1
0
mirror of https://github.com/mattermost/focalboard.git synced 2024-12-21 13:38:56 +02:00
focalboard/server/api/api.go

568 lines
14 KiB
Go
Raw Normal View History

package api
2020-10-16 11:41:56 +02:00
import (
2020-10-16 16:21:42 +02:00
"context"
2020-10-16 11:41:56 +02:00
"encoding/json"
"fmt"
"io/ioutil"
"log"
"net/http"
"path/filepath"
2020-11-12 20:16:59 +02:00
"strconv"
2020-10-16 11:41:56 +02:00
"strings"
2020-12-07 21:40:16 +02:00
"time"
2020-10-16 11:41:56 +02:00
"github.com/gorilla/mux"
2021-01-27 00:13:46 +02:00
"github.com/mattermost/focalboard/server/app"
"github.com/mattermost/focalboard/server/model"
"github.com/mattermost/focalboard/server/utils"
2020-10-16 11:41:56 +02:00
)
const (
HEADER_REQUESTED_WITH = "X-Requested-With"
HEADER_REQUESTED_WITH_XML = "XMLHttpRequest"
)
2020-10-16 11:41:56 +02:00
// ----------------------------------------------------------------------------------------------------
// REST APIs
2020-10-16 16:21:42 +02:00
type API struct {
appBuilder func() *app.App
2020-12-04 12:28:35 +02:00
singleUser bool
2020-10-16 16:21:42 +02:00
}
2020-12-04 12:28:35 +02:00
func NewAPI(appBuilder func() *app.App, singleUser bool) *API {
return &API{appBuilder: appBuilder, singleUser: singleUser}
2020-10-16 16:21:42 +02:00
}
2020-10-16 11:41:56 +02:00
func (a *API) app() *app.App {
2020-10-16 16:21:42 +02:00
return a.appBuilder()
2020-10-16 11:41:56 +02:00
}
func (a *API) RegisterRoutes(r *mux.Router) {
a.addHandler(r, "/api/v1/blocks", "GET", a.sessionRequired(a.handleGetBlocks))
a.addHandler(r, "/api/v1/blocks", "POST", a.sessionRequired(a.handlePostBlocks))
a.addHandler(r, "/api/v1/blocks/{blockID}", "DELETE", a.sessionRequired(a.handleDeleteBlock))
a.addHandler(r, "/api/v1/blocks/{blockID}/subtree", "GET", a.attachSession(a.handleGetSubTree, false))
2020-12-07 21:40:16 +02:00
a.addHandler(r, "/api/v1/users/me", "GET", a.sessionRequired(a.handleGetMe))
a.addHandler(r, "/api/v1/users/{userID}", "GET", a.sessionRequired(a.handleGetUser))
a.addHandler(r, "/api/v1/users/{userID}/changepassword", "POST", a.sessionRequired(a.handleChangePassword))
2020-10-16 11:41:56 +02:00
a.addHandler(r, "/api/v1/login", "POST", a.sessionRequired(a.handleLogin))
a.addHandler(r, "/api/v1/register", "POST", a.sessionRequired(a.handleRegister))
2020-11-06 17:46:35 +02:00
a.addHandler(r, "api/v1/files", "POST", a.sessionRequired(a.handleUploadFile))
a.addHandler(r, "/files/{filename}", "GET", a.sessionRequired(a.handleServeFile))
2020-10-16 11:41:56 +02:00
a.addHandler(r, "/api/v1/blocks/export", "GET", a.sessionRequired(a.handleExport))
a.addHandler(r, "/api/v1/blocks/import", "POST", a.sessionRequired(a.handleImport))
2021-01-13 01:35:30 +02:00
a.addHandler(r, "/api/v1/sharing/{rootID}", "POST", a.sessionRequired(a.handlePostSharing))
a.addHandler(r, "/api/v1/sharing/{rootID}", "GET", a.sessionRequired(a.handleGetSharing))
2021-01-14 02:56:01 +02:00
a.addHandler(r, "/api/v1/workspace", "GET", a.sessionRequired(a.handleGetWorkspace))
a.addHandler(r, "/api/v1/workspace/regenerate_signup_token", "POST", a.sessionRequired(a.handlePostWorkspaceRegenerateSignupToken))
2020-10-16 11:41:56 +02:00
}
func (a *API) RegisterAdminRoutes(r *mux.Router) {
2021-01-23 00:14:12 +02:00
r.HandleFunc("/api/v1/admin/users/{username}/password", a.adminRequired(a.handleAdminSetPassword)).Methods("POST")
}
