Merge branch 'master' into fix/app-list-layout

deanhannigan · web-flow · commit eb98294d9ffe · 2025-08-20T14:22:48.000+01:00
diff --git a/lerna.json b/lerna.json
@@ -1,6 +1,6 @@
 {
   "$schema": "node_modules/lerna/schemas/lerna-schema.json",
-  "version": "3.16.1",
+  "version": "3.17.1",
   "npmClient": "yarn",
   "concurrency": 20,
   "command": {
diff --git a/packages/backend-core/src/constants/db.ts b/packages/backend-core/src/constants/db.ts
@@ -1,4 +1,9 @@
-import { prefixed, DocumentType } from "@budibase/types"
+import {
+  prefixed,
+  DocumentType,
+  SEPARATOR,
+  InternalTable,
+} from "@budibase/types"
 
 export {
   SEPARATOR,
@@ -78,6 +83,7 @@ export const DEFAULT_INVENTORY_TABLE_ID = "ta_bb_inventory"
 export const DEFAULT_EXPENSES_TABLE_ID = "ta_bb_expenses"
 export const DEFAULT_EMPLOYEE_TABLE_ID = "ta_bb_employee"
 export { DEFAULT_BB_DATASOURCE_ID } from "@budibase/shared-core"
+export const USER_METADATA_PREFIX = `${DocumentType.ROW}${SEPARATOR}${InternalTable.USER_METADATA}${SEPARATOR}`
 
 export const enum DesignDocuments {
   SQLITE = SQLITE_DESIGN_DOC_ID,
diff --git a/packages/backend-core/src/db/Replication.ts b/packages/backend-core/src/db/Replication.ts
@@ -1,13 +1,15 @@
 import PouchDB from "pouchdb"
-import { getPouchDB, closePouchDB } from "./couch"
-import { DocumentType, Document } from "@budibase/types"
-import { DesignDocuments } from "../constants"
+import { closePouchDB, getPouchDB } from "./couch"
+import { Document, DocumentType } from "@budibase/types"
+import { DesignDocuments, SEPARATOR, USER_METADATA_PREFIX } from "../constants"
 
 enum ReplicationDirection {
   TO_PRODUCTION = "toProduction",
   TO_DEV = "toDev",
 }
 
+type DocumentWithID = Omit<Document, "_id"> & { _id: string }
+
 class Replication {
   source: PouchDB.Database
   target: PouchDB.Database
@@ -78,33 +80,38 @@ class Replication {
       tableSyncList = tablesToSync
     }
 
-    const isData = (_id?: string) =>
-      _id?.startsWith(DocumentType.ROW) || _id?.startsWith(DocumentType.LINK)
+    const startsWithID = (_id: string, documentType: string) => {
+      return _id?.startsWith(documentType + SEPARATOR)
+    }
+
+    const isData = (_id: string) =>
+      startsWithID(_id, DocumentType.ROW) ||
+      startsWithID(_id, DocumentType.LINK)
 
