Feature/add couchbase support (#14518) by gsmithun4 · Pull Request #15147 · ToolJet/ToolJet

gsmithun4 · 2026-02-03T03:28:23Z

Add support for couchbase
Update readme
Update query operation

* Add support for couchbase * Update readme * Update query operation --------- Co-authored-by: Midhun G S <gsmithun4@gmail.com>

Copilot

Pull request overview

This PR adds support for Couchbase, a NoSQL database, to ToolJet's marketplace plugins. The implementation provides integration with Couchbase's Data API, enabling document operations (CRUD), SQL++ queries, and Full-Text Search (FTS) capabilities.

Changes:

Added Couchbase plugin entry to the marketplace plugins registry
Implemented complete plugin infrastructure including TypeScript types, operations, and manifest files
Added six operations: Get Document, Create Document, Update Document, Delete Document, Query (SQL++), and FTS Search
Provided comprehensive documentation with examples for all operations

Reviewed changes

Copilot reviewed 12 out of 20 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
server/src/assets/marketplace/plugins.json	Registers the Couchbase plugin in the marketplace
marketplace/plugins/couchbase/package.json	Defines package metadata and dependencies
marketplace/plugins/couchbase/tsconfig.json	TypeScript configuration for the plugin
marketplace/plugins/couchbase/lib/types.ts	Type definitions for operations and options
marketplace/plugins/couchbase/lib/query_operations.ts	Implementation of all six Couchbase operations
marketplace/plugins/couchbase/lib/index.ts	Main service class implementing QueryService interface
marketplace/plugins/couchbase/lib/manifest.json	Plugin manifest with connection configuration
marketplace/plugins/couchbase/lib/operations.json	UI schema for operation parameters
marketplace/plugins/couchbase/lib/icon.svg	Couchbase logo SVG
marketplace/plugins/couchbase/tests/index.js	Placeholder test file
marketplace/plugins/couchbase/README.md	Brief README with documentation link
marketplace/plugins/couchbase/.gitignore	Git ignore rules for build artifacts
docs/static/img/marketplace/plugins/couchbase/*	Screenshots for documentation
docs/docs/marketplace/plugins/couchbase.md	Complete plugin documentation with examples

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-03T03:32:28Z

+  if (!response.ok) {
+    throw new Error(`Failed to create document: ${response.statusText}`);
+  }
+  await response.json().catch(() => (response.status === 201 ? { message: 'Created successfully' } : {}));


Line 49 has an awkward error handling pattern. The code attempts to parse JSON from the response and catches errors, but the catch block doesn't use the error or rethrow it. If the response is not 201, the operation still returns "Created successfully" even though the creation might have failed. This should be improved to properly handle the response or throw an error for non-201 status codes.

Suggested change

if (!response.ok) {

throw new Error(`Failed to create document: ${response.statusText}`);

}

await response.json().catch(() => (response.status === 201 ? { message: 'Created successfully' } : {}));

if (response.status !== 201) {

let errorBody: string | undefined;

try {

errorBody = await response.text();

} catch {

// Ignore errors while reading the error body

}

const message = `Failed to create document: ${response.status} ${response.statusText}${

errorBody ? ` - ${errorBody}` : ''

}`;

throw new Error(message);

}

try {

await response.json();

} catch {

// Ignore errors while parsing a successful creation response

}

Copilot · 2026-02-03T03:32:28Z

+  await response.json().catch((error) => {
+    if (!response.ok) {
+      throw error;
+    }
+  });
+  return 'Updated successfully';


The error handling in the catch block is inconsistent. On line 77-81, the code catches an error but only throws it if !response.ok. However, at this point we're in a catch block that was triggered by response.json() failing, which means the response was already OK (passed the check on line 74). This logic doesn't make sense - if we're in the catch block, we should either ignore the error (if an empty response is expected) or handle it differently. The same issue exists in the deleteDocument function (lines 101-105).

Copilot · 2026-02-03T03:32:28Z

+  if (!bucket || !index_name || !search_query) {
+    throw new Error('Missing required parameters: bucket, index_name, and query are required');
+  }
+
+  let parsedSearchQuery;
+  if (search_query) {
+    parsedSearchQuery = typeof search_query === 'string' ? JSON.parse(search_query) : search_query;
+  }
+
+  const dapi_url = `${data_api_url}/_p/fts/api/bucket/${bucket}/scope/${scope}/index/${index_name}/query`;


The scope parameter is not validated as required, but it's used in the URL construction on line 164. The error message on line 156 indicates that scope is required ("bucket, index_name, and query are required"), but the validation check on line 155 doesn't include scope. This inconsistency could lead to runtime errors when the URL is malformed due to an undefined scope value.