func (a *API) addHandler(r *mux.Router, path string, method string, f func(http.ResponseWriter, *http.Request)) {
r.HandleFunc(path, a.preHandle(f)).Methods(method)
}
func (a *API) preHandle(handler func(w http.ResponseWriter, r *http.Request)) func(w http.ResponseWriter, r *http.Request) {
return func(w http.ResponseWriter, r *http.Request) {
if !a.checkCSRFToken(r) {
log.Println("checkCSRFToken FAILED")
errorResponse(w, http.StatusBadRequest, nil, nil)
return
}
handler(w, r)
}
}
func (a *API) checkCSRFToken(r *http.Request) bool {
token := r.Header.Get(HEADER_REQUESTED_WITH)
if token == HEADER_REQUESTED_WITH_XML {
return true
}
return false
}
2020-10-16 11:41:56 +02:00
func (a *API) handleGetBlocks(w http.ResponseWriter, r *http.Request) {
query := r.URL.Query()
parentID := query.Get("parent_id")
blockType := query.Get("type")
2020-10-16 16:21:42 +02:00
blocks, err := a.app().GetBlocks(parentID, blockType)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-10-16 16:21:42 +02:00
return
2020-10-16 11:41:56 +02:00
}
2021-01-14 20:03:01 +02:00
// log.Printf("GetBlocks parentID: %s, type: %s, %d result(s)", parentID, blockType, len(blocks))
2020-10-16 11:41:56 +02:00
json, err := json.Marshal(blocks)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-10-16 11:41:56 +02:00
return
}
jsonBytesResponse(w, http.StatusOK, json)
}
2021-01-12 04:53:08 +02:00
func stampModifiedByUser(r *http.Request, blocks []model.Block) {
ctx := r.Context()
session := ctx.Value("session").(*model.Session)
userID := session.UserID
if userID == "single-user" {
userID = ""
}
for i := range blocks {
blocks[i].ModifiedBy = userID
}
}
2020-10-16 11:41:56 +02:00
func (a *API) handlePostBlocks(w http.ResponseWriter, r *http.Request) {
requestBody, err := ioutil.ReadAll(r.Body)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-10-16 11:41:56 +02:00
return
}
var blocks []model.Block
err = json.Unmarshal(requestBody, &blocks)
2020-10-16 11:41:56 +02:00
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-10-16 11:41:56 +02:00
return
}
for _, block := range blocks {
// Error checking
if len(block.Type) < 1 {
errorData := map[string]string{"description": "missing type", "id": block.ID}
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusBadRequest, errorData, nil)
2020-10-16 11:41:56 +02:00
return
}
2020-10-16 11:41:56 +02:00
if block.CreateAt < 1 {
errorData := map[string]string{"description": "invalid createAt", "id": block.ID}
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusBadRequest, errorData, nil)
2020-10-16 11:41:56 +02:00
return
}
2020-10-16 11:41:56 +02:00
if block.UpdateAt < 1 {
errorData := map[string]string{"description": "invalid UpdateAt", "id": block.ID}
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusBadRequest, errorData, nil)
2020-10-16 11:41:56 +02:00
return
}
}
2021-01-12 04:53:08 +02:00
stampModifiedByUser(r, blocks)
2020-10-16 16:21:42 +02:00
err = a.app().InsertBlocks(blocks)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-10-16 16:21:42 +02:00
return
}
2020-10-16 11:41:56 +02:00
log.Printf("POST Blocks %d block(s)", len(blocks))
jsonStringResponse(w, http.StatusOK, "{}")
}
2020-12-07 21:40:16 +02:00
func (a *API) handleGetUser(w http.ResponseWriter, r *http.Request) {
vars := mux.Vars(r)
userID := vars["userID"]
user, err := a.app().GetUser(userID)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-12-07 21:40:16 +02:00
return
}