     return {
       ...opts,
-      filter: (doc: Document, params: any) => {
+      filter: (doc: DocumentWithID, params: any) => {
         if (!isCreation && doc._id === DesignDocuments.MIGRATIONS) {
           return false
         }
         // don't sync design documents
-        if (toDev && doc._id?.startsWith("_design")) {
+        if (toDev && doc._id.startsWith("_design")) {
           return false
         }
         // always replicate deleted documents
         if (doc._deleted) {
           return true
         }
-        if (
-          isData(doc._id) &&
-          (tableSyncList?.find(id => doc._id?.includes(id)) || syncAllTables)
-        ) {
+        // always sync users from dev
+        if (startsWithID(doc._id, USER_METADATA_PREFIX)) {
           return true
         }
         if (isData(doc._id)) {
-          return false
+          return (
+            !!tableSyncList?.find(id => doc._id.includes(id)) || syncAllTables
+          )
         }
-        if (doc._id?.startsWith(DocumentType.AUTOMATION_LOG)) {
+        if (startsWithID(doc._id, DocumentType.AUTOMATION_LOG)) {
           return false
         }
         if (doc._id === DocumentType.APP_METADATA) {
diff --git a/packages/server/package.json b/packages/server/package.json
@@ -88,7 +88,7 @@
     "google-spreadsheet": "npm:@budibase/google-spreadsheet@4.1.5",
     "http-graceful-shutdown": "^3.1.12",
     "ioredis": "5.3.2",
-    "isolated-vm": "^5.0.1",
+    "isolated-vm": "^6.0.1",
     "jimp": "1.1.4",
     "joi": "17.6.0",
     "js-yaml": "4.1.0",
diff --git a/packages/server/src/api/controllers/deploy/index.ts b/packages/server/src/api/controllers/deploy/index.ts
@@ -251,6 +251,9 @@ export const publishApp = async function (
         replication.appReplicateOpts({
           isCreation: !isPublished,
           tablesToSync,
+          // don't use checkpoints, this can stop data that was previous ignored
+          // getting written - if not seeding tables we don't need to worry about it
+          checkpoint: !seedProductionTables,
         })
       )
       // app metadata is excluded as it is likely to be in conflict
diff --git a/packages/server/src/api/routes/tests/application.spec.ts b/packages/server/src/api/routes/tests/application.spec.ts
@@ -17,6 +17,7 @@ import env from "../../../environment"
 import {
   type App,
   BuiltinPermissionID,
+  PermissionLevel,
   Screen,
   WorkspaceApp,
 } from "@budibase/types"
@@ -1101,6 +1102,47 @@ describe.each([false, true])(
           ).toBeUndefined()
         })
       })
+
+      it("should publish table permissions for custom roles correctly", async () => {
+        // Create a table for testing permissions
+        const table = await config.api.table.save(basicTable())
+        expect(table._id).toBeDefined()
+
+        // Create a custom role
+        const customRole = await config.api.roles.save({
+          name: "TestRole",
+          inherits: "PUBLIC",
+          permissionId: BuiltinPermissionID.READ_ONLY,
+          version: "name",
+        })
+        expect(customRole._id).toBeDefined()
+
+        // Add READ permission for the custom role on the table
+        await config.api.permission.add({
+          roleId: customRole._id!,
+          resourceId: table._id!,
+          level: PermissionLevel.READ,
+        })
+
+        // Verify permissions exist in development
+        const devPermissions = await config.api.permission.get(table._id!)
+        expect(devPermissions.permissions.read.role).toBe(customRole.name)
+
+        // Publish the application
+        await config.publish()
+
+        // Verify permissions are correctly published to production
+        await config.withProdApp(async () => {
+          const prodPermissions = await config.api.permission.get(table._id!)
+          expect(prodPermissions.permissions.read.role).toBe(customRole.name)
+
+          // Also verify the role itself exists in production
+          const roles = await config.api.roles.fetch()
+          const prodRole = roles.find(r => r.name === customRole.name)
+          expect(prodRole).toBeDefined()
+          expect(prodRole!.name).toBe("TestRole")
+        })
+      })
     })
 
     describe("manage client library version", () => {
diff --git a/packages/server/src/jsRunner/vm/isolated-vm.ts b/packages/server/src/jsRunner/vm/isolated-vm.ts
@@ -71,11 +71,11 @@ export class IsolatedVM implements VM {
     })
 
     this.addToContext({
-      helpersStripProtocol: new ivm.Callback((str: string) => {
+      helpersStripProtocol: (str: string) => {
         let parsed = url.parse(str) as any
         parsed.protocol = ""
         return parsed.format()
-      }),
+      },
     })
 
     const injectedRequire = `require=function req(val) {
@@ -222,7 +222,7 @@ export class IsolatedVM implements VM {
       x[funcName] = key
 
       this.addToContext({
-        [key]: new ivm.Callback((...params: any[]) => (func as any)(...params)),
+        [key]: (...params: any[]) => (func as any)(...params),
       })
     }
 