Copilot · 2026-02-03T03:32:29Z

+    "name": "couchbase",
+    "description": "database plugin from couchbase",


The description "database plugin from couchbase" is inconsistent with other plugin descriptions in the file and uses lowercase "couchbase". It should be capitalized and more descriptive, similar to other database plugins. For example, HarperDB uses "Plugin to store and query data from HarperDB".

Suggested change

"name": "couchbase",

"description": "database plugin from couchbase",

"name": "Couchbase",

"description": "Plugin to store and query data from Couchbase",

Copilot · 2026-02-03T03:32:29Z

+  let parsedDocument;
+  if (document) {
+    parsedDocument = typeof document === 'string' ? JSON.parse(document) : document;
+  }
+
+  const dapi_url = `${data_api_url}/v1/buckets/${bucket}/scopes/${scope}/collections/${collection}/documents/${document_id}`;
+  const response = await fetch(dapi_url, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`,
+    },
+    body: JSON.stringify(parsedDocument),


The parsedDocument variable may be undefined if the document parameter is not provided. The code should validate that parsedDocument exists before using it in JSON.stringify() on line 44. This could cause the API to send "undefined" as the request body, which would likely fail.

Copilot · 2026-02-03T03:32:29Z

+  await response.json().catch((error) => {
+    if (!response.ok) {
+      throw error;
+    }
+  });


The error handling in the catch block is inconsistent. The code catches an error but only throws it if !response.ok. However, at this point we're in a catch block that was triggered by response.json() failing, which means the response was already OK (passed the check on line 98). This logic doesn't make sense - if we're in the catch block, we should either ignore the error (if an empty response is expected) or handle it differently. This is the same issue as in the updateDocument function.

Suggested change

await response.json().catch((error) => {

if (!response.ok) {

throw error;

}

});

// Some DELETE endpoints may return no JSON body; ignore JSON parsing errors.

try {

await response.json();

} catch {

// Intentionally ignore errors when parsing an optional response body.

}

Copilot · 2026-02-03T03:32:30Z

+
+**Query Options**: `{ "readonly": true, "query_context": "travel-sample.inventory" }`
+
+Refer to the [request paramters](https://docs.couchbase.com/server/current/n1ql-rest-query/index.html#Request) for supported query options.


There's a typo in "request paramters" - it should be "request parameters".

Suggested change

Refer to the [request paramters](https://docs.couchbase.com/server/current/n1ql-rest-query/index.html#Request) for supported query options.

Refer to the [request parameters](https://docs.couchbase.com/server/current/n1ql-rest-query/index.html#Request) for supported query options.

Copilot · 2026-02-03T03:32:30Z

+    "author": "Tooljet",
+    "timestamp": "Fri, 20 Jun 2025 06:46:04 GMT",
+    "tags": [
+      "AI"


The tag "AI" is incorrect for a database plugin. Couchbase is a NoSQL database, so this should be tagged with "Database" instead. This inconsistency could confuse users searching for database or AI-related plugins in the marketplace.

Suggested change

"AI"

"Database"

Copilot · 2026-02-03T03:32:30Z

+const couchbase = require('../lib');
+


Unused variable couchbase.

Suggested change

const couchbase = require('../lib');

Copilot · 2026-02-03T03:32:30Z

+  let parsedSearchQuery;
+  if (search_query) {
+    parsedSearchQuery = typeof search_query === 'string' ? JSON.parse(search_query) : search_query;
+  }


This use of variable 'search_query' always evaluates to true.

Suggested change

let parsedSearchQuery;

if (search_query) {

parsedSearchQuery = typeof search_query === 'string' ? JSON.parse(search_query) : search_query;

}

let parsedSearchQuery = typeof search_query === 'string' ? JSON.parse(search_query) : search_query;

github-actions · 2026-02-04T04:53:51Z

🚀 EE LTS Review App Deployed!

Resource	Link
App URL	https://tooljet-ee-lts-pr-15147.onrender.com
Render Dashboard	https://dashboard.render.com/web/srv-d61d0gpr0fns73fricig
Docker Image	`tooljet/tooljet-render:ee-lts-pr-15147`

