overleaf/services/web/app/coffee/router.coffee

360 lines
20 KiB
CoffeeScript
Raw Normal View History

AdminController = require('./Features/ServerAdmin/AdminController')
2014-06-20 12:17:24 -04:00
ErrorController = require('./Features/Errors/ErrorController')
ProjectController = require("./Features/Project/ProjectController")
2014-02-12 05:23:40 -05:00
ProjectApiController = require("./Features/Project/ProjectApiController")
SpellingController = require('./Features/Spelling/SpellingController')
EditorController = require("./Features/Editor/EditorController")
EditorRouter = require("./Features/Editor/EditorRouter")
2014-02-12 05:23:40 -05:00
Settings = require('settings-sharelatex')
TpdsController = require('./Features/ThirdPartyDataStore/TpdsController')
SubscriptionRouter = require './Features/Subscription/SubscriptionRouter'
UploadsRouter = require './Features/Uploads/UploadsRouter'
metrics = require('metrics-sharelatex')
2014-02-12 05:23:40 -05:00
ReferalController = require('./Features/Referal/ReferalController')
AuthenticationController = require('./Features/Authentication/AuthenticationController')
TagsController = require("./Features/Tags/TagsController")
NotificationsController = require("./Features/Notifications/NotificationsController")
CollaboratorsRouter = require('./Features/Collaborators/CollaboratorsRouter')
UserInfoController = require('./Features/User/UserInfoController')
UserController = require("./Features/User/UserController")
UserPagesController = require('./Features/User/UserPagesController')
2014-02-12 05:23:40 -05:00
DocumentController = require('./Features/Documents/DocumentController')
CompileManager = require("./Features/Compile/CompileManager")
CompileController = require("./Features/Compile/CompileController")
2016-08-31 11:10:24 -04:00
ClsiCookieManager = require("./Features/Compile/ClsiCookieManager")
2014-02-12 05:23:40 -05:00
HealthCheckController = require("./Features/HealthCheck/HealthCheckController")
ProjectDownloadsController = require "./Features/Downloads/ProjectDownloadsController"
FileStoreController = require("./Features/FileStore/FileStoreController")
HistoryController = require("./Features/History/HistoryController")
2014-05-15 11:20:23 -04:00
PasswordResetRouter = require("./Features/PasswordReset/PasswordResetRouter")
2014-06-20 12:17:24 -04:00
StaticPagesRouter = require("./Features/StaticPages/StaticPagesRouter")
ChatController = require("./Features/Chat/ChatController")
2014-07-09 14:49:39 -04:00
BlogController = require("./Features/Blog/BlogController")
2014-09-08 09:19:24 -04:00
Modules = require "./infrastructure/Modules"
2015-02-04 10:05:26 -05:00
RateLimiterMiddlewear = require('./Features/Security/RateLimiterMiddlewear')
CooldownMiddlewear = require('./Features/Cooldown/CooldownMiddlewear')
RealTimeProxyRouter = require('./Features/RealTimeProxy/RealTimeProxyRouter')
2015-08-13 17:50:39 -04:00
InactiveProjectController = require("./Features/InactiveData/InactiveProjectController")
ContactRouter = require("./Features/Contacts/ContactRouter")
ReferencesController = require('./Features/References/ReferencesController')
AuthorizationMiddlewear = require('./Features/Authorization/AuthorizationMiddlewear')
2016-06-07 08:41:50 -04:00
BetaProgramController = require('./Features/BetaProgram/BetaProgramController')
SudoModeController = require('./Features/SudoMode/SudoModeController')
SudoModeMiddlewear = require('./Features/SudoMode/SudoModeMiddlewear')
2016-08-10 11:42:56 -04:00
AnalyticsRouter = require('./Features/Analytics/AnalyticsRouter')
AnnouncementsController = require("./Features/Announcements/AnnouncementsController")
LabelsController = require('./Features/Labels/LabelsController')
2017-09-22 09:54:35 -04:00
TokenAccessController = require('./Features/TokenAccess/TokenAccessController')
Features = require('./infrastructure/Features')
2014-05-15 11:20:23 -04:00
2014-02-12 05:23:40 -05:00
logger = require("logger-sharelatex")
