DO DNS API break means this value must atleast be 30

(cherry picked from commit 8cd5c15c2b)

CHANGES

@@ -1631,21 +1631,3 @@
 [4.1.4]
 * Add CLOUDRON_ prefix to MySQL addon variables
 
-[4.1.5]
-* Make the terminal addon button inject variables based on manifest version
-* Preserve addon passwords correctly when using v2 manifest
-* Show error message instead of logging out user when invalid 2FA token is provided
-* Ensure redis vars are renamed with manifest v2
-* Add missing Scaleway Object Storage to restore UI
-* Fix Exoscale endpoints in restore UI
-* Reset the app icon when showing the configure UI
-
-[4.1.6]
-* Fix issue where CLOUDRON_APP_HOSTNAME was incorrectly set
-* Remove chat link from the footer of login screen
-* Add support for oplog tailing in mongodb
-* Fix LDAP not accessible via scheduler containers
-
-[4.1.7]
-* Fix issue where login looped when admin bit was removed
-

migrations/20190703031708-apps-remove-ownerId.js

@@ -1,14 +0,0 @@
-'use strict';
-
-var async = require('async');
-
-exports.up = function(db, callback) {
-    async.series([
-        db.runSql.bind(db, 'ALTER TABLE apps DROP FOREIGN KEY apps_owner_constraint'),
-        db.runSql.bind(db, 'ALTER TABLE apps DROP COLUMN ownerId')
-    ], callback);
-};
-
-exports.down = function(db, callback) {
-    callback();
-};

migrations/schema.sql

@@ -93,6 +93,9 @@ CREATE TABLE IF NOT EXISTS apps(
     oldConfigJson TEXT, // used to pass old config to apptask (configure, restore)
     updateConfigJson TEXT, // used to pass new config to apptask (update)
 
+    ownerId VARCHAR(128),
+
+    FOREIGN KEY(ownerId) REFERENCES users(id),
     PRIMARY KEY(id));
 
 CREATE TABLE IF NOT EXISTS appPortBindings(

package.json

@@ -14,40 +14,40 @@
     "node": ">=4.0.0 <=4.1.1"
   },
   "dependencies": {
-    "@google-cloud/dns": "^1.1.0",
+    "@google-cloud/dns": "^0.9.2",
     "@google-cloud/storage": "^2.5.0",
     "@sindresorhus/df": "^3.1.0",
     "async": "^2.6.2",
-    "aws-sdk": "^2.476.0",
-    "body-parser": "^1.19.0",
+    "aws-sdk": "^2.441.0",
+    "body-parser": "^1.18.3",
     "cloudron-manifestformat": "^2.15.0",
-    "connect": "^3.7.0",
+    "connect": "^3.6.6",
     "connect-ensure-login": "^0.1.1",
     "connect-lastmile": "^1.0.2",
     "connect-timeout": "^1.9.0",
     "cookie-parser": "^1.4.4",
     "cookie-session": "^1.3.3",
-    "cron": "^1.7.1",
-    "csurf": "^1.10.0",
-    "db-migrate": "^0.11.6",
+    "cron": "^1.7.0",
+    "csurf": "^1.9.0",
+    "db-migrate": "^0.11.5",
     "db-migrate-mysql": "^1.1.10",
     "debug": "^4.1.1",
     "dockerode": "^2.5.8",
     "ejs": "^2.6.1",
     "ejs-cli": "^2.0.1",
-    "express": "^4.17.1",
-    "express-session": "^1.16.2",
+    "express": "^4.16.4",
+    "express-session": "^1.16.1",
     "js-yaml": "^3.13.1",
     "json": "^9.0.6",
     "ldapjs": "^1.0.2",
     "lodash": "^4.17.11",
     "lodash.chunk": "^4.2.0",
-    "mime": "^2.4.4",
+    "mime": "^2.4.2",
     "moment-timezone": "^0.5.25",
     "morgan": "^1.9.1",
     "multiparty": "^4.2.1",
     "mysql": "^2.17.1",
-    "nodemailer": "^6.2.1",
+    "nodemailer": "^6.1.1",
     "nodemailer-smtp-transport": "^2.7.4",
     "oauth2orize": "^1.11.0",
     "once": "^1.4.0",
@@ -60,25 +60,25 @@
     "progress-stream": "^2.0.0",
     "proxy-middleware": "^0.15.0",
     "qrcode": "^1.3.3",
-    "readdirp": "^3.0.2",
+    "readdirp": "^3.0.0",
     "request": "^2.88.0",
     "rimraf": "^2.6.3",
     "s3-block-read-stream": "^0.5.0",
     "safetydance": "^0.7.1",
-    "semver": "^6.1.1",
+    "semver": "^6.0.0",
     "showdown": "^1.9.0",
     "speakeasy": "^2.0.0",
     "split": "^1.0.1",
-    "superagent": "^5.0.9",
+    "superagent": "^5.0.2",
     "supererror": "^0.7.2",
     "tar-fs": "github:cloudron-io/tar-fs#ignore_stat_error",
-    "tar-stream": "^2.1.0",
+    "tar-stream": "^2.0.1",
     "tldjs": "^2.3.1",
     "underscore": "^1.9.1",
     "uuid": "^3.3.2",
     "valid-url": "^1.0.9",
-    "validator": "^11.0.0",
-    "ws": "^7.0.0",
+    "validator": "^10.11.0",
+    "ws": "^6.2.1",
     "xml2js": "^0.4.19"
   },
   "devDependencies": {
@@ -88,7 +88,7 @@
     "mocha": "^6.1.4",
     "mock-aws-s3": "git+https://github.com/cloudron-io/mock-aws-s3.git",
     "nock": "^10.0.6",
-    "node-sass": "^4.12.0",
+    "node-sass": "^4.11.0",
     "recursive-readdir": "^2.2.2"
   },
   "scripts": {

scripts/cloudron-support

@@ -13,7 +13,6 @@ HELP_MESSAGE="
 This script collects diagnostic information to help debug server related issues
 
  Options:
-   --admin-login   Login as administrator
    --enable-ssh    Enable SSH access for the Cloudron support team
    --help          Show this message
 "
@@ -26,20 +25,13 @@ fi
 
 enableSSH="false"
 
-args=$(getopt -o "" -l "help,enable-ssh,admin-login" -n "$0" -- "$@")
+args=$(getopt -o "" -l "help,enable-ssh" -n "$0" -- "$@")
 eval set -- "${args}"
 
 while true; do
     case "$1" in
     --help) echo -e "${HELP_MESSAGE}"; exit 0;;
     --enable-ssh) enableSSH="true"; shift;;
-    --admin-login)
-        admin_username=$(mysql -NB -uroot -ppassword -e "SELECT username FROM box.users WHERE admin=1 LIMIT 1" 2>/dev/null)
-        admin_password=$(pwgen -1s 12)
-        printf '{"%s":"%s"}\n' "${admin_username}" "${admin_password}" > /tmp/cloudron_ghost.json
-        echo "Login as ${admin_username} / ${admin_password} . Remove /tmp/cloudron_ghost.json when done."
-        exit 0
-        ;;
     --) break;;
     *) echo "Unknown option $1"; exit 1;;
     esac

src/addons.js

@@ -906,7 +906,7 @@ function setupSendMail(app, options, callback) {
 
     debugApp(app, 'Setting up SendMail');
 
-    appdb.getAddonConfigByName(app.id, 'sendmail', '%MAIL_SMTP_PASSWORD', function (error, existingPassword) {
+    appdb.getAddonConfigByName(app.id, 'sendmail', 'MAIL_SMTP_PASSWORD', function (error, existingPassword) {
         if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);
 
         var password = error ? hat(4 * 48) : existingPassword; // see box#565 for password length
@@ -944,7 +944,7 @@ function setupRecvMail(app, options, callback) {
 
     debugApp(app, 'Setting up recvmail');
 
