2022-08-10 14:20:42 +02:00
|
|
|
package api
|
|
|
|
|
|
|
|
import (
|
|
|
|
"encoding/json"
|
2022-09-13 12:18:40 +02:00
|
|
|
"errors"
|
|
|
|
"io"
|
2022-08-10 14:20:42 +02:00
|
|
|
"net/http"
|
|
|
|
|
|
|
|
"github.com/gorilla/mux"
|
|
|
|
"github.com/mattermost/focalboard/server/model"
|
|
|
|
"github.com/mattermost/focalboard/server/services/audit"
|
|
|
|
|
2024-06-07 20:00:08 +02:00
|
|
|
"github.com/mattermost/mattermost/server/public/shared/mlog"
|
2022-08-10 14:20:42 +02:00
|
|
|
)
|
|
|
|
|
2022-09-13 12:18:40 +02:00
|
|
|
var ErrTurningOnSharing = errors.New("turning on sharing for board failed, see log for details")
|
|
|
|
|
2022-08-10 14:20:42 +02:00
|
|
|
func (a *API) registerSharingRoutes(r *mux.Router) {
|
|
|
|
// Sharing APIs
|
|
|
|
r.HandleFunc("/boards/{boardID}/sharing", a.sessionRequired(a.handlePostSharing)).Methods("POST")
|
|
|
|
r.HandleFunc("/boards/{boardID}/sharing", a.sessionRequired(a.handleGetSharing)).Methods("GET")
|
|
|
|
}
|
|
|
|
|
|
|
|
func (a *API) handleGetSharing(w http.ResponseWriter, r *http.Request) {
|
|
|
|
// swagger:operation GET /boards/{boardID}/sharing getSharing
|
|
|
|
//
|
|
|
|
// Returns sharing information for a board
|
|
|
|
//
|
|
|
|
// ---
|
|
|
|
// produces:
|
|
|
|
// - application/json
|
|
|
|
// parameters:
|
|
|
|
// - name: boardID
|
|
|
|
// in: path
|
|
|
|
// description: Board ID
|
|
|
|
// required: true
|
|
|
|
// type: string
|
|
|
|
// security:
|
|
|
|
// - BearerAuth: []
|
|
|
|
// responses:
|
|
|
|
// '200':
|
|
|
|
// description: success
|
|
|
|
// schema:
|
|
|
|
// "$ref": "#/definitions/Sharing"
|
|
|
|
// '404':
|
|
|
|
// description: board not found
|
|
|
|
// default:
|
|
|
|
// description: internal error
|
|
|
|
// schema:
|
|
|
|
// "$ref": "#/definitions/ErrorResponse"
|
|
|
|
|
|
|
|
vars := mux.Vars(r)
|
|
|
|
boardID := vars["boardID"]
|
|
|
|
|
|
|
|
userID := getUserID(r)
|
|
|
|
if !a.permissions.HasPermissionToBoard(userID, boardID, model.PermissionShareBoard) {
|
2022-09-13 12:18:40 +02:00
|
|
|
a.errorResponse(w, r, model.NewErrPermission("access denied to sharing the board"))
|
2022-08-10 14:20:42 +02:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
auditRec := a.makeAuditRecord(r, "getSharing", audit.Fail)
|
|
|
|
defer a.audit.LogRecord(audit.LevelRead, auditRec)
|
|
|
|
auditRec.AddMeta("boardID", boardID)
|
|
|
|
|
|
|
|
sharing, err := a.app.GetSharing(boardID)
|
|
|
|
if err != nil {
|
2022-09-13 12:18:40 +02:00
|
|
|
a.errorResponse(w, r, err)
|
2022-08-10 14:20:42 +02:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
sharingData, err := json.Marshal(sharing)
|
|
|
|
if err != nil {
|
2022-09-13 12:18:40 +02:00
|
|
|
a.errorResponse(w, r, err)
|
2022-08-10 14:20:42 +02:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
jsonBytesResponse(w, http.StatusOK, sharingData)
|
|
|
|
|
|
|
|
a.logger.Debug("GET sharing",
|
|
|
|
mlog.String("boardID", boardID),
|
|
|
|
mlog.String("shareID", sharing.ID),
|
|
|
|
mlog.Bool("enabled", sharing.Enabled),
|
|
|
|
)
|
|
|
|
auditRec.AddMeta("shareID", sharing.ID)
|
|
|
|
auditRec.AddMeta("enabled", sharing.Enabled)
|
|
|
|
auditRec.Success()
|
|
|
|
}
|
