WIP

MarceloRGonc · MarceloRGonc · commit 657e5d611c01 · 2025-11-25T14:21:41.000Z
diff --git a/compose.yaml b/compose.yaml
@@ -2,7 +2,7 @@ name: openopsdev
 services:
   tables:
     container_name: tables
-    image: public.ecr.aws/openops/openops-tables:0.2.10
+    image: 535002847982.dkr.ecr.us-east-2.amazonaws.com/openops/openops-tables:mg-OPS-3123-2
     environment:
       BASEROW_PUBLIC_URL: ${OPS_OPENOPS_TABLES_PUBLIC_URL}
       BASEROW_PRIVATE_URL: http://localhost:3001
diff --git a/packages/openops/src/index.ts b/packages/openops/src/index.ts
@@ -43,6 +43,7 @@ export * from './lib/openops-tables/fields';
 export * from './lib/openops-tables/filters';
 export * from './lib/openops-tables/openops-tables-common-properties';
 export * from './lib/openops-tables/requests-helpers';
+export * from './lib/openops-tables/reset-user-password';
 export * from './lib/openops-tables/rows';
 export * from './lib/openops-tables/tables';
 export * from './lib/openops-tables/types';
diff --git a/packages/openops/src/lib/openops-tables/auth-user.ts b/packages/openops/src/lib/openops-tables/auth-user.ts
@@ -1,14 +1,6 @@
-import { AppSystemProp, cacheWrapper, system } from '@openops/server-shared';
 import { AxiosHeaders } from 'axios';
 import { IAxiosRetryConfig } from 'axios-retry';
 import { makeOpenOpsTablesPost } from './requests-helpers';
-const tokenLifetimeMinutes = system.getNumber(
-  AppSystemProp.TABLES_TOKEN_LIFETIME_MINUTES,
-);
-
-const tokenLifetimeSeconds = tokenLifetimeMinutes
-  ? (tokenLifetimeMinutes - 10) * 60 // Subtract 10 minutes to ensure the cache expired before the token
-  : undefined;
 
 export interface AuthTokens {
   token: string;
@@ -36,29 +28,3 @@ export async function authenticateUserInOpenOpsTables(
     axiosRetryConfig,
   );
 }
-
-export async function authenticateDefaultUserInOpenOpsTables(
-  axiosRetryConfig?: IAxiosRetryConfig,
-): Promise<AuthTokens> {
-  const cacheKey = 'openops-tables-token';
-
-  let tokens = await cacheWrapper.getSerializedObject<AuthTokens>(cacheKey);
-
-  if (!tokens) {
-    const email = system.getOrThrow(AppSystemProp.OPENOPS_ADMIN_EMAIL);
-    const password = system.getOrThrow(AppSystemProp.OPENOPS_ADMIN_PASSWORD);
-
-    tokens = await authenticateUserInOpenOpsTables(
-      email,
-      password,
-      axiosRetryConfig,
-    );
-    await cacheWrapper.setSerializedObject(
-      cacheKey,
-      tokens,
-      tokenLifetimeSeconds,
-    );
-  }
-
-  return tokens;
-}
diff --git a/packages/openops/src/lib/openops-tables/context-helpers.ts b/packages/openops/src/lib/openops-tables/context-helpers.ts
@@ -1,6 +1,5 @@
 import { ServerContext } from '@openops/blocks-framework';
 import { AppSystemProp, encryptUtils, system } from '@openops/server-shared';
-import { authenticateDefaultUserInOpenOpsTables } from './auth-user';
 
 export function shouldUseDatabaseToken(): boolean {
   return system.getBoolean(AppSystemProp.ENABLE_TABLES_DATABASE_TOKEN) ?? false;
@@ -15,15 +14,15 @@ export type TablesServerContext = Pick<
 export async function resolveTokenProvider(
   serverContext: TablesServerContext,
 ): Promise<TokenOrResolver> {
-  if (shouldUseDatabaseToken()) {
-    return {
-      getToken: () => {
+  // if (shouldUseDatabaseToken()) {
+  return {
+    getToken: () => {
         const { tablesDatabaseToken } = serverContext;
-        return encryptUtils.decryptString(tablesDatabaseToken);
-      },
-    };
-  }
+      return encryptUtils.decryptString(tablesDatabaseToken);
+    },
+  };
+  // }
 