-    appdb.getAddonConfigByName(app.id, 'recvmail', '%MAIL_IMAP_PASSWORD', function (error, existingPassword) {
+    appdb.getAddonConfigByName(app.id, 'recvmail', 'MAIL_IMAP_PASSWORD', function (error, existingPassword) {
         if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);
 
         var password = error ? hat(4 * 48) : existingPassword;  // see box#565 for password length
@@ -1040,7 +1040,7 @@ function setupMySql(app, options, callback) {
 
     debugApp(app, 'Setting up mysql');
 
-    appdb.getAddonConfigByName(app.id, 'mysql', '%MYSQL_PASSWORD', function (error, existingPassword) {
+    appdb.getAddonConfigByName(app.id, 'mysql', 'MYSQL_PASSWORD', function (error, existingPassword) {
         if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);
 
         const tmp = mysqlDatabaseName(app.id);
@@ -1256,7 +1256,7 @@ function setupPostgreSql(app, options, callback) {
 
     const { database, username } = postgreSqlNames(app.id);
 
-    appdb.getAddonConfigByName(app.id, 'postgresql', '%POSTGRESQL_PASSWORD', function (error, existingPassword) {
+    appdb.getAddonConfigByName(app.id, 'postgresql', 'POSTGRESQL_PASSWORD', function (error, existingPassword) {
         if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);
 
         const data = {
@@ -1431,14 +1431,13 @@ function setupMongoDb(app, options, callback) {
 
     debugApp(app, 'Setting up mongodb');
 
-    appdb.getAddonConfigByName(app.id, 'mongodb', '%MONGODB_PASSWORD', function (error, existingPassword) {
+    appdb.getAddonConfigByName(app.id, 'mongodb', 'MONGODB_PASSWORD', function (error, existingPassword) {
         if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);
 
         const data = {
             database: app.id,
             username: app.id,
-            password: error ? hat(4 * 128) : existingPassword,
-            oplog: !!options.oplog
+            password: error ? hat(4 * 128) : existingPassword
         };
 
         getServiceDetails('mongodb', 'CLOUDRON_MONGODB_TOKEN', function (error, result) {
@@ -1451,7 +1450,7 @@ function setupMongoDb(app, options, callback) {
                 const envPrefix = app.manifest.manifestVersion <= 1 ? '' : 'CLOUDRON_';
 
                 var env = [
-                    { name: `${envPrefix}MONGODB_URL`, value : `mongodb://${data.username}:${data.password}@mongodb:27017/${data.database}` },
+                    { name: `${envPrefix}MONGODB_URL`, value : `mongodb://${data.username}:${data.password}@mongodb/${data.database}` },
                     { name: `${envPrefix}MONGODB_USERNAME`, value : data.username },
                     { name: `${envPrefix}MONGODB_PASSWORD`, value: data.password },
                     { name: `${envPrefix}MONGODB_HOST`, value : 'mongodb' },
@@ -1459,10 +1458,6 @@ function setupMongoDb(app, options, callback) {
                     { name: `${envPrefix}MONGODB_DATABASE`, value : data.database }
                 ];
 
-                if (options.oplog) {
-                    env.push({ name: `${envPrefix}MONGODB_OPLOG_URL`, value : `mongodb://${data.username}:${data.password}@mongodb:27017/local?authSource=${data.database}` });
-                }
-
                 debugApp(app, 'Setting mongodb addon config to %j', env);
                 appdb.setAddonConfig(app.id, 'mongodb', env, callback);
             });
@@ -1569,69 +1564,68 @@ function setupRedis(app, options, callback) {
 
     const redisName = 'redis-' + app.id;
 
-    appdb.getAddonConfigByName(app.id, 'redis', '%REDIS_PASSWORD', function (error, existingPassword) {
-        if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);
-
-        const redisPassword = error ? hat(4 * 48) : existingPassword; // see box#362 for password length
-        const redisServiceToken = hat(4 * 48);
-
-        // Compute redis memory limit based on app's memory limit (this is arbitrary)
-        var memoryLimit = app.memoryLimit || app.manifest.memoryLimit || 0;
-
-        if (memoryLimit === -1) { // unrestricted (debug mode)
-            memoryLimit = 0;
-        } else if (memoryLimit === 0 || memoryLimit <= (2 * 1024 * 1024 * 1024)) { // less than 2G (ram+swap)
-            memoryLimit = 150 * 1024 * 1024; // 150m
-        } else {
-            memoryLimit = 600 * 1024 * 1024; // 600m
+    docker.inspect(redisName, function (error, result) {
+        if (!error) {
+            debug(`Re-using existing redis container with state: ${result.State}`);
+            return callback();
         }
 
-        const tag = infra.images.redis.tag;
-        const label = app.fqdn;
-        // note that we do not add appId label because this interferes with the stop/start app logic
-        const cmd = `docker run --restart=always -d --name=${redisName} \
-                    --hostname ${redisName} \
-                    --label=location=${label} \
-                    --net cloudron \
-                    --net-alias ${redisName} \
-                    --log-driver syslog \
-                    --log-opt syslog-address=udp://127.0.0.1:2514 \
-                    --log-opt syslog-format=rfc5424 \
-                    --log-opt tag="${redisName}" \
-                    -m ${memoryLimit/2} \
-                    --memory-swap ${memoryLimit} \
-                    --dns 172.18.0.1 \
-                    --dns-search=. \
-                    -e CLOUDRON_REDIS_PASSWORD="${redisPassword}" \
-                    -e CLOUDRON_REDIS_TOKEN="${redisServiceToken}" \
-                    -v "${paths.PLATFORM_DATA_DIR}/redis/${app.id}:/var/lib/redis" \
-                    --label isCloudronManaged=true \
-                    --read-only -v /tmp -v /run ${tag}`;
+        appdb.getAddonConfigByName(app.id, 'redis', 'REDIS_PASSWORD', function (error, existingPassword) {
+            if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);
 
-        const envPrefix = app.manifest.manifestVersion <= 1 ? '' : 'CLOUDRON_';
+            const redisPassword = error ? hat(4 * 48) : existingPassword; // see box#362 for password length
+            const redisServiceToken = hat(4 * 48);
 
-        var env = [
-            { name: `${envPrefix}REDIS_URL`, value: 'redis://redisuser:' + redisPassword + '@redis-' + app.id },
-            { name: `${envPrefix}REDIS_PASSWORD`, value: redisPassword },
-            { name: `${envPrefix}REDIS_HOST`, value: redisName },
-            { name: `${envPrefix}REDIS_PORT`, value: '6379' }
-        ];
+            // Compute redis memory limit based on app's memory limit (this is arbitrary)
+            var memoryLimit = app.memoryLimit || app.manifest.memoryLimit || 0;
 