userData, err := json.Marshal(user)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-12-07 21:40:16 +02:00
return
}
jsonStringResponse(w, http.StatusOK, string(userData))
}
func (a *API) handleGetMe(w http.ResponseWriter, r *http.Request) {
ctx := r.Context()
session := ctx.Value("session").(*model.Session)
var user *model.User
var err error
if session.UserID == "single-user" {
now := time.Now().Unix()
user = &model.User{
ID: "single-user",
Username: "single-user",
Email: "single-user",
CreateAt: now,
UpdateAt: now,
}
} else {
user, err = a.app().GetUser(session.UserID)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-12-07 21:40:16 +02:00
return
}
}
userData, err := json.Marshal(user)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-12-07 21:40:16 +02:00
return
}
jsonStringResponse(w, http.StatusOK, string(userData))
}
2020-10-16 11:41:56 +02:00
func (a *API) handleDeleteBlock(w http.ResponseWriter, r *http.Request) {
2021-01-12 21:16:25 +02:00
ctx := r.Context()
session := ctx.Value("session").(*model.Session)
userID := session.UserID
2020-10-16 11:41:56 +02:00
vars := mux.Vars(r)
blockID := vars["blockID"]
2021-01-12 21:16:25 +02:00
err := a.app().DeleteBlock(blockID, userID)
2020-10-16 16:21:42 +02:00
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-10-16 16:21:42 +02:00
return
2020-10-16 11:41:56 +02:00
}
log.Printf("DELETE Block %s", blockID)
jsonStringResponse(w, http.StatusOK, "{}")
}
func (a *API) handleGetSubTree(w http.ResponseWriter, r *http.Request) {
vars := mux.Vars(r)
blockID := vars["blockID"]
2021-01-13 04:49:08 +02:00
// If not authenticated (no session), check that block is publicly shared
ctx := r.Context()
session, _ := ctx.Value("session").(*model.Session)
if session == nil {
2021-01-13 19:40:37 +02:00
query := r.URL.Query()
readToken := query.Get("read_token")
// Require read token
if len(readToken) < 1 {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusUnauthorized, map[string]string{"error": "No read_token"}, nil)
2021-01-13 19:40:37 +02:00
return
}
2021-02-03 04:15:03 +02:00
isValid, err := a.app().IsValidReadToken(blockID, readToken)
2021-01-13 04:49:08 +02:00
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2021-01-13 04:49:08 +02:00
return
}
2021-02-03 04:15:03 +02:00
if !isValid {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusUnauthorized, nil, nil)
2021-01-13 04:49:08 +02:00
return
}
}
2020-11-12 20:16:59 +02:00
query := r.URL.Query()
levels, err := strconv.ParseInt(query.Get("l"), 10, 32)
if err != nil {
levels = 2
}
if levels != 2 && levels != 3 {
log.Printf(`ERROR Invalid levels: %d`, levels)
errorData := map[string]string{"description": "invalid levels"}
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, errorData, nil)
2020-11-12 20:16:59 +02:00
return
}
blocks, err := a.app().GetSubTree(blockID, int(levels))
2020-10-16 16:21:42 +02:00
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-10-16 16:21:42 +02:00
return
}
2020-10-16 11:41:56 +02:00
2020-11-12 20:16:59 +02:00
log.Printf("GetSubTree (%v) blockID: %s, %d result(s)", levels, blockID, len(blocks))
2020-10-16 11:41:56 +02:00
json, err := json.Marshal(blocks)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-10-16 11:41:56 +02:00
return
}
jsonBytesResponse(w, http.StatusOK, json)
}
func (a *API) handleExport(w http.ResponseWriter, r *http.Request) {
2020-10-16 16:21:42 +02:00
blocks, err := a.app().GetAllBlocks()