Deployed using DockerHub-based pipeline - LTS Edition

github-actions · 2026-02-04T06:06:45Z

Marketplace Plugin added to stage bucket

🔍 View Deployment Logs & Summary

━━━━━━━━━━━━━━━ UPLOAD SUMMARY ━━━━━━━━━━━━━━━━━
[6:06:44 AM] 🎉 All files uploaded successfully
[6:06:44 AM] ✅ Successfully uploaded: 3701/3701 files
[6:06:44 AM] ❌ Failed uploads: 0/3701 files
[6:06:44 AM] ℹ Total time: 8.5s

socket-security · 2026-02-17T14:11:43Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@docusaurus/preset-classic@2.0.0-alpha.73
	@docusaurus/plugin-google-gtag@2.0.0-alpha.73
	@docusaurus/core@2.0.0-alpha.73
	clsx@1.1.1
	@mdx-js/react@1.6.22

View full report

socket-security · 2026-02-17T14:11:45Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code in npm `@babel/traverse` CVE: GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code (CRITICAL) Affected versions: < 7.23.2; >= 8.0.0-alpha.0 < 8.0.0-alpha.4 Patched version: 7.23.2 From: docs/versioned_docs/version-2.22.0/widgets/package-lock.json → `npm/@docusaurus/core@2.0.0-alpha.73` → `npm/@docusaurus/preset-classic@2.0.0-alpha.73` → `npm/@babel/traverse@7.15.4` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@babel/traverse@7.15.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Prototype Pollution in npm `algoliasearch-helper` CVE: GHSA-vpf5-82c8-9v36 Prototype Pollution in algoliasearch-helper (CRITICAL) Affected versions: < 3.6.2 Patched version: 3.6.2 From: docs/versioned_docs/version-2.22.0/widgets/package-lock.json → `npm/@docusaurus/preset-classic@2.0.0-alpha.73` → `npm/algoliasearch-helper@3.6.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/algoliasearch-helper@3.6.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: npm `cipher-base` is missing type checks, leading to hash rewind and passing on crafted data CVE: GHSA-cpq7-6gpm-g9rc cipher-base is missing type checks, leading to hash rewind and passing on crafted data (CRITICAL) Affected versions: < 1.0.5 Patched version: 1.0.5 From: docs/versioned_docs/version-2.22.0/widgets/package-lock.json → `npm/cipher-base@1.0.4` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/cipher-base@1.0.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) CVE: GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) (CRITICAL) Affected versions: < 6.6.1 Patched version: 6.6.1 From: docs/versioned_docs/version-2.22.0/widgets/package-lock.json → `npm/elliptic@6.5.4` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/elliptic@6.5.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Exposure of Sensitive Information in npm `eventsource` CVE: GHSA-6h5x-7c5m-7cr7 Exposure of Sensitive Information in eventsource (CRITICAL) Affected versions: < 1.1.1; >= 2.0.0 < 2.0.2 Patched version: 1.1.1 From: docs/versioned_docs/version-2.22.0/widgets/package-lock.json → `npm/eventsource@1.1.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/eventsource@1.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Prototype Pollution in npm `immer` CVE: GHSA-33f9-j839-rf8h Prototype Pollution in immer (CRITICAL) Affected versions: >= 7.0.0 < 9.0.6 Patched version: 9.0.6 From: docs/versioned_docs/version-2.22.0/widgets/package-lock.json → `npm/immer@8.0.1` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/immer@8.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Prototype pollution in webpack npm `loader-utils` CVE: GHSA-76p3-8jx3-jpfq Prototype pollution in webpack loader-utils (CRITICAL) Affected versions: >= 2.0.0 < 2.0.3; < 1.4.1 Patched version: 1.4.1 From: docs/versioned_docs/version-2.22.0/widgets/package-lock.json → `npm/@docusaurus/preset-classic@2.0.0-alpha.73` → `npm/loader-utils@1.4.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/loader-utils@1.4.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Prototype pollution in webpack npm `loader-utils` CVE: GHSA-76p3-8jx3-jpfq Prototype pollution in webpack loader-utils (CRITICAL) Affected versions: >= 2.0.0 < 2.0.3; < 1.4.1 Patched version: 2.0.3 From: docs/versioned_docs/version-2.22.0/widgets/package-lock.json → `npm/@docusaurus/core@2.0.0-alpha.73` → `npm/@docusaurus/preset-classic@2.0.0-alpha.73` → `npm/loader-utils@2.0.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/loader-utils@2.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Prototype Pollution in npm `minimist` CVE: GHSA-xvch-5gv4-984h Prototype Pollution in minimist (CRITICAL) Affected versions: >= 1.0.0 < 1.2.6; < 0.2.4 Patched version: 1.2.6 From: docs/versioned_docs/version-2.22.0/widgets/package-lock.json → `npm/@docusaurus/core@2.0.0-alpha.73` → `npm/@docusaurus/preset-classic@2.0.0-alpha.73` → `npm/minimist@1.2.5` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/minimist@1.2.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2026-02-17T14:28:37Z