-        async.series([
-            (next) => {
-                docker.inspect(redisName, function (inspectError, result) {
-                    if (!inspectError) {
-                        debug(`Re-using existing redis container with state: ${JSON.stringify(result.State)}`);
-                        return next();
-                    }
-                    shell.exec('startRedis', cmd, next);
-                });
-            },
-            appdb.setAddonConfig.bind(null, app.id, 'redis', env),
-            waitForService.bind(null, 'redis-' + app.id, 'CLOUDRON_REDIS_TOKEN')
-        ], function (error) {
-            if (error) debug('Error setting up redis: ', error);
-            callback(error);
+            if (memoryLimit === -1) { // unrestricted (debug mode)
+                memoryLimit = 0;
+            } else if (memoryLimit === 0 || memoryLimit <= (2 * 1024 * 1024 * 1024)) { // less than 2G (ram+swap)
+                memoryLimit = 150 * 1024 * 1024; // 150m
+            } else {
+                memoryLimit = 600 * 1024 * 1024; // 600m
+            }
+
+            const tag = infra.images.redis.tag;
+            const label = app.fqdn;
+            // note that we do not add appId label because this interferes with the stop/start app logic
+            const cmd = `docker run --restart=always -d --name=${redisName} \
+                        --hostname ${redisName} \
+                        --label=location=${label} \
+                        --net cloudron \
+                        --net-alias ${redisName} \
+                        --log-driver syslog \
+                        --log-opt syslog-address=udp://127.0.0.1:2514 \
+                        --log-opt syslog-format=rfc5424 \
+                        --log-opt tag="${redisName}" \
+                        -m ${memoryLimit/2} \
+                        --memory-swap ${memoryLimit} \
+                        --dns 172.18.0.1 \
+                        --dns-search=. \
+                        -e CLOUDRON_REDIS_PASSWORD="${redisPassword}" \
+                        -e CLOUDRON_REDIS_TOKEN="${redisServiceToken}" \
+                        -v "${paths.PLATFORM_DATA_DIR}/redis/${app.id}:/var/lib/redis" \
+                        --label isCloudronManaged=true \
+                        --read-only -v /tmp -v /run ${tag}`;
+
+            const envPrefix = app.manifest.manifestVersion <= 1 ? '' : 'CLOUDRON_';
+
+            var env = [
+                { name: `${envPrefix}REDIS_URL`, value: 'redis://redisuser:' + redisPassword + '@redis-' + app.id },
+                { name: `${envPrefix}REDIS_PASSWORD`, value: redisPassword },
+                { name: `${envPrefix}REDIS_HOST`, value: redisName },
+                { name: `${envPrefix}REDIS_PORT`, value: '6379' }
+            ];
+
+            async.series([
+                shell.exec.bind(null, 'startRedis', cmd),
+                appdb.setAddonConfig.bind(null, app.id, 'redis', env),
+                waitForService.bind(null, 'redis-' + app.id, 'CLOUDRON_REDIS_TOKEN')
+            ], function (error) {
+                if (error) debug('Error setting up redis: ', error);
+                callback(error);
+            });
         });
     });
 }

src/appdb.js

@@ -25,6 +25,9 @@ exports = module.exports = {
     setRunCommand: setRunCommand,
     getAppStoreIds: getAppStoreIds,
 
+    setOwner: setOwner,
+    transferOwnership: transferOwnership,
+
     // installation codes (keep in sync in UI)
     ISTATE_PENDING_INSTALL: 'pending_install', // installs and fresh reinstalls
     ISTATE_PENDING_CLONE: 'pending_clone', // clone
@@ -67,7 +70,7 @@ var APPS_FIELDS_PREFIXED = [ 'apps.id', 'apps.appStoreId', 'apps.installationSta
     'apps.accessRestrictionJson', 'apps.restoreConfigJson', 'apps.oldConfigJson', 'apps.updateConfigJson', 'apps.memoryLimit',
     'apps.label', 'apps.tagsJson',
     'apps.sso', 'apps.debugModeJson', 'apps.robotsTxt', 'apps.enableBackup',
-    'apps.creationTime', 'apps.updateTime', 'apps.mailboxName', 'apps.enableAutomaticUpdate',
+    'apps.creationTime', 'apps.updateTime', 'apps.ownerId', 'apps.mailboxName', 'apps.enableAutomaticUpdate',
     'apps.dataDir', 'apps.ts', 'apps.healthTime' ].join(',');
 
 var PORT_BINDINGS_FIELDS = [ 'hostPort', 'type', 'environmentVariable', 'appId' ].join(',');
@@ -254,13 +257,14 @@ function getAll(callback) {
     });
 }
 
-function add(id, appStoreId, manifest, location, domain, portBindings, data, callback) {
+function add(id, appStoreId, manifest, location, domain, ownerId, portBindings, data, callback) {
     assert.strictEqual(typeof id, 'string');
     assert.strictEqual(typeof appStoreId, 'string');
     assert(manifest && typeof manifest === 'object');
     assert.strictEqual(typeof manifest.version, 'string');
     assert.strictEqual(typeof location, 'string');
     assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof ownerId, 'string');
     assert.strictEqual(typeof portBindings, 'object');
     assert(data && typeof data === 'object');
     assert.strictEqual(typeof callback, 'function');
@@ -286,10 +290,10 @@ function add(id, appStoreId, manifest, location, domain, portBindings, data, cal
 
     queries.push({
         query: 'INSERT INTO apps (id, appStoreId, manifestJson, installationState, accessRestrictionJson, memoryLimit, '
-            + 'restoreConfigJson, sso, debugModeJson, robotsTxt, mailboxName, label, tagsJson) '
-            + ' VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+            + 'restoreConfigJson, sso, debugModeJson, robotsTxt, ownerId, mailboxName, label, tagsJson) '
+            + ' VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
         args: [ id, appStoreId, manifestJson, installationState, accessRestrictionJson, memoryLimit, restoreConfigJson,
-            sso, debugModeJson, robotsTxt, mailboxName, label, tagsJson ]
+            sso, debugModeJson, robotsTxt, ownerId, mailboxName, label, tagsJson ]
     });
 
     queries.push({
@@ -631,16 +635,44 @@ function getAppIdByAddonConfigValue(addonId, namePattern, value, callback) {
     });
 }
 
-function getAddonConfigByName(appId, addonId, namePattern, callback) {
+function getAddonConfigByName(appId, addonId, name, callback) {
     assert.strictEqual(typeof appId, 'string');
     assert.strictEqual(typeof addonId, 'string');
-    assert.strictEqual(typeof namePattern, 'string');
+    assert.strictEqual(typeof name, 'string');
     assert.strictEqual(typeof callback, 'function');
 
-    database.query('SELECT value FROM appAddonConfigs WHERE appId = ? AND addonId = ? AND name LIKE ?', [ appId, addonId, namePattern ], function (error, results) {
+    database.query('SELECT value FROM appAddonConfigs WHERE appId = ? AND addonId = ? AND name = ?', [ appId, addonId, name ], function (error, results) {
         if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
         if (results.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
 
         callback(null, results[0].value);
     });
 }
+
+function setOwner(appId, ownerId, callback) {
+    assert.strictEqual(typeof appId, 'string');
+    assert.strictEqual(typeof ownerId, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    database.query('UPDATE apps SET ownerId=? WHERE appId=?', [ ownerId, appId ], function (error, results) {
+        if (error && error.code === 'ER_NO_REFERENCED_ROW_2') return callback(new DatabaseError(DatabaseError.NOT_FOUND, 'No such user'));
+        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+
+        if (results.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND, 'No such app'));
+
+        callback(null);
+    });
+}
+
+function transferOwnership(oldOwnerId, newOwnerId, callback) {
+    assert.strictEqual(typeof oldOwnerId, 'string');
+    assert.strictEqual(typeof newOwnerId, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    database.query('UPDATE apps SET ownerId=? WHERE ownerId=?', [ newOwnerId, oldOwnerId ], function (error) {
+        if (error && error.code === 'ER_NO_REFERENCED_ROW_2') return callback(new DatabaseError(DatabaseError.NOT_FOUND, 'No such user'));
+        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+
+        callback(null);
+    });
+}

src/apps.js

@@ -46,6 +46,9 @@ exports = module.exports = {
     downloadFile: downloadFile,
     uploadFile: uploadFile,
 
+    setOwner: setOwner,
+    transferOwnership: transferOwnership,
+
     PORT_TYPE_TCP: 'tcp',
     PORT_TYPE_UDP: 'udp',
 
@@ -381,13 +384,13 @@ function removeInternalFields(app) {
         'location', 'domain', 'fqdn', 'mailboxName',
         'accessRestriction', 'manifest', 'portBindings', 'iconUrl', 'memoryLimit',
         'sso', 'debugMode', 'robotsTxt', 'enableBackup', 'creationTime', 'updateTime', 'ts', 'tags',
-        'label', 'alternateDomains', 'env', 'enableAutomaticUpdate', 'dataDir');
+        'label', 'alternateDomains', 'ownerId', 'env', 'enableAutomaticUpdate', 'dataDir');
 }
 
 // non-admins can only see these
 function removeRestrictedFields(app) {
     return _.pick(app,
-        'id', 'appStoreId', 'installationState', 'installationProgress', 'runState', 'health',
+        'id', 'appStoreId', 'installationState', 'installationProgress', 'runState', 'health', 'ownerId',
         'location', 'domain', 'fqdn', 'manifest', 'portBindings', 'iconUrl', 'creationTime', 'ts', 'tags', 'label');
 }
 