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-10-16 16:21:42 +02:00
return
}
2020-10-16 11:41:56 +02:00
2020-12-10 22:39:09 +02:00
log.Printf("%d raw block(s)", len(blocks))
blocks = filterOrphanBlocks(blocks)
2020-12-14 21:24:38 +02:00
log.Printf("EXPORT %d filtered block(s)", len(blocks))
2020-10-16 11:41:56 +02:00
json, err := json.Marshal(blocks)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-10-16 11:41:56 +02:00
return
}
jsonBytesResponse(w, http.StatusOK, json)
}
2020-12-10 22:39:09 +02:00
func filterOrphanBlocks(blocks []model.Block) (ret []model.Block) {
2020-12-14 21:24:38 +02:00
queue := make([]model.Block, 0)
var childrenOfBlockWithID = make(map[string]*[]model.Block)
// Build the trees from nodes
2020-12-10 22:39:09 +02:00
for _, block := range blocks {
2020-12-14 21:24:38 +02:00
if len(block.ParentID) == 0 {
// Queue root blocks to process first
queue = append(queue, block)
} else {
siblings := childrenOfBlockWithID[block.ParentID]
if siblings != nil {
*siblings = append(*siblings, block)
} else {
siblings := []model.Block{block}
childrenOfBlockWithID[block.ParentID] = &siblings
}
2020-12-10 22:39:09 +02:00
}
}
2020-12-14 21:24:38 +02:00
// Map the trees to an array, which skips orphaned nodes
blocks = make([]model.Block, 0)
for len(queue) > 0 {
block := queue[0]
queue = queue[1:] // dequeue
blocks = append(blocks, block)
children := childrenOfBlockWithID[block.ID]
if children != nil {
queue = append(queue, (*children)...)
}
}
return blocks
2020-12-10 22:39:09 +02:00
}
func arrayContainsBlockWithID(array []model.Block, blockID string) bool {
for _, item := range array {
if item.ID == blockID {
return true
}
}
return false
}
2020-10-16 11:41:56 +02:00
func (a *API) handleImport(w http.ResponseWriter, r *http.Request) {
requestBody, err := ioutil.ReadAll(r.Body)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-10-16 11:41:56 +02:00
return
}
var blocks []model.Block
err = json.Unmarshal(requestBody, &blocks)
2020-10-16 11:41:56 +02:00
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2020-10-16 11:41:56 +02:00
return
}
2021-01-12 04:53:08 +02:00
stampModifiedByUser(r, blocks)
err = a.app().InsertBlocks(blocks)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
return
2020-10-16 11:41:56 +02:00
}
log.Printf("IMPORT Blocks %d block(s)", len(blocks))
jsonStringResponse(w, http.StatusOK, "{}")
}
2021-01-13 01:35:30 +02:00
// Sharing
func (a *API) handleGetSharing(w http.ResponseWriter, r *http.Request) {
vars := mux.Vars(r)
rootID := vars["rootID"]
sharing, err := a.app().GetSharing(rootID)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2021-01-13 01:35:30 +02:00
return
}
sharingData, err := json.Marshal(sharing)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2021-01-13 01:35:30 +02:00
return
}
log.Printf("GET sharing %s", rootID)
jsonStringResponse(w, http.StatusOK, string(sharingData))
}
func (a *API) handlePostSharing(w http.ResponseWriter, r *http.Request) {
requestBody, err := ioutil.ReadAll(r.Body)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2021-01-13 01:35:30 +02:00
return
}
var sharing model.Sharing
err = json.Unmarshal(requestBody, &sharing)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2021-01-13 01:35:30 +02:00
return
}
// Stamp ModifiedBy
ctx := r.Context()
session := ctx.Value("session").(*model.Session)
userID := session.UserID
if userID == "single-user" {
userID = ""
}
sharing.ModifiedBy = userID