-  const { token } = await authenticateDefaultUserInOpenOpsTables();
-  return token;
+  // const { token } = await authenticateDefaultUserInOpenOpsTables();
+  // return token;
 }
diff --git a/packages/openops/src/lib/openops-tables/reset-user-password.ts b/packages/openops/src/lib/openops-tables/reset-user-password.ts
@@ -0,0 +1,16 @@
+import { createAxiosHeaders, makeOpenOpsTablesPatch } from './requests-helpers';
+
+export async function resetUserPassword(
+  email: string,
+  password: string,
+  token: string,
+): Promise<void> {
+  const payload = {
+    username: email,
+    password,
+  };
+
+  const headers = createAxiosHeaders(token);
+
+  await makeOpenOpsTablesPatch<void>('api/admin/users/', payload, headers);
+}
diff --git a/packages/server/api/src/app/ai/mcp/tables-tools.ts b/packages/server/api/src/app/ai/mcp/tables-tools.ts
@@ -1,14 +1,12 @@
-import {
-  authenticateDefaultUserInOpenOpsTables,
-  createAxiosHeaders,
-} from '@openops/common';
+import { createAxiosHeaders } from '@openops/common';
 import { AppSystemProp, system } from '@openops/server-shared';
 import { experimental_createMCPClient as createMCPClient, ToolSet } from 'ai';
+import { authenticateAdminUserInOpenOpsTables } from '../../database/seeds/auth-tables';
 import { openopsTables } from '../../openops-tables';
 import { MCPTool } from './types';
 
 export async function getTablesTools(): Promise<MCPTool> {
-  const { token } = await authenticateDefaultUserInOpenOpsTables();
+  const { token } = await authenticateAdminUserInOpenOpsTables();
   const mcpEndpoint = await openopsTables.getMcpEndpointList(token);
   if (!mcpEndpoint) {
     return {
diff --git a/packages/server/api/src/app/authentication/basic/authentication-service.ts b/packages/server/api/src/app/authentication/basic/authentication-service.ts
@@ -38,7 +38,7 @@ export const authenticationService = {
 
     const { refresh_token } = await authenticateUserInOpenOpsTables(
       request.email,
-      request.password,
+      user.password,
     );
 
     return this.authResponse(user, refresh_token);
diff --git a/packages/server/api/src/app/authentication/new-user/create-user.ts b/packages/server/api/src/app/authentication/new-user/create-user.ts
@@ -122,7 +122,7 @@ export async function createUser(
     const tablesRefreshToken = await createTablesUser(
       name,
       params.email,
-      params.password,
+      user.password,
     );
 
     return {
diff --git a/packages/server/api/src/app/authentication/new-user/organization-assignment.ts b/packages/server/api/src/app/authentication/new-user/organization-assignment.ts
@@ -1,6 +1,6 @@
-import { authenticateDefaultUserInOpenOpsTables } from '@openops/common';
 import { AppSystemProp, system } from '@openops/server-shared';
 import { ApplicationError, ErrorCode, isNil, User } from '@openops/shared';
+import { authenticateAdminUserInOpenOpsTables } from '../../database/seeds/auth-tables';
 import { openopsTables } from '../../openops-tables';
 import { organizationService } from '../../organization/organization.service';
 import { projectService } from '../../project/project-service';
@@ -53,8 +53,7 @@ async function addUserToDefaultWorkspace(values: {
   email: string;
   workspaceId: number;
 }): Promise<void> {
-  const { token: defaultToken } =
-    await authenticateDefaultUserInOpenOpsTables();
+  const { token: defaultToken } = await authenticateAdminUserInOpenOpsTables();
 
   await openopsTables.addUserToWorkspace(defaultToken, {
     ...values,
diff --git a/packages/server/api/src/app/database/migrations/1763394159990-AddTablesTokenToProject.ts b/packages/server/api/src/app/database/migrations/1763394159990-AddTablesTokenToProject.ts
@@ -1,5 +1,5 @@
-import { authenticateDefaultUserInOpenOpsTables } from '@openops/common';
-import { encryptUtils } from '@openops/server-shared';
+import { authenticateUserInOpenOpsTables } from '@openops/common';
+import { AppSystemProp, encryptUtils, system } from '@openops/server-shared';
 import { MigrationInterface, QueryRunner } from 'typeorm';
 import { openopsTables } from '../../openops-tables';
 
@@ -43,7 +43,9 @@ async function createTokensForExistingProjects(
     return;
   }
 