diff --git a/yarn.lock b/yarn.lock
@@ -13474,12 +13474,12 @@ isobject@^4.0.0:
   resolved "https://registry.yarnpkg.com/isobject/-/isobject-4.0.0.tgz#3f1c9155e73b192022a80819bacd0343711697b0"
   integrity sha512-S/2fF5wH8SJA/kmwr6HYhK/RI/OkhD84k8ntalo0iJjZikgq1XFvR5M8NPT1x5F7fBwCG3qHfnzeP/Vh/ZxCUA==
 
-isolated-vm@^5.0.1:
-  version "5.0.1"
-  resolved "https://registry.yarnpkg.com/isolated-vm/-/isolated-vm-5.0.1.tgz#d87b12cf8889e351cb1598a4aeea00bb458bf20c"
-  integrity sha512-hs7+ff59Z2zDvavfcjuot/r1gm6Bmpt+GoZxmVfxUmXaX5scOvUq/Rnme+mUtSh5lW41hH8gAuvk/yTJDYO8Fg==
+isolated-vm@^6.0.1:
+  version "6.0.1"
+  resolved "https://registry.yarnpkg.com/isolated-vm/-/isolated-vm-6.0.1.tgz#37da98080f859ac9b2176d4f9b95c0dd896c9d9c"
+  integrity sha512-rcnfMOYIbRdChFnQbMYsSx/cSfmLJRiw+MlPyz6WdwhaPDB/mfib0pSK+D2COW+KNZKGOGeW6a+qVksL6+X/Bg==
   dependencies:
-    prebuild-install "^7.1.1"
+    prebuild-install "^7.1.3"
 
 isstream@~0.1.2:
   version "0.1.2"
@@ -15985,10 +15985,10 @@ nanoid@^3.3.7:
   resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.7.tgz#d0c301a691bc8d54efa0a2226ccf3fe2fd656bd8"
   integrity sha512-eSRppjcPIatRIMC1U6UngP8XFcz8MQWGQdt1MTBQ7NaAmvXDfvNxbvWV3x2y6CdEUciCSsDHDQZbhYaB8QEo2g==
 
-napi-build-utils@^1.0.1:
-  version "1.0.2"
-  resolved "https://registry.yarnpkg.com/napi-build-utils/-/napi-build-utils-1.0.2.tgz#b1fddc0b2c46e380a0b7a76f984dd47c41a13806"
-  integrity sha512-ONmRUqK7zj7DWX0D9ADe03wbwOBZxNAfF20PlGfCWQcD3+/MakShIHrMqx9YwPTfxDdF1zLeL+RGZiR9kGMLdg==
+napi-build-utils@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/napi-build-utils/-/napi-build-utils-2.0.0.tgz#13c22c0187fcfccce1461844136372a47ddc027e"
+  integrity sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==
 
 napi-macros@~2.0.0:
   version "2.0.0"
@@ -17890,17 +17890,17 @@ preact@^10.19.3:
   resolved "https://registry.yarnpkg.com/preact/-/preact-10.20.1.tgz#1bc598ab630d8612978f7533da45809a8298542b"
   integrity sha512-JIFjgFg9B2qnOoGiYMVBtrcFxHqn+dNXbq76bVmcaHYJFYR4lW67AOcXgAYQQTDYXDOg/kTZrKPNCdRgJ2UJmw==
 