@@ -483,7 +486,6 @@ function getByContainerId(containerId, callback) {
     });
 }
 
-// returns the app associated with this IP (app or scheduler)
 function getByIpAddress(ip, callback) {
     assert.strictEqual(typeof ip, 'string');
     assert.strictEqual(typeof callback, 'function');
@@ -491,14 +493,7 @@ function getByIpAddress(ip, callback) {
     docker.getContainerIdByIp(ip, function (error, containerId) {
         if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, error));
 
-        docker.inspect(containerId, function (error, result) {
-            if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, error));
-
-            const appId = safe.query(result, 'Config.Labels.appId', null);
-            if (!appId) return callback(new AppsError(AppsError.NOT_FOUND, 'No such app'));
-
-            get(appId, callback);
-        });
+        getByContainerId(containerId, callback);
     });
 }
 
@@ -590,6 +585,7 @@ function install(data, user, auditSource, callback) {
         enableAutomaticUpdate = 'enableAutomaticUpdate' in data ? data.enableAutomaticUpdate : true,
         backupId = data.backupId || null,
         backupFormat = data.backupFormat || 'tgz',
+        ownerId = data.ownerId,
         alternateDomains = data.alternateDomains || [],
         env = data.env || {},
         mailboxName = data.mailboxName || '',
@@ -683,7 +679,7 @@ function install(data, user, auditSource, callback) {
                 env: env
             };
 
-            appdb.add(appId, appStoreId, manifest, location, domain, translatePortBindings(portBindings, manifest), data, function (error) {
+            appdb.add(appId, appStoreId, manifest, location, domain, ownerId, translatePortBindings(portBindings, manifest), data, function (error) {
                 if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(getDuplicateErrorDetails(error, location, domainObject, portBindings, data.alternateDomains));
                 if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, error.message));
                 if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, error));
@@ -1076,12 +1072,14 @@ function clone(appId, data, user, auditSource, callback) {
         domain = data.domain.toLowerCase(),
         portBindings = data.portBindings || null,
         backupId = data.backupId,
+        ownerId = data.ownerId,
         mailboxName = data.mailboxName || '';
 
     assert.strictEqual(typeof backupId, 'string');
     assert.strictEqual(typeof location, 'string');
     assert.strictEqual(typeof domain, 'string');
     assert.strictEqual(typeof portBindings, 'object');
+    assert(ownerId === null || typeof ownerId === 'string');
 
     get(appId, function (error, app) {
         if (error) return callback(error);
@@ -1130,7 +1128,7 @@ function clone(appId, data, user, auditSource, callback) {
                     env: app.env
                 };
 
-                appdb.add(newAppId, app.appStoreId, manifest, location, domain, translatePortBindings(portBindings, manifest), data, function (error) {
+                appdb.add(newAppId, app.appStoreId, manifest, location, domain, ownerId, translatePortBindings(portBindings, manifest), data, function (error) {
                     if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(getDuplicateErrorDetails(error, location, domainObject, portBindings, []));
                     if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, error));
 
@@ -1521,3 +1519,28 @@ function uploadFile(appId, sourceFilePath, destFilePath, callback) {
         readFile.pipe(stream);
     });
 }
+
+function setOwner(appId, ownerId, callback) {
+    assert.strictEqual(typeof appId, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    appdb.setOwner(appId, ownerId, function (error) {
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, error.message));
+        if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, error));
+
+        callback();
+    });
+}
+
+function transferOwnership(oldOwnerId, newOwnerId, callback) {
+    assert.strictEqual(typeof oldOwnerId, 'string');
+    assert.strictEqual(typeof newOwnerId, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    appdb.transferOwnership(oldOwnerId, newOwnerId, function (error) {
+        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new AppsError(AppsError.NOT_FOUND, error.message));
+        if (error) return callback(new AppsError(AppsError.INTERNAL_ERROR, error));
+
+        callback();
+    });
+}

src/appstore.js

@@ -32,14 +32,12 @@ var apps = require('./apps.js'),
     debug = require('debug')('box:appstore'),
     domains = require('./domains.js'),
     eventlog = require('./eventlog.js'),
-    groups = require('./groups.js'),
     mail = require('./mail.js'),
     os = require('os'),
     safe = require('safetydance'),
     semver = require('semver'),
     settings = require('./settings.js'),
     superagent = require('superagent'),
-    users = require('./users.js'),
     util = require('util');
 
 function AppstoreError(reason, errorOrMessage) {
@@ -208,7 +206,7 @@ function unpurchaseApp(appId, data, callback) {
 function sendAliveStatus(callback) {
     callback = callback || NOOP_CALLBACK;
 
-    let allSettings, allDomains, mailDomains, loginEvents, userCount, groupCount;
+    var allSettings, allDomains, mailDomains, loginEvents;
 
     async.series([
         function (callback) {
@@ -238,20 +236,6 @@ function sendAliveStatus(callback) {
                 loginEvents = result;
                 callback();
             });
-        },
-        function (callback) {
-            users.count(function (error, result) {
-                if (error) return callback(new AppstoreError(AppstoreError.INTERNAL_ERROR, error));
-                userCount = result;
-                callback();
-            });
-        },
-        function (callback) {
-            groups.count(function (error, result) {
-                if (error) return callback(new AppstoreError(AppstoreError.INTERNAL_ERROR, error));
-                groupCount = result;
-                callback();
-            });
         }
     ], function (error) {
         if (error) return callback(error);
@@ -271,8 +255,6 @@ function sendAliveStatus(callback) {
                 catchAllCount: mailDomains.filter(function (d) { return d.catchAll.length !== 0; }).length,
                 relayProviders: Array.from(new Set(mailDomains.map(function (d) { return d.relay.provider; })))
             },
-            userCount: userCount,
-            groupCount: groupCount,
             appAutoupdatePattern: allSettings[settings.APP_AUTOUPDATE_PATTERN_KEY],
             boxAutoupdatePattern: allSettings[settings.BOX_AUTOUPDATE_PATTERN_KEY],
             timeZone: allSettings[settings.TIME_ZONE_KEY],

src/docker.js

@@ -176,19 +176,18 @@ function createSubcontainer(app, name, cmd, options, callback) {
     assert.strictEqual(typeof callback, 'function');
 
     var docker = exports.connection,
-        isAppContainer = !cmd; // non app-containers are like scheduler and exec (terminal) containers
+        isAppContainer = !cmd; // non app-containers are like scheduler containers
 
     var manifest = app.manifest;
     var exposedPorts = {}, dockerPortBindings = { };
     var domain = app.fqdn;
-    const hostname = isAppContainer ? app.id : name;
 
     const envPrefix = manifest.manifestVersion <= 1 ? '' : 'CLOUDRON_';
 
     let stdEnv = [
         'CLOUDRON=1',
         'CLOUDRON_PROXY_IP=172.18.0.1',
-        `CLOUDRON_APP_HOSTNAME=${app.id}`,
+        `CLOUDRON_APP_HOSTNAME=${name}`,
         `${envPrefix}WEBADMIN_ORIGIN=${config.adminOrigin()}`,
         `${envPrefix}API_ORIGIN=${config.adminOrigin()}`,
         `${envPrefix}APP_ORIGIN=https://${domain}`,
@@ -241,7 +240,7 @@ function createSubcontainer(app, name, cmd, options, callback) {
         var containerOptions = {
             name: name, // for referencing containers
             Tty: isAppContainer,
-            Hostname: hostname,
+            Hostname: name,
             Image: app.manifest.dockerImage,
             Cmd: (isAppContainer && app.debugMode && app.debugMode.cmd) ? app.debugMode.cmd : cmd,
             Env: stdEnv.concat(addonEnv).concat(portEnv).concat(appEnv),

src/groups.js

@@ -20,9 +20,7 @@ exports = module.exports = {
     getGroups: getGroups,
 
     setMembership: setMembership,
-    getMembership: getMembership,
-
-    count: count
+    getMembership: getMembership
 };
 