-  const { token } = await authenticateDefaultUserInOpenOpsTables();
+  const adminEmail = system.getOrThrow(AppSystemProp.OPENOPS_ADMIN_EMAIL);
+  const password = system.getOrThrow(AppSystemProp.OPENOPS_ADMIN_PASSWORD);
+  const { token } = await authenticateUserInOpenOpsTables(adminEmail, password);
   for (const record of projects) {
     const newToken = await openopsTables.createDatabaseToken(
       record.tablesWorkspaceId,
diff --git a/packages/server/api/src/app/database/migrations/1763755045436-MigrateTablesUserPassword.ts b/packages/server/api/src/app/database/migrations/1763755045436-MigrateTablesUserPassword.ts
@@ -0,0 +1,41 @@
+import {
+  authenticateUserInOpenOpsTables,
+  resetUserPassword,
+} from '@openops/common';
+import { AppSystemProp, system } from '@openops/server-shared';
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class MigrateTablesUserPassword1763755045436
+  implements MigrationInterface
+{
+  name = 'MigrateTablesUserPassword1763755045436';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    const users = await queryRunner.query(
+      'SELECT "email", "password" FROM "user"',
+    );
+
+    if (users.length === 0) {
+      return;
+    }
+
+    const adminEmail = system.getOrThrow(AppSystemProp.OPENOPS_ADMIN_EMAIL);
+    const password = system.getOrThrow(AppSystemProp.OPENOPS_ADMIN_PASSWORD);
+    const { token } = await authenticateUserInOpenOpsTables(
+      adminEmail,
+      password,
+    );
+
+    for (const record of users) {
+      if (record.email === adminEmail) {
+        continue;
+      }
+
+      await resetUserPassword(record.email, record.password, token);
+    }
+  }
+
+  public async down(_: QueryRunner): Promise<void> {
+    throw new Error('Rollback not implemented');
+  }
+}
diff --git a/packages/server/api/src/app/database/postgres-connection.ts b/packages/server/api/src/app/database/postgres-connection.ts
@@ -38,6 +38,7 @@ import { MigrateAiConfigToAppConnection1759242268873 } from './migrations/175924
 import { AddTestRunActionLimitsToFlowVersion1760429290001 } from './migrations/1760429290001-AddTestRunActionLimitsToFlowVersion';
 import { MoveTablesWorkspaceIdFromOrganizationToProject1760500000000 } from './migrations/1760500000000-MoveTablesWorkspaceIdFromOrganizationToProject';
 import { AddTablesDatabaseTokenToProject1763394159990 } from './migrations/1763394159990-AddTablesTokenToProject';
+import { MigrateTablesUserPassword1763755045436 } from './migrations/1763755045436-MigrateTablesUserPassword';
 
 const getSslConfig = (): boolean | TlsOptions => {
   const useSsl = system.get(AppSystemProp.POSTGRES_USE_SSL);
@@ -84,6 +85,7 @@ const getMigrations = (): (new () => MigrationInterface)[] => {
     AddTestRunActionLimitsToFlowVersion1760429290001,
     MoveTablesWorkspaceIdFromOrganizationToProject1760500000000,
     AddTablesDatabaseTokenToProject1763394159990,
+    MigrateTablesUserPassword1763755045436,
   ];
 };
 
diff --git a/packages/server/api/src/app/database/seeds/auth-tables.ts b/packages/server/api/src/app/database/seeds/auth-tables.ts
@@ -0,0 +1,43 @@
+import { authenticateUserInOpenOpsTables } from '@openops/common';
+import { AppSystemProp, cacheWrapper, system } from '@openops/server-shared';
+import { IAxiosRetryConfig } from 'axios-retry';
+import { userService } from '../../user/user-service';
+
+const tokenLifetimeMinutes = system.getNumber(
+  AppSystemProp.TABLES_TOKEN_LIFETIME_MINUTES,
+);
+
+const tokenLifetimeSeconds = tokenLifetimeMinutes
+  ? (tokenLifetimeMinutes - 10) * 60 // Subtract 10 minutes to ensure the cache expired before the token
+  : undefined;
+
+export type AuthTokens = {
+  token: string;
+  refresh_token: string;
+};
+
+export async function authenticateAdminUserInOpenOpsTables(
+  axiosRetryConfig?: IAxiosRetryConfig,
+): Promise<AuthTokens> {
+  const cacheKey = 'openops-tables-token';
+
+  let tokens = await cacheWrapper.getSerializedObject<AuthTokens>(cacheKey);
+
+  if (!tokens) {
+    const email = system.getOrThrow(AppSystemProp.OPENOPS_ADMIN_EMAIL);
+    const user = await userService.getUserByEmailOrFail({ email });
+
+    tokens = await authenticateUserInOpenOpsTables(
+      email,
+      user.password,
+      axiosRetryConfig,
+    );
+    await cacheWrapper.setSerializedObject(
+      cacheKey,
+      tokens,
+      tokenLifetimeSeconds,
+    );
+  }
+
+  return tokens;
+}
diff --git a/packages/server/api/src/app/database/seeds/create-open-ops-tables-mcp-endpoint.ts b/packages/server/api/src/app/database/seeds/create-open-ops-tables-mcp-endpoint.ts
@@ -1,10 +1,10 @@
-import { authenticateDefaultUserInOpenOpsTables } from '@openops/common';
 import { logger } from '@openops/server-shared';
 import { openopsTables } from '../../openops-tables';
 import { OPENOPS_DEFAULT_WORKSPACE_NAME } from '../../openops-tables/default-workspace-database';
+import { authenticateAdminUserInOpenOpsTables } from './auth-tables';
 