_ = require("underscore")
2014-02-12 05:23:40 -05:00
module.exports = class Router
constructor: (webRouter, privateApiRouter, publicApiRouter)->
if !Settings.allowPublicAccess
webRouter.all '*', AuthenticationController.requireGlobalLogin
webRouter.get '/login', UserPagesController.loginPage
AuthenticationController.addEndpointToLoginWhitelist '/login'
webRouter.post '/login', AuthenticationController.passportLogin
webRouter.get '/logout', UserController.logout
webRouter.get '/restricted', AuthorizationMiddlewear.restricted
2014-02-12 05:23:40 -05:00
if Features.hasFeature('registration')
webRouter.get '/register', UserPagesController.registerPage
AuthenticationController.addEndpointToLoginWhitelist '/register'
EditorRouter.apply(webRouter, privateApiRouter)
CollaboratorsRouter.apply(webRouter, privateApiRouter)
SubscriptionRouter.apply(webRouter, privateApiRouter, publicApiRouter)
UploadsRouter.apply(webRouter, privateApiRouter)
PasswordResetRouter.apply(webRouter, privateApiRouter)
StaticPagesRouter.apply(webRouter, privateApiRouter)
RealTimeProxyRouter.apply(webRouter, privateApiRouter)
ContactRouter.apply(webRouter, privateApiRouter)
AnalyticsRouter.apply(webRouter, privateApiRouter)
2016-09-02 11:17:37 -04:00
Modules.applyRouter(webRouter, privateApiRouter, publicApiRouter)
2014-02-12 05:23:40 -05:00
2014-07-09 14:49:39 -04:00
2014-02-12 05:23:40 -05:00
if Settings.enableSubscriptions
2016-09-23 09:42:57 -04:00
webRouter.get '/user/bonus', AuthenticationController.requireLogin(), ReferalController.bonus
webRouter.get '/blog', BlogController.getIndexPage
webRouter.get '/blog/*', BlogController.getPage
webRouter.get '/user/activate', UserPagesController.activateAccountPage
AuthenticationController.addEndpointToLoginWhitelist '/user/activate'
webRouter.get '/user/settings',
AuthenticationController.requireLogin(),
SudoModeMiddlewear.protectPage,
UserPagesController.settingsPage
webRouter.post '/user/settings', AuthenticationController.requireLogin(), UserController.updateUserSettings
webRouter.post '/user/password/update',
AuthenticationController.requireLogin(),
RateLimiterMiddlewear.rateLimit({
endpointName: "change-password"
maxRequests: 10
timeInterval: 60
}),
UserController.changePassword
2014-05-15 11:20:23 -04:00
webRouter.get '/user/sessions',
AuthenticationController.requireLogin(),
SudoModeMiddlewear.protectPage,
UserPagesController.sessionsPage
webRouter.post '/user/sessions/clear', AuthenticationController.requireLogin(), UserController.clearSessions
2016-10-06 10:49:47 -04:00
webRouter.delete '/user/newsletter/unsubscribe', AuthenticationController.requireLogin(), UserController.unsubscribe
webRouter.post '/user/delete', AuthenticationController.requireLogin(), UserController.tryDeleteUser
2014-02-12 05:23:40 -05:00
2016-03-10 12:15:14 -05:00
webRouter.get '/user/personal_info', AuthenticationController.requireLogin(), UserInfoController.getLoggedInUsersPersonalInfo
privateApiRouter.get '/user/:user_id/personal_info', AuthenticationController.httpAuth, UserInfoController.getPersonalInfo
webRouter.get '/project', AuthenticationController.requireLogin(), ProjectController.projectListPage
webRouter.post '/project/new', AuthenticationController.requireLogin(), ProjectController.newProject
2014-04-28 12:47:47 -04:00
webRouter.get '/Project/:Project_id', RateLimiterMiddlewear.rateLimit({
2015-02-04 10:05:26 -05:00
endpointName: "open-project"
params: ["Project_id"]
maxRequests: 10
timeInterval: 60
}), AuthorizationMiddlewear.ensureUserCanReadProject, ProjectController.loadEditor
webRouter.get '/Project/:Project_id/file/:File_id', AuthorizationMiddlewear.ensureUserCanReadProject, FileStoreController.getFile
webRouter.post '/project/:Project_id/settings', AuthorizationMiddlewear.ensureUserCanWriteProjectSettings, ProjectController.updateProjectSettings
webRouter.post '/project/:Project_id/settings/admin', AuthorizationMiddlewear.ensureUserCanAdminProject, ProjectController.updateProjectAdminSettings