 var assert = require('assert'),
@@ -270,13 +268,3 @@ function getGroups(userId, callback) {
         callback(null, results);
     });
 }
-
-function count(callback) {
-    assert.strictEqual(typeof callback, 'function');
-
-    groupdb.count(function (error, count) {
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
-
-        callback(null, count);
-    });
-}

src/infra_version.js

@@ -17,7 +17,7 @@ exports = module.exports = {
     'images': {
         'mysql': { repo: 'cloudron/mysql', tag: 'cloudron/mysql:2.0.2@sha256:a28320f313785816be60e3f865e09065504170a3d20ed37de675c719b32b01eb' },
         'postgresql': { repo: 'cloudron/postgresql', tag: 'cloudron/postgresql:2.0.2@sha256:6dcee0731dfb9b013ed94d56205eee219040ee806c7e251db3b3886eaa4947ff' },
-        'mongodb': { repo: 'cloudron/mongodb', tag: 'cloudron/mongodb:2.1.0@sha256:6d1bf221cfe6124957e2c58b57c0a47214353496009296acb16adf56df1da9d5' },
+        'mongodb': { repo: 'cloudron/mongodb', tag: 'cloudron/mongodb:2.0.2@sha256:95e006390ddce7db637e1672eb6f3c257d3c2652747424f529b1dee3cbe6728c' },
         'redis': { repo: 'cloudron/redis', tag: 'cloudron/redis:2.0.0@sha256:8a88dd334b62b578530a014ca1a2425a54cb9df1e475f5d3a36806e5cfa22121' },
         'mail': { repo: 'cloudron/mail', tag: 'cloudron/mail:2.3.1@sha256:9693e3ae42a12a7ac8cf5df94d828d46f5b22b4e2e1c7d1bc614d6ee2a22c365' },
         'graphite': { repo: 'cloudron/graphite', tag: 'cloudron/graphite:2.0.2@sha256:454f035d60b768153d4f31210380271b5ba1c09367c9d95c7fa37f9e39d2f59c' },

src/ldap.js

@@ -135,7 +135,7 @@ function userSearch(req, res, next) {
             var dn = ldap.parseDN('cn=' + entry.id + ',ou=users,dc=cloudron');
 
             var groups = [ GROUP_USERS_DN ];
-            if (entry.admin) groups.push(GROUP_ADMINS_DN);
+            if (entry.admin || req.app.ownerId === entry.id) groups.push(GROUP_ADMINS_DN);
 
             var displayName = entry.displayName || entry.username || ''; // displayName can be empty and username can be null
             var nameParts = displayName.split(' ');
@@ -155,7 +155,7 @@ function userSearch(req, res, next) {
                     givenName: firstName,
                     username: entry.username,
                     samaccountname: entry.username,      // to support ActiveDirectory clients
-                    isadmin: entry.admin,
+                    isadmin: (entry.admin || req.app.ownerId === entry.id) ? 1 : 0,
                     memberof: groups
                 }
             };
@@ -195,7 +195,7 @@ function groupSearch(req, res, next) {
 
         groups.forEach(function (group) {
             var dn = ldap.parseDN('cn=' + group.name + ',ou=groups,dc=cloudron');
-            var members = group.admin ? result.filter(function (entry) { return entry.admin; }) : result;
+            var members = group.admin ? result.filter(function (entry) { return entry.admin || req.app.ownerId === entry.id; }) : result;
 
             var obj = {
                 dn: dn.toString(),
@@ -244,7 +244,7 @@ function groupAdminsCompare(req, res, next) {
         // we only support memberuid here, if we add new group attributes later add them here
         if (req.attribute === 'memberuid') {
             var found = result.find(function (u) { return u.id === req.value; });
-            if (found && found.admin) return res.end(true);
+            if (found && (found.admin || req.app.ownerId == found.id)) return res.end(true);
         }
 
         res.end(false);

src/mail.js

@@ -126,6 +126,7 @@ function checkOutboundPort25(callback) {
         'smtp.gmail.com',
         'smtp.live.com',
         'smtp.mail.yahoo.com',
+        'smtp.o2.ie',
         'smtp.comcast.net',
         'smtp.1und1.de',
     ]);

src/oauth2views/footer.ejs

@@ -1,6 +1,8 @@
 
     <footer class="text-center">
       <span class="text-muted">&copy; 2016-19 <a href="https://cloudron.io" target="_blank">Cloudron</a></span>
+      <span class="text-muted"><a href="https://twitter.com/cloudron_io" target="_blank">Twitter <i class="fa fa-twitter"></i></a></span>
+      <span class="text-muted"><a href="https://chat.cloudron.io" target="_blank">Chat <i class="fa fa-comments"></i></a></span>
     </footer>
 
 	</div>

src/oauth2views/header.ejs

@@ -13,7 +13,7 @@
     <link href="<%= adminOrigin %>/theme.css" rel="stylesheet">
 
     <!-- Custom Fonts -->
-    <link href="<%= adminOrigin %>/3rdparty/fontawesome/css/all.min.css" rel="stylesheet" rel="stylesheet" type="text/css">
+    <link href="<%= adminOrigin %>/3rdparty/css/font-awesome.min.css" rel="stylesheet" rel="stylesheet" type="text/css">
 
     <!-- jQuery-->
     <script src="<%= adminOrigin %>/3rdparty/js/jquery.min.js"></script>

src/routes/apps.js

@@ -21,6 +21,8 @@ exports = module.exports = {
 
     cloneApp: cloneApp,
 
+    setOwner: setOwner,
+
     uploadFile: uploadFile,
     downloadFile: downloadFile
 };
@@ -78,6 +80,7 @@ function installApp(req, res, next) {
     assert.strictEqual(typeof req.body, 'object');
 
     var data = req.body;
+    data.ownerId = req.user.id;
 
     // atleast one
     if ('manifest' in data && typeof data.manifest !== 'object') return next(new HttpError(400, 'manifest must be an object'));
@@ -230,6 +233,7 @@ function cloneApp(req, res, next) {
     assert.strictEqual(typeof req.params.id, 'string');
 
     var data = req.body;
+    data.ownerId = req.user.id;
 
     debug('Clone app id:%s', req.params.id);
 
@@ -580,3 +584,17 @@ function downloadFile(req, res, next) {
         stream.pipe(res);
     });
 }
+
+function setOwner(req, res, next) {
+    assert.strictEqual(typeof req.params.id, 'string');
+    assert.strictEqual(typeof req.body, 'object');
+
+    if (typeof req.body.ownerId !== 'string') return next(new HttpError(400, 'ownerId must be a string'));
+
+    apps.setOwner(req.params.id, req.body.ownerId, function (error) {
+        if (error && error.reason === AppsError.NOT_FOUND) return next(new HttpError(404, error.message));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(200, { }));
+    });
+}

src/routes/profile.js

@@ -85,7 +85,7 @@ function enableTwoFactorAuthentication(req, res, next) {
 
     users.enableTwoFactorAuthentication(req.user.id, req.body.totpToken, function (error) {
         if (error && error.reason === UsersError.NOT_FOUND) return next(new HttpError(404, 'User not found'));
-        if (error && error.reason === UsersError.BAD_TOKEN) return next(new HttpError(412, 'Invalid token'));
+        if (error && error.reason === UsersError.BAD_TOKEN) return next(new HttpError(403, 'Invalid token'));
         if (error && error.reason === UsersError.ALREADY_EXISTS) return next(new HttpError(409, 'TwoFactor Authentication is already enabled'));
         if (error) return next(new HttpError(500, error));
 

src/routes/test/backups-test.js

@@ -31,7 +31,7 @@ const DOMAIN_0 = {
 
 let AUDIT_SOURCE = { ip: '1.2.3.4' };
 
-var token = null;
+var token = null, ownerId = null;
 
 function setup(done) {
     nock.cleanAll();
@@ -51,6 +51,7 @@ function setup(done) {
                     expect(result.statusCode).to.eql(201);
 