-prebuild-install@^7.1.1:
-  version "7.1.1"
-  resolved "https://registry.yarnpkg.com/prebuild-install/-/prebuild-install-7.1.1.tgz#de97d5b34a70a0c81334fd24641f2a1702352e45"
-  integrity sha512-jAXscXWMcCK8GgCoHOfIr0ODh5ai8mj63L2nWrjuAgXE6tDyYGnx4/8o/rCgU+B4JSyZBKbeZqzhtwtC3ovxjw==
+prebuild-install@^7.1.3:
+  version "7.1.3"
+  resolved "https://registry.yarnpkg.com/prebuild-install/-/prebuild-install-7.1.3.tgz#d630abad2b147443f20a212917beae68b8092eec"
+  integrity sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==
   dependencies:
     detect-libc "^2.0.0"
     expand-template "^2.0.3"
     github-from-package "0.0.0"
     minimist "^1.2.3"
     mkdirp-classic "^0.5.3"
-    napi-build-utils "^1.0.1"
+    napi-build-utils "^2.0.0"
     node-abi "^3.3.0"
     pump "^3.0.0"
     rc "^1.2.7"
@@ -19925,16 +19925,7 @@ string-length@^4.0.1:
     char-regex "^1.0.2"
     strip-ansi "^6.0.0"
 
-"string-width-cjs@npm:string-width@^4.2.0":
-  version "4.2.3"
-  resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010"
-  integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
-  dependencies:
-    emoji-regex "^8.0.0"
-    is-fullwidth-code-point "^3.0.0"
-    strip-ansi "^6.0.1"
-
-"string-width@^1.0.2 || 2 || 3 || 4", string-width@^4.0.0, string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.2, string-width@^4.2.3:
+"string-width-cjs@npm:string-width@^4.2.0", "string-width@^1.0.2 || 2 || 3 || 4", string-width@^4.0.0, string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.2, string-width@^4.2.3:
   version "4.2.3"
   resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010"
   integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
@@ -20026,7 +20017,7 @@ stringify-object@^3.2.1:
     is-obj "^1.0.1"
     is-regexp "^1.0.0"
 
-"strip-ansi-cjs@npm:strip-ansi@^6.0.1":
+"strip-ansi-cjs@npm:strip-ansi@^6.0.1", strip-ansi@^6.0.0, strip-ansi@^6.0.1:
   version "6.0.1"
   resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-6.0.1.tgz#9e26c63d30f53443e9489495b2105d37b67a85d9"
   integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==
@@ -20040,13 +20031,6 @@ strip-ansi@^5.0.0, strip-ansi@^5.1.0, strip-ansi@^5.2.0:
   dependencies:
     ansi-regex "^4.1.0"
 
-strip-ansi@^6.0.0, strip-ansi@^6.0.1:
-  version "6.0.1"
-  resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-6.0.1.tgz#9e26c63d30f53443e9489495b2105d37b67a85d9"
-  integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==
-  dependencies:
-    ansi-regex "^5.0.1"
-
 strip-ansi@^7.0.1:
   version "7.0.1"
   resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-7.0.1.tgz#61740a08ce36b61e50e65653f07060d000975fb2"
@@ -21899,7 +21883,7 @@ worker-farm@1.7.0:
   dependencies:
     errno "~0.1.7"
 
-"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0":
+"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0", wrap-ansi@^7.0.0:
   version "7.0.0"
   resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz#67e145cff510a6a6984bdf1152911d69d2eb9e43"
   integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==
@@ -21917,15 +21901,6 @@ wrap-ansi@^5.1.0:
     string-width "^3.0.0"
     strip-ansi "^5.0.0"
 
-wrap-ansi@^7.0.0:
-  version "7.0.0"
-  resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz#67e145cff510a6a6984bdf1152911d69d2eb9e43"
-  integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==
-  dependencies:
-    ansi-styles "^4.0.0"
-    string-width "^4.1.0"
-    strip-ansi "^6.0.0"
-
 wrap-ansi@^8.1.0:
   version "8.1.0"
   resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-8.1.0.tgz#56dc22368ee570face1b49819975d9b9a5ead214"

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"$schema": "node_modules/lerna/schemas/lerna-schema.json",`
`3`		`- "version": "3.16.1",`
	`3`	`+ "version": "3.17.1",`
`4`	`4`	`"npmClient": "yarn",`
`5`	`5`	`"concurrency": 20,`
`6`	`6`	`"command": {`