2014-02-12 05:23:40 -05:00
2017-04-11 11:08:38 -04:00
webRouter.post '/project/:Project_id/compile', RateLimiterMiddlewear.rateLimit({
endpointName: "compile-project-http"
params: ["Project_id"]
maxRequests: 800
timeInterval: 60 * 60
}), AuthorizationMiddlewear.ensureUserCanReadProject, CompileController.compile
2016-07-14 09:48:46 -04:00
webRouter.post '/project/:Project_id/compile/stop', AuthorizationMiddlewear.ensureUserCanReadProject, CompileController.stopCompile
# Used by the web download buttons, adds filename header
webRouter.get '/project/:Project_id/output/output.pdf', AuthorizationMiddlewear.ensureUserCanReadProject, CompileController.downloadPdf
# Used by the pdf viewers
webRouter.get /^\/project\/([^\/]*)\/output\/(.*)$/,
2014-02-12 05:23:40 -05:00
((req, res, next) ->
params =
"Project_id": req.params[0]
"file": req.params[1]
req.params = params
next()
), AuthorizationMiddlewear.ensureUserCanReadProject, CompileController.getFileFromClsi
# direct url access to output files for a specific build (query string not required)
webRouter.get /^\/project\/([^\/]*)\/build\/([0-9a-f-]+)\/output\/(.*)$/,
((req, res, next) ->
params =
"Project_id": req.params[0]
"build_id": req.params[1]
"file": req.params[2]
2016-07-14 09:48:46 -04:00
req.params = params
next()
), AuthorizationMiddlewear.ensureUserCanReadProject, CompileController.getFileFromClsi
# direct url access to output files for user but no build, to retrieve files when build fails
2016-07-14 09:48:46 -04:00
webRouter.get /^\/project\/([^\/]*)\/user\/([0-9a-f-]+)\/output\/(.*)$/,
((req, res, next) ->
params =
"Project_id": req.params[0]
"user_id": req.params[1]
"file": req.params[2]
req.params = params
next()
), AuthorizationMiddlewear.ensureUserCanReadProject, CompileController.getFileFromClsi
# direct url access to output files for a specific user and build (query string not required)
webRouter.get /^\/project\/([^\/]*)\/user\/([0-9a-f]+)\/build\/([0-9a-f-]+)\/output\/(.*)$/,
((req, res, next) ->
params =
"Project_id": req.params[0]
"user_id": req.params[1]
"build_id": req.params[2]
"file": req.params[3]
req.params = params
next()
), AuthorizationMiddlewear.ensureUserCanReadProject, CompileController.getFileFromClsi
webRouter.delete "/project/:Project_id/output", AuthorizationMiddlewear.ensureUserCanReadProject, CompileController.deleteAuxFiles
webRouter.get "/project/:Project_id/sync/code", AuthorizationMiddlewear.ensureUserCanReadProject, CompileController.proxySyncCode
webRouter.get "/project/:Project_id/sync/pdf", AuthorizationMiddlewear.ensureUserCanReadProject, CompileController.proxySyncPdf
webRouter.get "/project/:Project_id/wordcount", AuthorizationMiddlewear.ensureUserCanReadProject, CompileController.wordCount
2014-02-12 05:23:40 -05:00
webRouter.delete '/Project/:Project_id', AuthorizationMiddlewear.ensureUserCanAdminProject, ProjectController.deleteProject
webRouter.post '/Project/:Project_id/restore', AuthorizationMiddlewear.ensureUserCanAdminProject, ProjectController.restoreProject
webRouter.post '/Project/:Project_id/clone', AuthorizationMiddlewear.ensureUserCanReadProject, ProjectController.cloneProject
2014-04-28 12:47:47 -04:00
webRouter.post '/project/:Project_id/rename', AuthorizationMiddlewear.ensureUserCanAdminProject, ProjectController.renameProject
2014-03-05 11:31:52 -05:00
webRouter.get "/project/:Project_id/updates", AuthorizationMiddlewear.ensureUserCanReadProject, HistoryController.proxyToHistoryApi
webRouter.get "/project/:Project_id/doc/:doc_id/diff", AuthorizationMiddlewear.ensureUserCanReadProject, HistoryController.proxyToHistoryApi
webRouter.post "/project/:Project_id/doc/:doc_id/version/:version_id/restore", AuthorizationMiddlewear.ensureUserCanReadProject, HistoryController.proxyToHistoryApi
webRouter.get '/Project/:Project_id/download/zip', AuthorizationMiddlewear.ensureUserCanReadProject, ProjectDownloadsController.downloadProject