                     // stash token for further use
+                    ownerId = result.body.userId;
                     token = result.body.token;
 
                     callback();
@@ -59,7 +60,7 @@ function setup(done) {
 
         function addApp(callback) {
             var manifest = { version: '0.0.1', manifestVersion: 1, dockerImage: 'foo', healthCheckPath: '/', httpPort: 3, title: 'ok', addons: { } };
-            appdb.add('appid', 'appStoreId', manifest, 'location', DOMAIN_0.domain, [ ] /* portBindings */, { }, callback);
+            appdb.add('appid', 'appStoreId', manifest, 'location', DOMAIN_0.domain, ownerId, [ ] /* portBindings */, { }, callback);
         },
 
         function createSettings(callback) {

src/routes/test/oauth2-test.js

@@ -64,7 +64,8 @@ describe('OAuth2', function () {
             domain: DOMAIN_0.domain,
             portBindings: {},
             accessRestriction: null,
-            memoryLimit: 0
+            memoryLimit: 0,
+            ownerId: USER_0.id
         };
 
         var APP_1 = {
@@ -75,7 +76,8 @@ describe('OAuth2', function () {
             domain: DOMAIN_0.domain,
             portBindings: {},
             accessRestriction: { users: [ 'foobar' ] },
-            memoryLimit: 0
+            memoryLimit: 0,
+            ownerId: USER_0.id
         };
 
         var APP_2 = {
@@ -86,7 +88,8 @@ describe('OAuth2', function () {
             domain: DOMAIN_0.domain,
             portBindings: {},
             accessRestriction: { users: [ USER_0.id ] },
-            memoryLimit: 0
+            memoryLimit: 0,
+            ownerId: USER_0.id
         };
 
         var APP_3 = {
@@ -97,7 +100,8 @@ describe('OAuth2', function () {
             domain: DOMAIN_0.domain,
             portBindings: {},
             accessRestriction: { groups: [ 'someothergroup', 'admin', 'anothergroup' ] },
-            memoryLimit: 0
+            memoryLimit: 0,
+            ownerId: USER_0.id
         };
 
         // unknown app
@@ -221,13 +225,14 @@ describe('OAuth2', function () {
                         expect(error).to.not.be.ok();
 
                         // update the global objects to reflect the new user id
+                        USER_0.id = APP_0.ownerId = APP_1.ownerId = APP_2.ownerId = APP_3.ownerId = userObject.id;
                         APP_2.accessRestriction = { users: [ 'foobar', userObject.id ] };
 
                         async.series([
-                            appdb.add.bind(null, APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.portBindings, APP_0),
-                            appdb.add.bind(null, APP_1.id, APP_1.appStoreId, APP_1.manifest, APP_1.location, APP_1.domain, APP_1.portBindings, APP_1),
-                            appdb.add.bind(null, APP_2.id, APP_2.appStoreId, APP_2.manifest, APP_2.location, APP_2.domain, APP_2.portBindings, APP_2),
-                            appdb.add.bind(null, APP_3.id, APP_3.appStoreId, APP_3.manifest, APP_3.location, APP_3.domain, APP_3.portBindings, APP_3),
+                            appdb.add.bind(null, APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.ownerId, APP_0.portBindings, APP_0),
+                            appdb.add.bind(null, APP_1.id, APP_1.appStoreId, APP_1.manifest, APP_1.location, APP_1.domain, APP_1.ownerId, APP_1.portBindings, APP_1),
+                            appdb.add.bind(null, APP_2.id, APP_2.appStoreId, APP_2.manifest, APP_2.location, APP_2.domain, APP_2.ownerId, APP_2.portBindings, APP_2),
+                            appdb.add.bind(null, APP_3.id, APP_3.appStoreId, APP_3.manifest, APP_3.location, APP_3.domain, APP_3.ownerId, APP_3.portBindings, APP_3),
 
                             appdb.update.bind(null, APP_2.id, APP_2)
                         ], callback);

src/routes/test/profile-test.js

@@ -248,7 +248,7 @@ describe('Profile API', function () {
                 .query({ access_token: token_0 })
                 .send({ password: 'some wrong password', newPassword: 'MOre#$%34' })
                 .end(function (err, res) {
-                    expect(res.statusCode).to.equal(412);
+                    expect(res.statusCode).to.equal(400);
                     done();
                 });
         });

src/routes/users.js

@@ -10,7 +10,8 @@ exports = module.exports = {
     verifyPassword: verifyPassword,
     createInvite: createInvite,
     sendInvite: sendInvite,
-    setGroups: setGroups
+    setGroups: setGroups,
+    transferOwnership: transferOwnership
 };
 
 var assert = require('assert'),
@@ -131,7 +132,7 @@ function verifyPassword(req, res, next) {
     if (typeof req.body.password !== 'string') return next(new HttpError(400, 'API call requires user password'));
 
     users.verifyWithUsername(req.user.username, req.body.password, function (error) {
-        if (error && error.reason === UsersError.WRONG_PASSWORD) return next(new HttpError(412, 'Password incorrect'));
+        if (error && error.reason === UsersError.WRONG_PASSWORD) return next(new HttpError(400, 'Password incorrect'));
         if (error && error.reason === UsersError.NOT_FOUND) return next(new HttpError(404, 'No such user'));
         if (error) return next(new HttpError(500, error));
 
@@ -178,6 +179,20 @@ function setGroups(req, res, next) {
     });
 }
 
+function transferOwnership(req, res, next) {
+    assert.strictEqual(typeof req.body, 'object');
+    assert.strictEqual(typeof req.params.userId, 'string');
+
+    if (typeof req.body.ownerId !== 'string') return next(new HttpError(400, 'ownerId must be a string'));
+
+    users.transferOwnership(req.params.userId, req.body.ownerId, auditSource.fromRequest(req), function (error) {
+        if (error && error.reason === UsersError.NOT_FOUND) return next(new HttpError(404, 'No such user'));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(200, {}));
+    });
+}
+
 function changePassword(req, res, next) {
     assert.strictEqual(typeof req.body, 'object');
     assert.strictEqual(typeof req.params.userId, 'string');

src/server.js

@@ -173,6 +173,7 @@ function initializeExpressSync() {
     router.put ('/api/v1/users/:userId/groups', usersManageScope, routes.users.setGroups);
     router.post('/api/v1/users/:userId/send_invite', usersManageScope, routes.users.sendInvite);
     router.post('/api/v1/users/:userId/create_invite', usersManageScope, routes.users.createInvite);
+    router.post('/api/v1/users/:userId/transfer', usersManageScope, routes.users.transferOwnership);
 
     // Group management
     router.get ('/api/v1/groups', usersReadScope, routes.groups.list);
@@ -239,6 +240,7 @@ function initializeExpressSync() {
     router.post('/api/v1/apps/:id/clone',     appsManageScope, routes.apps.cloneApp);
     router.get ('/api/v1/apps/:id/download',  appsManageScope, routes.apps.downloadFile);
     router.post('/api/v1/apps/:id/upload',    appsManageScope, multipart, routes.apps.uploadFile);
+    router.post('/api/v1/apps/:id/owner',     appsManageScope, routes.apps.setOwner);
 