|
|
|
|
|
|
|
func (a *API) handlePostSharing(w http.ResponseWriter, r *http.Request) {
|
|
|
|
// swagger:operation POST /boards/{boardID}/sharing postSharing
|
|
|
|
//
|
|
|
|
// Sets sharing information for a board
|
|
|
|
//
|
|
|
|
// ---
|
|
|
|
// produces:
|
|
|
|
// - application/json
|
|
|
|
// parameters:
|
|
|
|
// - name: boardID
|
|
|
|
// in: path
|
|
|
|
// description: Board ID
|
|
|
|
// required: true
|
|
|
|
// type: string
|
|
|
|
// - name: Body
|
|
|
|
// in: body
|
|
|
|
// description: sharing information for a root block
|
|
|
|
// required: true
|
|
|
|
// schema:
|
|
|
|
// "$ref": "#/definitions/Sharing"
|
|
|
|
// security:
|
|
|
|
// - BearerAuth: []
|
|
|
|
// responses:
|
|
|
|
// '200':
|
|
|
|
// description: success
|
|
|
|
// default:
|
|
|
|
// description: internal error
|
|
|
|
// schema:
|
|
|
|
// "$ref": "#/definitions/ErrorResponse"
|
|
|
|
|
|
|
|
boardID := mux.Vars(r)["boardID"]
|
|
|
|
|
|
|
|
userID := getUserID(r)
|
|
|
|
if !a.permissions.HasPermissionToBoard(userID, boardID, model.PermissionShareBoard) {
|
2022-09-13 12:18:40 +02:00
|
|
|
a.errorResponse(w, r, model.NewErrPermission("access denied to sharing the board"))
|
2022-08-10 14:20:42 +02:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2022-09-13 12:18:40 +02:00
|
|
|
requestBody, err := io.ReadAll(r.Body)
|
2022-08-10 14:20:42 +02:00
|
|
|
if err != nil {
|
2022-09-13 12:18:40 +02:00
|
|
|
a.errorResponse(w, r, err)
|
2022-08-10 14:20:42 +02:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
var sharing model.Sharing
|
|
|
|
err = json.Unmarshal(requestBody, &sharing)
|
|
|
|
if err != nil {
|
2022-09-13 12:18:40 +02:00
|
|
|
a.errorResponse(w, r, err)
|
2022-08-10 14:20:42 +02:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// Stamp boardID from the URL
|
|
|
|
sharing.ID = boardID
|
|
|
|
|
|
|
|
auditRec := a.makeAuditRecord(r, "postSharing", audit.Fail)
|
|
|
|
defer a.audit.LogRecord(audit.LevelModify, auditRec)
|
|
|
|
auditRec.AddMeta("shareID", sharing.ID)
|
|
|
|
auditRec.AddMeta("enabled", sharing.Enabled)
|
|
|
|
|
|
|
|
// Stamp ModifiedBy
|
|
|
|
modifiedBy := userID
|
|
|
|
if userID == model.SingleUser {
|
|
|
|
modifiedBy = ""
|
|
|
|
}
|
|
|
|
sharing.ModifiedBy = modifiedBy
|
|
|
|
|
|
|
|
if userID == model.SingleUser {
|
|
|
|
userID = ""
|
|
|
|
}
|
|
|
|
|
|
|
|
if !a.app.GetClientConfig().EnablePublicSharedBoards {
|
|
|
|
a.logger.Warn(
|
|
|
|
"Attempt to turn on sharing for board via API failed, sharing off in configuration.",
|
|
|
|
mlog.String("boardID", sharing.ID),
|
|
|
|
mlog.String("userID", userID))
|
2022-09-13 12:18:40 +02:00
|
|
|
a.errorResponse(w, r, ErrTurningOnSharing)
|
2022-08-10 14:20:42 +02:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
sharing.ModifiedBy = userID
|
|
|
|
|
|
|
|
err = a.app.UpsertSharing(sharing)
|
|
|
|
if err != nil {
|
2022-09-13 12:18:40 +02:00
|
|
|
a.errorResponse(w, r, err)
|
2022-08-10 14:20:42 +02:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
jsonStringResponse(w, http.StatusOK, "{}")
|
|
|
|
|
|
|
|
a.logger.Debug("POST sharing", mlog.String("sharingID", sharing.ID))
|
|
|
|
auditRec.Success()
|
|
|
|
}
|