webRouter.get '/project/download/zip', AuthorizationMiddlewear.ensureUserCanReadMultipleProjects, ProjectDownloadsController.downloadMultipleProjects
2014-02-12 05:23:40 -05:00
2017-06-12 06:37:05 -04:00
webRouter.get '/project/:project_id/labels', AuthorizationMiddlewear.ensureUserCanReadProject, AuthenticationController.requireLogin(), LabelsController.getAllLabels
webRouter.post '/project/:project_id/doc/:doc_id/labels', AuthorizationMiddlewear.ensureUserCanReadProject, AuthenticationController.requireLogin(), LabelsController.broadcastLabelsForDoc
webRouter.get '/tag', AuthenticationController.requireLogin(), TagsController.getAllTags
webRouter.post '/tag', AuthenticationController.requireLogin(), TagsController.createTag
webRouter.post '/tag/:tag_id/rename', AuthenticationController.requireLogin(), TagsController.renameTag
webRouter.delete '/tag/:tag_id', AuthenticationController.requireLogin(), TagsController.deleteTag
2016-01-29 08:29:25 -05:00
webRouter.post '/tag/:tag_id/project/:project_id', AuthenticationController.requireLogin(), TagsController.addProjectToTag
webRouter.delete '/tag/:tag_id/project/:project_id', AuthenticationController.requireLogin(), TagsController.removeProjectFromTag
2014-02-12 05:23:40 -05:00
webRouter.get '/notifications', AuthenticationController.requireLogin(), NotificationsController.getAllUnreadNotifications
2016-09-02 11:17:37 -04:00
webRouter.delete '/notifications/:notification_id', AuthenticationController.requireLogin(), NotificationsController.markNotificationAsRead
webRouter.get '/announcements', AuthenticationController.requireLogin(), AnnouncementsController.getUndreadAnnouncements
# Deprecated in favour of /internal/project/:project_id but still used by versioning
privateApiRouter.get '/project/:project_id/details', AuthenticationController.httpAuth, ProjectApiController.getProjectDetails
2014-02-12 05:23:40 -05:00
# New 'stable' /internal API end points
privateApiRouter.get '/internal/project/:project_id', AuthenticationController.httpAuth, ProjectApiController.getProjectDetails
privateApiRouter.get '/internal/project/:Project_id/zip', AuthenticationController.httpAuth, ProjectDownloadsController.downloadProject
privateApiRouter.get '/internal/project/:project_id/compile/pdf', AuthenticationController.httpAuth, CompileController.compileAndDownloadPdf
2015-07-08 08:29:10 -04:00
privateApiRouter.post '/internal/deactivateOldProjects', AuthenticationController.httpAuth, InactiveProjectController.deactivateOldProjects
privateApiRouter.post '/internal/project/:project_id/deactivate', AuthenticationController.httpAuth, InactiveProjectController.deactivateProject
2015-08-13 17:50:39 -04:00
webRouter.get /^\/internal\/project\/([^\/]*)\/output\/(.*)$/,
((req, res, next) ->
params =
"Project_id": req.params[0]
"file": req.params[1]
req.params = params
next()
), AuthenticationController.httpAuth, CompileController.getFileFromClsi
2014-02-12 05:23:40 -05:00
privateApiRouter.get '/project/:Project_id/doc/:doc_id', AuthenticationController.httpAuth, DocumentController.getDocument
privateApiRouter.post '/project/:Project_id/doc/:doc_id', AuthenticationController.httpAuth, DocumentController.setDocument
2014-02-12 05:23:40 -05:00
privateApiRouter.post '/user/:user_id/update/*', AuthenticationController.httpAuth, TpdsController.mergeUpdate
privateApiRouter.delete '/user/:user_id/update/*', AuthenticationController.httpAuth, TpdsController.deleteUpdate
privateApiRouter.post '/project/:project_id/contents/*', AuthenticationController.httpAuth, TpdsController.updateProjectContents
privateApiRouter.delete '/project/:project_id/contents/*', AuthenticationController.httpAuth, TpdsController.deleteProjectContents
2014-02-12 05:23:40 -05:00
webRouter.post "/spelling/check", AuthenticationController.requireLogin(), SpellingController.proxyRequestToSpellingApi
webRouter.post "/spelling/learn", AuthenticationController.requireLogin(), SpellingController.proxyRequestToSpellingApi