     // settings routes (these are for the settings tab - avatar & name have public routes for normal users. see above)
     router.get ('/api/v1/settings/:setting', settingsScope, routes.settings.get);

src/test/apps-test.js

@@ -115,6 +115,7 @@ describe('Apps', function () {
         memoryLimit: 0,
         robotsTxt: null,
         sso: false,
+        ownerId: USER_0.id,
         env: {
             'CUSTOM_KEY': 'CUSTOM_VALUE'
         },
@@ -134,6 +135,7 @@ describe('Apps', function () {
         portBindings: {},
         accessRestriction: { users: [ 'someuser' ], groups: [ GROUP_0.id ] },
         memoryLimit: 0,
+        ownerId: USER_0.id,
         env: {},
         dataDir: ''
     };
@@ -153,6 +155,7 @@ describe('Apps', function () {
         memoryLimit: 0,
         robotsTxt: null,
         sso: false,
+        ownerId: USER_0.id,
         env: {},
         dataDir: ''
     };
@@ -174,9 +177,9 @@ describe('Apps', function () {
             groupdb.add.bind(null, GROUP_0.id, GROUP_0.name),
             groupdb.add.bind(null, GROUP_1.id, GROUP_1.name),
             groups.addMember.bind(null, GROUP_0.id, USER_1.id),
-            appdb.add.bind(null, APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, apps._translatePortBindings(APP_0.portBindings, APP_0.manifest), APP_0),
-            appdb.add.bind(null, APP_1.id, APP_1.appStoreId, APP_1.manifest, APP_1.location, APP_1.domain, apps._translatePortBindings(APP_1.portBindings, APP_1.manifest), APP_1),
-            appdb.add.bind(null, APP_2.id, APP_2.appStoreId, APP_2.manifest, APP_2.location, APP_2.domain, apps._translatePortBindings(APP_2.portBindings, APP_2.manifest), APP_2),
+            appdb.add.bind(null, APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.ownerId, apps._translatePortBindings(APP_0.portBindings, APP_0.manifest), APP_0),
+            appdb.add.bind(null, APP_1.id, APP_1.appStoreId, APP_1.manifest, APP_1.location, APP_1.domain, APP_1.ownerId, apps._translatePortBindings(APP_1.portBindings, APP_1.manifest), APP_1),
+            appdb.add.bind(null, APP_2.id, APP_2.appStoreId, APP_2.manifest, APP_2.location, APP_2.domain, APP_2.ownerId, apps._translatePortBindings(APP_2.portBindings, APP_2.manifest), APP_2),
         ], done);
     });
 

src/test/apptask-test.js

@@ -91,7 +91,8 @@ var APP = {
     httpPort: 4567,
     portBindings: null,
     accessRestriction: null,
-    memoryLimit: 0
+    memoryLimit: 0,
+    ownerId: ADMIN.id
 };
 
 var awsHostedZones;
@@ -122,7 +123,7 @@ describe('apptask', function () {
             database._clear,
             domains.add.bind(null, DOMAIN_0.domain, DOMAIN_0, AUDIT_SOURCE),
             userdb.add.bind(null, ADMIN.id, ADMIN),
-            appdb.add.bind(null, APP.id, APP.appStoreId, APP.manifest, APP.location, APP.domain, APP.portBindings, APP)
+            appdb.add.bind(null, APP.id, APP.appStoreId, APP.manifest, APP.location, APP.domain, APP.ownerId, APP.portBindings, APP)
         ], done);
     });
 

src/test/database-test.js

@@ -416,6 +416,7 @@ describe('database', function () {
             debugMode: null,
             robotsTxt: null,
             enableBackup: true,
+            ownerId: USER_0.id,
             env: {},
             mailboxName: 'talktome',
             enableAutomaticUpdate: true,
@@ -425,7 +426,7 @@ describe('database', function () {
         };
 
         it('cannot delete referenced domain', function (done) {
-            appdb.add(APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.portBindings, APP_0, function (error) {
+            appdb.add(APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.ownerId, APP_0.portBindings, APP_0, function (error) {
                 expect(error).to.be(null);
 
                 domaindb.del(DOMAIN_0.domain, function (error) {
@@ -995,6 +996,7 @@ describe('database', function () {
             debugMode: null,
             robotsTxt: null,
             enableBackup: true,
+            ownerId: USER_0.id,
             alternateDomains: [],
             env: {
                 'CUSTOM_KEY': 'CUSTOM_VALUE'
@@ -1028,6 +1030,7 @@ describe('database', function () {
             debugMode: null,
             robotsTxt: null,
             enableBackup: true,
+            ownerId: USER_0.id,
             alternateDomains: [],
             env: {},
             mailboxName: 'callme',
@@ -1062,7 +1065,7 @@ describe('database', function () {
         });
 
         it('add succeeds', function (done) {
-            appdb.add(APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.portBindings, APP_0, function (error) {
+            appdb.add(APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.ownerId, APP_0.portBindings, APP_0, function (error) {
                 expect(error).to.be(null);
                 done();
             });
@@ -1086,7 +1089,7 @@ describe('database', function () {
         });
 
         it('add of same app fails', function (done) {
-            appdb.add(APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, [], APP_0, function (error) {
+            appdb.add(APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.ownerId, [], APP_0, function (error) {
                 expect(error).to.be.a(DatabaseError);
                 expect(error.reason).to.be(DatabaseError.ALREADY_EXISTS);
                 done();
@@ -1159,7 +1162,7 @@ describe('database', function () {
         });
 
         it('add second app succeeds', function (done) {
-            appdb.add(APP_1.id, APP_1.appStoreId, APP_1.manifest, APP_1.location, APP_1.domain, [], APP_1, function (error) {
+            appdb.add(APP_1.id, APP_1.appStoreId, APP_1.manifest, APP_1.location, APP_1.domain, APP_0.ownerId, [], APP_1, function (error) {
                 expect(error).to.be(null);
                 done();
             });

src/test/ldap-test.js

@@ -79,6 +79,7 @@ var APP_0 = {
     restoreConfig: null,
     oldConfig: null,
     memoryLimit: 4294967296,
+    ownerId: null,
     mailboxName: 'some-location-0.app'
 };
 
@@ -104,12 +105,11 @@ function setup(done) {
             users.createOwner(USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE, function (error, result) {
                 if (error) return callback(error);
 
-                USER_0.id = result.id;
+                USER_0.id = APP_0.ownerId = result.id;
 
-                callback();
+                appdb.add(APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.ownerId, apps._translatePortBindings(APP_0.portBindings, APP_0.manifest), APP_0, callback);
             });
         },
-        appdb.add.bind(null, APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, apps._translatePortBindings(APP_0.portBindings, APP_0.manifest), APP_0),
         (done) => mailboxdb.addMailbox(USER_0.username.toLowerCase(), DOMAIN_0.domain, USER_0.id, done),
         (done) => mailboxdb.setAliasesForName(USER_0.username.toLowerCase(), DOMAIN_0.domain, [ USER_0_ALIAS.toLocaleLowerCase() ], done),
         appdb.update.bind(null, APP_0.id, { containerId: APP_0.containerId }),
@@ -185,15 +185,6 @@ function setup(done) {
                     }
                 };
                 status = 200;
-            } else if (req.method === 'GET' && req.url === '/containers/someContainerId/json') {
-                answer = {
-                    Config: {
-                        Labels: {
-                            appId: APP_0.id
-                        }
-                    }
-                };
-                status = 200;
             }
 
             res.writeHead(status);
@@ -563,6 +554,42 @@ describe('Ldap', function () {
                 });
             });
         });
+
+        it ('lists the owner as admin', function (done) {
+            // make a normal user the owner
+            appdb.update(APP_0.id, { ownerId: USER_1.id, accessRestriction: { users: [], groups: [ GROUP_ID ] } }, function (error) {
+                expect(error).to.be(null);
+
+                var client = ldap.createClient({ url: 'ldap://127.0.0.1:' + config.get('ldapPort') });
+
+                var opts = {
+                    filter: 'objectcategory=person'
+                };
+
+                client.search('ou=users,dc=cloudron', opts, function (error, result) {
+                    expect(error).to.be(null);
+                    expect(result).to.be.an(EventEmitter);
+
+                    var entries = [];
+
+                    result.on('searchEntry', function (entry) { entries.push(entry.object); });
+                    result.on('error', done);
+                    result.on('end', function (result) {
+                        expect(result.status).to.equal(0);
+                        expect(entries.length).to.equal(2);
+                        entries.sort(function (a, b) { return a.username > b.username; });
+
+                        expect(entries[0].username).to.equal(USER_0.username.toLowerCase());
+                        expect(entries[1].username).to.equal(USER_1.username.toLowerCase());
+                        expect(entries[1].isadmin).to.equal('1');
+
+                        client.unbind();
+
+                        appdb.update(APP_0.id, { ownerId: USER_0.id, accessRestriction: null }, done);
+                    });
+                });
+            });
+        });
     });
 
