overleaf/services/web/app/coffee/Features/TokenAccess/TokenAccessHandler.coffee

175 lines
6.5 KiB
CoffeeScript
Raw Normal View History

2017-09-22 09:54:35 -04:00
Project = require('../../models/Project').Project
CollaboratorsHandler = require('../Collaborators/CollaboratorsHandler')
2017-09-22 09:54:35 -04:00
PublicAccessLevels = require '../Authorization/PublicAccessLevels'
PrivilegeLevels = require '../Authorization/PrivilegeLevels'
UserGetter = require '../User/UserGetter'
2017-09-22 09:54:35 -04:00
ObjectId = require("mongojs").ObjectId
Settings = require('settings-sharelatex')
logger = require('logger-sharelatex')
V1Api = require "../V1/V1Api"
crypto = require 'crypto'
2017-09-22 09:54:35 -04:00
module.exports = TokenAccessHandler =
ANONYMOUS_READ_AND_WRITE_ENABLED:
Settings.allowAnonymousReadAndWriteSharing == true
_extractNumericPrefix: (token) ->
token.match(/^(\d+)\w+/)
_getProjectByReadOnlyToken: (token, callback=(err, project)->) ->
2017-09-22 09:54:35 -04:00
Project.findOne {
'tokens.readOnly': token
}, {_id: 1, tokens: 1, publicAccesLevel: 1, owner_ref: 1}, callback
_getProjectByEitherToken: (token, callback=(err, project)->) ->
TokenAccessHandler._getProjectByReadOnlyToken token, (err, project) ->
return callback(err) if err?
if project?
return callback(null, project)
TokenAccessHandler._getProjectByReadAndWriteToken token, (err, project) ->
return callback(err) if err?
callback(null, project)
_getProjectByReadAndWriteToken: (token, callback=(err, project)->) ->
numericPrefixMatch = TokenAccessHandler._extractNumericPrefix(token)
if !numericPrefixMatch
return callback(null, null)
numerics = numericPrefixMatch[1]
Project.findOne {
'tokens.readAndWritePrefix': numerics
}, {_id: 1, tokens: 1, publicAccesLevel: 1, owner_ref: 1}, (err, project) ->
return callback(err) if err?
if !project?
return callback(null, null)
try
if !crypto.timingSafeEqual(new Buffer(token), new Buffer(project.tokens.readAndWrite))
logger.err {token}, "read-and-write token match on numeric section, but not on full token"
return callback(null, null)
else
return callback(null, project)
catch err
logger.err {token, cryptoErr: err}, "error comparing tokens"
return callback(null, null)
findProjectWithReadOnlyToken: (token, callback=(err, project, projectExists)->) ->
TokenAccessHandler._getProjectByReadOnlyToken token, (err, project) ->
if err?
return callback(err)
if !project?
return callback(null, null, false) # Project doesn't exist, so we handle differently
if project.publicAccesLevel != PublicAccessLevels.TOKEN_BASED
return callback(null, null, true) # Project does exist, but it isn't token based
return callback(null, project, true)
2017-09-22 09:54:35 -04:00
findProjectWithReadAndWriteToken: (token, callback=(err, project, projectExists)->) ->
TokenAccessHandler._getProjectByReadAndWriteToken token, (err, project) ->
if err?
return callback(err)
if !project?
return callback(null, null, false) # Project doesn't exist, so we handle differently
if project.publicAccesLevel != PublicAccessLevels.TOKEN_BASED
return callback(null, null, true) # Project does exist, but it isn't token based
return callback(null, project, true)
2017-09-22 09:54:35 -04:00
_userIsMember: (userId, projectId, callback=(err, isMember)->) ->
CollaboratorsHandler.isUserInvitedMemberOfProject userId, projectId, callback
findProjectWithHigherAccess: (token, userId, callback=(err, project)->) ->
TokenAccessHandler._getProjectByEitherToken token, (err, project) ->
return callback(err) if err?
if !project?
return callback(null, null)
projectId = project._id
TokenAccessHandler._userIsMember userId, projectId, (err, isMember) ->
return callback(err) if err?