err = a.app().UpsertSharing(sharing)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2021-01-13 01:35:30 +02:00
return
}
log.Printf("POST sharing %s", sharing.ID)
jsonStringResponse(w, http.StatusOK, "{}")
}
2021-01-14 02:56:01 +02:00
// Workspace
func (a *API) handleGetWorkspace(w http.ResponseWriter, r *http.Request) {
workspace, err := a.app().GetRootWorkspace()
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2021-01-14 02:56:01 +02:00
return
}
workspaceData, err := json.Marshal(workspace)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2021-01-14 02:56:01 +02:00
return
}
jsonStringResponse(w, http.StatusOK, string(workspaceData))
}
func (a *API) handlePostWorkspaceRegenerateSignupToken(w http.ResponseWriter, r *http.Request) {
workspace, err := a.app().GetRootWorkspace()
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2021-01-14 02:56:01 +02:00
return
}
workspace.SignupToken = utils.CreateGUID()
err = a.app().UpsertWorkspaceSignupToken(*workspace)
if err != nil {
2021-01-14 20:03:01 +02:00
errorResponse(w, http.StatusInternalServerError, nil, err)
2021-01-14 02:56:01 +02:00
return
}
jsonStringResponse(w, http.StatusOK, "{}")
}
2020-10-16 11:41:56 +02:00
// File upload
func (a *API) handleServeFile(w http.ResponseWriter, r *http.Request) {
vars := mux.Vars(r)
filename := vars["filename"]
contentType := "image/jpg"
2020-10-16 11:41:56 +02:00
fileExtension := strings.ToLower(filepath.Ext(filename))
if fileExtension == "png" {
contentType = "image/png"
}
w.Header().Set("Content-Type", contentType)
2020-10-16 16:36:08 +02:00
filePath := a.app().GetFilePath(filename)
2020-10-16 11:41:56 +02:00
http.ServeFile(w, r, filePath)
}
func (a *API) handleUploadFile(w http.ResponseWriter, r *http.Request) {
fmt.Println(`handleUploadFile`)
2020-10-16 11:41:56 +02:00
file, handle, err := r.FormFile("file")
if err != nil {
fmt.Fprintf(w, "%v", err)
2020-10-16 11:41:56 +02:00
return
}
defer file.Close()
log.Printf(`handleUploadFile, filename: %s`, handle.Filename)
2020-10-16 16:36:08 +02:00
url, err := a.app().SaveFile(file, handle.Filename)
2020-10-16 11:41:56 +02:00
if err != nil {
jsonStringResponse(w, http.StatusInternalServerError, `{}`)
2020-10-16 11:41:56 +02:00
return
}
2020-10-16 11:41:56 +02:00
log.Printf(`saveFile, url: %s`, url)
json := fmt.Sprintf(`{ "url": "%s" }`, url)
jsonStringResponse(w, http.StatusOK, json)
}
// Response helpers
func jsonStringResponse(w http.ResponseWriter, code int, message string) {
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(code)
fmt.Fprint(w, message)
}
func jsonBytesResponse(w http.ResponseWriter, code int, json []byte) {
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(code)
w.Write(json)
}
2021-01-14 20:03:01 +02:00
func errorResponse(w http.ResponseWriter, code int, message map[string]string, sourceError error) {
log.Printf("API ERROR %d, err: %v\n", code, sourceError)
2020-11-17 16:43:56 +02:00
w.Header().Set("Content-Type", "application/json")
data, err := json.Marshal(message)
if err != nil {
data = []byte("{}")
}
2020-10-16 11:41:56 +02:00
w.WriteHeader(code)
2020-11-12 20:16:59 +02:00
w.Write(data)
2020-10-16 11:41:56 +02:00
}
2020-10-16 16:21:42 +02:00
func addUserID(rw http.ResponseWriter, req *http.Request, next http.Handler) {
ctx := context.WithValue(req.Context(), "userid", req.Header.Get("userid"))
req = req.WithContext(ctx)
next.ServeHTTP(rw, req)
}