     describe('search groups', function () {
@@ -733,6 +760,45 @@ describe('Ldap', function () {
                 });
             });
         });
+
+        it ('shows owner as admin', function (done) {
+            appdb.update(APP_0.id, { ownerId: USER_1.id, accessRestriction: { users: [], groups: [ GROUP_ID ] } }, function (error) {
+                expect(error).to.be(null);
+
+                var client = ldap.createClient({ url: 'ldap://127.0.0.1:' + config.get('ldapPort') });
+
+                var opts = {
+                    filter: '&(objectclass=group)(cn=*)'
+                };
+
+                client.search('ou=groups,dc=cloudron', opts, function (error, result) {
+                    expect(error).to.be(null);
+                    expect(result).to.be.an(EventEmitter);
+
+                    var entries = [];
+
+                    result.on('searchEntry', function (entry) { entries.push(entry.object); });
+                    result.on('error', done);
+                    result.on('end', function (result) {
+                        expect(result.status).to.equal(0);
+                        expect(entries.length).to.equal(2);
+                        expect(entries[0].cn).to.equal('users');
+                        expect(entries[0].memberuid.length).to.equal(2);
+                        expect(entries[0].memberuid[0]).to.equal(USER_0.id);
+                        expect(entries[0].memberuid[1]).to.equal(USER_1.id);
+                        expect(entries[1].cn).to.equal('admins');
+
+                        expect(entries[1].memberuid.length).to.equal(2);
+                        expect(entries[1].memberuid[0]).to.equal(USER_0.id);
+                        expect(entries[1].memberuid[1]).to.equal(USER_1.id);
+
+                        client.unbind();
+
+                        appdb.update(APP_0.id, { ownerId: USER_0.id, accessRestriction: null }, done);
+                    });
+                });
+            });
+        });
     });
 
     // ldapsearch -LLL -E pr=10/noprompt -x -h localhost -p 3002 -b cn=userName0@example.com,ou=mailboxes,dc=cloudron objectclass=mailbox

src/test/updatechecker-test.js

@@ -245,7 +245,8 @@ describe('updatechecker - app - manual (email)', function () {
         portBindings: { PORT: 5678 },
         healthy: null,
         accessRestriction: null,
-        memoryLimit: 0
+        memoryLimit: 0,
+        ownerId: null
     };
 
     before(function (done) {
@@ -262,8 +263,14 @@ describe('updatechecker - app - manual (email)', function () {
             cron.startJobs,
             domains.add.bind(null, DOMAIN_0.domain, DOMAIN_0, AUDIT_SOURCE),
             mail.addDomain.bind(null, DOMAIN_0.domain),
-            users.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
-            appdb.add.bind(null, APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, apps._translatePortBindings(APP_0.portBindings, APP_0.manifest), APP_0),
+            function (next) {
+                users.createOwner(USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE, function (error, userObject) {
+                    if (error) return next(error);
+
+                    APP_0.ownerId = userObject.id;
+                    appdb.add(APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.ownerId, apps._translatePortBindings(APP_0.portBindings, APP_0.manifest), APP_0, next);
+                });
+            },
             settings.setAppAutoupdatePattern.bind(null, constants.AUTOUPDATE_PATTERN_NEVER),
             settingsdb.set.bind(null, settings.CLOUDRON_TOKEN_KEY, 'atoken'),
         ], done);
@@ -356,7 +363,8 @@ describe('updatechecker - app - automatic (no email)', function () {
         portBindings: { PORT: 5678 },
         healthy: null,
         accessRestriction: null,
-        memoryLimit: 0
+        memoryLimit: 0,
+        ownerId: null
     };
 
     before(function (done) {
@@ -373,8 +381,14 @@ describe('updatechecker - app - automatic (no email)', function () {
             cron.startJobs,
             domains.add.bind(null, DOMAIN_0.domain, DOMAIN_0, AUDIT_SOURCE),
             mail.addDomain.bind(null, DOMAIN_0.domain),
-            users.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
-            appdb.add.bind(null, APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, apps._translatePortBindings(APP_0.portBindings, APP_0.manifest), APP_0),
+            function (next) {
+                users.createOwner(USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE, function (error, userObject) {
+                    if (error) return next(error);
+
+                    APP_0.ownerId = userObject.id;
+                    appdb.add(APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.ownerId, apps._translatePortBindings(APP_0.portBindings, APP_0.manifest), APP_0, next);
+                });
+            },
             settings.setAppAutoupdatePattern.bind(null, '00 00 1,3,5,23 * * *'),
             settingsdb.set.bind(null, settings.CLOUDRON_TOKEN_KEY, 'atoken'),
         ], done);
@@ -423,7 +437,8 @@ describe('updatechecker - app - automatic free (email)', function () {
         portBindings: { PORT: 5678 },
         healthy: null,
         accessRestriction: null,
-        memoryLimit: 0
+        memoryLimit: 0,
+        ownerId: null
     };
 
     before(function (done) {
@@ -440,8 +455,14 @@ describe('updatechecker - app - automatic free (email)', function () {
             cron.startJobs,
             domains.add.bind(null, DOMAIN_0.domain, DOMAIN_0, AUDIT_SOURCE),
             mail.addDomain.bind(null, DOMAIN_0.domain),
-            users.createOwner.bind(null, USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE),
-            appdb.add.bind(null, APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, apps._translatePortBindings(APP_0.portBindings, APP_0.manifest), APP_0),
+            function (next) {
+                users.createOwner(USER_0.username, USER_0.password, USER_0.email, USER_0.displayName, AUDIT_SOURCE, function (error, userObject) {
+                    if (error) return next(error);
+
+                    APP_0.ownerId = userObject.id;
+                    appdb.add(APP_0.id, APP_0.appStoreId, APP_0.manifest, APP_0.location, APP_0.domain, APP_0.ownerId, apps._translatePortBindings(APP_0.portBindings, APP_0.manifest), APP_0, next);
+                });
+            },
             settings.setAppAutoupdatePattern.bind(null, '00 00 1,3,5,23 * * *'),
             settingsdb.set.bind(null, settings.CLOUDRON_TOKEN_KEY, 'atoken'),
         ], done);

src/users.js

@@ -29,11 +29,12 @@ exports = module.exports = {
     setTwoFactorAuthenticationSecret: setTwoFactorAuthenticationSecret,
     enableTwoFactorAuthentication: enableTwoFactorAuthentication,
     disableTwoFactorAuthentication: disableTwoFactorAuthentication,
-
-    count: count
+    transferOwnership: transferOwnership
 };
 
-let assert = require('assert'),
+var apps = require('./apps.js'),
+    AppsError = apps.AppsError,
+    assert = require('assert'),
     crypto = require('crypto'),
     config = require('./config.js'),
     constants = require('./constants.js'),
@@ -541,7 +542,7 @@ function createOwner(username, password, email, displayName, auditSource, callba
     // This is only not allowed for the owner
     if (username === '') return callback(new UsersError(UsersError.BAD_FIELD, 'Username cannot be empty'));
 
-    count(function (error, count) {
+    userdb.count(function (error, count) {
         if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));
         if (count !== 0) return callback(new UsersError(UsersError.ALREADY_EXISTS, 'Owner already exists'));
 
@@ -654,3 +655,19 @@ function disableTwoFactorAuthentication(userId, callback) {
         callback(null);
     });
 }
+
+function transferOwnership(oldOwnerId, newOwnerId, auditSource, callback) {
+    assert.strictEqual(typeof oldOwnerId, 'string');
+    assert.strictEqual(typeof newOwnerId, 'string');
+    assert(auditSource && typeof auditSource === 'object');
+    assert.strictEqual(typeof callback, 'function');
+
+    apps.transferOwnership(oldOwnerId, newOwnerId, function (error) {
+        if (error && error.reason === AppsError.NOT_FOUND) return callback(new UsersError(UsersError.NOT_FOUND, error.message));
+        if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));
+
+        eventlog.add(eventlog.ACTION_USER_TRANSFER, auditSource, { oldOwnerId: oldOwnerId, newOwnerId: newOwnerId });
+
+        callback(null);
+    });
+}