 export const createOpenOpsTablesMcpEndpoint = async () => {
-  const { token } = await authenticateDefaultUserInOpenOpsTables();
+  const { token } = await authenticateAdminUserInOpenOpsTables();
   const mcpEndpoints = await openopsTables.getMcpEndpointList(token);
   const workspace = await openopsTables.getWorkspaceByName(
     token,
diff --git a/packages/server/api/src/app/database/seeds/openops-delete-old-opportunities-table.ts b/packages/server/api/src/app/database/seeds/openops-delete-old-opportunities-table.ts
@@ -1,7 +1,6 @@
 /* TODO: remove this when all environments are migrated */
 
 import {
-  authenticateDefaultUserInOpenOpsTables,
   createAxiosHeaders,
   getTableByName,
   makeOpenOpsTablesDelete,
@@ -11,6 +10,7 @@ import { FlagEntity } from '../../flags/flag.entity';
 import { SEED_OPENOPS_TABLE_NAME } from '../../openops-tables/template-tables/create-opportunities-table';
 import { databaseConnection } from '../database-connection';
 import { getDefaultProjectTablesDatabaseToken } from '../get-default-user-db-token';
+import { authenticateAdminUserInOpenOpsTables } from './auth-tables';
 
 const OPENOPS_OLD_OPPORTUNITIES_TABLE_DELETED = 'OPPORTUNITYDEL1';
 
@@ -53,7 +53,7 @@ export const deleteOldOpportunitiesTable = async (): Promise<void> => {
   }
 
   try {
-    const { token } = await authenticateDefaultUserInOpenOpsTables();
+    const { token } = await authenticateAdminUserInOpenOpsTables();
 
     const table = await getTableByName(
       SEED_OPENOPS_TABLE_NAME,
diff --git a/packages/server/api/src/app/database/seeds/openops-tables-rename-database.ts b/packages/server/api/src/app/database/seeds/openops-tables-rename-database.ts
@@ -6,10 +6,10 @@ import { openopsTables } from '../../openops-tables';
 import { databaseConnection } from '../database-connection';
 
 import {
-  authenticateDefaultUserInOpenOpsTables,
   getDefaultDatabaseId,
   OPENOPS_DEFAULT_DATABASE_NAME,
 } from '@openops/common';
+import { authenticateAdminUserInOpenOpsTables } from './auth-tables';
 
 const OPENOPS_TABLES_DATABASE_RENAMED_FLAG = 'TABLES_DB_RENAMED';
 const isOpenopsTablesDatabaseAlreadyRenamed = async (): Promise<boolean> => {
@@ -39,7 +39,7 @@ export const updateOpenopsTablesDatabase = async (): Promise<void> => {
     return;
   }
 
-  const { token } = await authenticateDefaultUserInOpenOpsTables();
+  const { token } = await authenticateAdminUserInOpenOpsTables();
 
   try {
     const tablesDatabaseId = await getDefaultDatabaseId(
diff --git a/packages/server/api/src/app/database/seeds/seed-admin.ts b/packages/server/api/src/app/database/seeds/seed-admin.ts
diff --git a/packages/server/api/src/app/openops-tables/template-tables/seed-tables-for-templates.ts b/packages/server/api/src/app/openops-tables/template-tables/seed-tables-for-templates.ts
diff --git a/packages/server/api/src/app/user/user-service.ts b/packages/server/api/src/app/user/user-service.ts
