organization id is subsequently used to find a matching plugin (checking for installation essentially), but when organization id is missing, this query never returns. But the error message reads as if the plugin is not installed, whereas it should've been that organization id is missing.

See merge request theappsmith/internal-tools-server!406
2020-06-26 11:43:16 +00:00
Shrikant Kandula
d5921ea52d When organizationId is null in a datasource, fail with the right error message 2020-06-26 11:43:16 +00:00
Trisha Anand
779c79476d Merge branch 'bug/acl-update-role-race-condition' into 'release'
Race condition bug caught in remove user from organization flow where multiple applicaitons/pages/actions exist for an organization.

See merge request theappsmith/internal-tools-server!407
2020-06-25 10:15:07 +00:00
Trisha Anand
57f4f734dd Race condition bug caught in remove user from organization flow where multiple applicaitons/pages/actions exist for an organization. 2020-06-25 15:39:32 +05:30
Shrikant Kandula
3217daab14 Fix Mustache rendering to work on object fields directly 2020-06-25 09:58:20 +00:00
Trisha Anand
6d103b4939 Untested changes for fixing the bug where duplicate policies are getting created for the same permission. 2020-06-25 08:09:59 +00:00
Trisha Anand
a73d182d73 Merge branch 'bug/org-creation' into 'release'
Bug fix : Create Organization is failing because the user is read from the session and not from the repository. Now reading the user at appropriate places.

See merge request theappsmith/internal-tools-server!405
2020-06-24 12:14:25 +00:00
Trisha Anand
aebb50d216 Bug fix : Create Organization is failing because the user is read from the session and not from the repository. Now reading the user at appropriate places. 2020-06-24 17:30:24 +05:30
Arpit Mohan
b63ca6726d Merge branch 'feat/plugin-templates' into 'release'
Add server-side templates support for plugins

Two main themes in this MR:

1. Add support for saving query templates as resource files inside a plugin. This has been done for both Postgres and MongoDB plugins, based on current template contents.
2. Loading of form JSON is now reactive. The blocking call has been moved inside a `Mono.fromSupplier`.
3. The loading of from JSON as well as the templates is cached and are loaded on-demand. This means that the templates are loaded once for a plugin through the lifetime of the server process, and that they are loaded only at the first time they are needed.
4. If loading of these resources fails, we try again when they are needed the next time.

See merge request theappsmith/internal-tools-server!385
2020-06-24 11:08:25 +00:00
Shrikant Kandula
eee2cfcaff Add server-side templates support for plugins 2020-06-24 11:08:25 +00:00
Shrikant Kandula
40b5466bd8 Fill response body with value when running findAndModify Mongo query 2020-06-24 11:05:19 +00:00
Shrikant Kandula
d7655ebb3c Add image location and documentation link fields to plugins 2020-06-24 08:28:54 +00:00
Shrikant Kandula
522e6221f7 Make NO_SSL the default for Mongo datasources 2020-06-24 11:02:34 +05:30
Arpit Mohan
0be492e8e9 Fixing OAuth2 SSO login for new ACL flow 2020-06-23 13:19:22 +00:00
Trisha Anand
cd30e36eaa Hacky solve for setting the action execution request in case of failures in URL/HTTP Method/etc. 2020-06-19 23:43:32 +05:30
Trisha Anand
0603da29ee User test - Add request URL and http method to the execution result 2020-06-19 16:24:58 +00:00
Shrikant Kandula
5ce19962a3 Merge branch 'chore/sending-email-should-be-nonblocking' into 'release'
Sending emails is now done in a non-blocking way

See merge request theappsmith/internal-tools-server!396
2020-06-19 07:14:43 +00:00
Shrikant Kandula
5f0a3034b8 Sending emails is now done in a non-blocking way 2020-06-18 17:29:36 +05:30
Shrikant Kandula
70c312ca40 Merge branch 'bug/disallow-delete-datasource-with-actions' into 'release'
Fail deleting datasource if there's actions against it

See merge request theappsmith/internal-tools-server!388
2020-06-18 10:41:49 +00:00