callback(
null,
if isMember == true then project else null
)
2017-09-22 09:54:35 -04:00
addReadOnlyUserToProject: (userId, projectId, callback=(err)->) ->
userId = ObjectId(userId.toString())
projectId = ObjectId(projectId.toString())
Project.update {
_id: projectId
}, {
$addToSet: {tokenAccessReadOnly_refs: userId}
2017-10-03 09:14:22 -04:00
}, callback
2017-09-22 09:54:35 -04:00
addReadAndWriteUserToProject: (userId, projectId, callback=(err)->) ->
userId = ObjectId(userId.toString())
projectId = ObjectId(projectId.toString())
Project.update {
_id: projectId
}, {
$addToSet: {tokenAccessReadAndWrite_refs: userId}
2017-10-03 09:14:22 -04:00
}, callback
2017-09-22 09:54:35 -04:00
grantSessionTokenAccess: (req, projectId, token) ->
2017-09-22 09:54:35 -04:00
if req.session?
if !req.session.anonTokenAccess?
req.session.anonTokenAccess = {}
req.session.anonTokenAccess[projectId.toString()] = token.toString()
2017-09-22 09:54:35 -04:00
getRequestToken: (req, projectId) ->
2017-09-27 09:01:52 -04:00
token = (
req?.session?.anonTokenAccess?[projectId.toString()] or
req?.headers['x-sl-anonymous-access-token']
2017-09-27 09:01:52 -04:00
)
return token
isValidToken: (projectId, token, callback=(err, isValidReadAndWrite, isValidReadOnly)->) ->
2017-09-27 09:01:52 -04:00
if !token
return callback null, false, false
_validate = (project) ->
project? and
project.publicAccesLevel == PublicAccessLevels.TOKEN_BASED and
project._id.toString() == projectId.toString()
TokenAccessHandler.findProjectWithReadAndWriteToken token, (err, readAndWriteProject) ->
2017-09-27 09:01:52 -04:00
return callback(err) if err?
isValidReadAndWrite = _validate(readAndWriteProject)
TokenAccessHandler.findProjectWithReadOnlyToken token, (err, readOnlyProject) ->
return callback(err) if err?
isValidReadOnly = _validate(readOnlyProject)
callback null, isValidReadAndWrite, isValidReadOnly
protectTokens: (project, privilegeLevel) ->
if project? && project.tokens?
if privilegeLevel == PrivilegeLevels.OWNER
return
if privilegeLevel != PrivilegeLevels.READ_AND_WRITE
project.tokens.readAndWrite = ''
project.tokens.readAndWritePrefix = ''
if privilegeLevel != PrivilegeLevels.READ_ONLY
project.tokens.readOnly = ''
getV1DocPublishedInfo: (token, callback = (err, publishedInfo) ->) ->
# default to allowing access
2018-10-02 11:16:46 -04:00
return callback(null, {
allow: true
}) unless Settings.apis?.v1?
V1Api.request { url: "/api/v1/sharelatex/docs/#{token}/is_published" }, (err, response, body) ->
return callback err if err?
callback null, body
getV1DocInfo: (token, v2UserId, callback=(err, info)->) ->
# default to not exported
return callback(null, {
exists: true
exported: false
}) unless Settings.apis?.v1?
UserGetter.getUser v2UserId, { overleaf: 1 }, (err, user) ->
return callback(err) if err?
v1UserId = user.overleaf?.id
V1Api.request { url: "/api/v1/sharelatex/users/#{v1UserId}/docs/#{token}/info" }, (err, response, body) ->
return callback err if err?
callback null, body
module.exports.READ_AND_WRITE_TOKEN_REGEX = /^(\d+)(\w+)$/
module.exports.READ_AND_WRITE_URL_REGEX = /^\/(\d+)(\w+)$/
module.exports.READ_ONLY_TOKEN_REGEX = /^([a-z]{12})$/
module.exports.READ_ONLY_URL_REGEX = /^\/read\/([a-z]{12})$/