2014-02-12 05:23:40 -05:00
2016-12-16 11:42:41 -05:00
webRouter.get "/project/:project_id/messages", AuthorizationMiddlewear.ensureUserCanReadProject, ChatController.getMessages
webRouter.post "/project/:project_id/messages", AuthorizationMiddlewear.ensureUserCanReadProject, ChatController.sendMessage
webRouter.post "/project/:Project_id/references/index", AuthorizationMiddlewear.ensureUserCanReadProject, ReferencesController.index
webRouter.post "/project/:Project_id/references/indexAll", AuthorizationMiddlewear.ensureUserCanReadProject, ReferencesController.indexAll
2016-06-08 10:11:39 -04:00
webRouter.get "/beta/participate", AuthenticationController.requireLogin(), BetaProgramController.optInPage
2016-06-07 06:15:56 -04:00
webRouter.post "/beta/opt-in", AuthenticationController.requireLogin(), BetaProgramController.optIn
2016-06-08 10:11:39 -04:00
webRouter.post "/beta/opt-out", AuthenticationController.requireLogin(), BetaProgramController.optOut
webRouter.get "/confirm-password", AuthenticationController.requireLogin(), SudoModeController.sudoModePrompt
webRouter.post "/confirm-password", AuthenticationController.requireLogin(), SudoModeController.submitPassword
2016-06-07 06:15:56 -04:00
2014-02-12 05:23:40 -05:00
#Admin Stuff
webRouter.get '/admin', AuthorizationMiddlewear.ensureUserIsSiteAdmin, AdminController.index
webRouter.get '/admin/user', AuthorizationMiddlewear.ensureUserIsSiteAdmin, (req, res)-> res.redirect("/admin/register") #this gets removed by admin-panel addon
webRouter.get '/admin/register', AuthorizationMiddlewear.ensureUserIsSiteAdmin, AdminController.registerNewUser
webRouter.post '/admin/register', AuthorizationMiddlewear.ensureUserIsSiteAdmin, UserController.register
webRouter.post '/admin/closeEditor', AuthorizationMiddlewear.ensureUserIsSiteAdmin, AdminController.closeEditor
webRouter.post '/admin/dissconectAllUsers', AuthorizationMiddlewear.ensureUserIsSiteAdmin, AdminController.dissconectAllUsers
webRouter.post '/admin/syncUserToSubscription', AuthorizationMiddlewear.ensureUserIsSiteAdmin, AdminController.syncUserToSubscription
webRouter.post '/admin/flushProjectToTpds', AuthorizationMiddlewear.ensureUserIsSiteAdmin, AdminController.flushProjectToTpds
webRouter.post '/admin/pollDropboxForUser', AuthorizationMiddlewear.ensureUserIsSiteAdmin, AdminController.pollDropboxForUser
webRouter.post '/admin/messages', AuthorizationMiddlewear.ensureUserIsSiteAdmin, AdminController.createMessage
webRouter.post '/admin/messages/clear', AuthorizationMiddlewear.ensureUserIsSiteAdmin, AdminController.clearMessages
privateApiRouter.get '/perfTest', (req,res)->
2014-02-12 05:23:40 -05:00
res.send("hello")
publicApiRouter.get '/status', (req,res)->
2017-07-04 07:42:54 -04:00
res.send("web sharelatex is alive (web)")
privateApiRouter.get '/status', (req,res)->
2017-07-04 07:42:54 -04:00
res.send("web sharelatex is alive (api)")
webRouter.get '/dev/csrf', (req, res) ->
res.send res.locals.csrfToken
2014-02-12 05:23:40 -05:00
publicApiRouter.get '/health_check', HealthCheckController.check
privateApiRouter.get '/health_check', HealthCheckController.check
publicApiRouter.get '/health_check/redis', HealthCheckController.checkRedis
privateApiRouter.get '/health_check/redis', HealthCheckController.checkRedis
2014-02-12 05:23:40 -05:00
webRouter.get "/status/compiler/:Project_id", AuthorizationMiddlewear.ensureUserCanReadProject, (req, res) ->
2016-08-31 11:10:24 -04:00
project_id = req.params.Project_id
sendRes = _.once (statusCode, message)->
res.status statusCode
res.send message
2016-08-31 11:10:24 -04:00
ClsiCookieManager.clearServerId project_id # force every compile to a new server
# set a timeout
handler = setTimeout (() ->
sendRes 500, "Compiler timed out"
handler = null
2014-02-12 05:23:40 -05:00
), 10000
# use a valid user id for testing
test_user_id = "123456789012345678901234"
# run the compile
2016-08-31 11:10:24 -04:00
CompileManager.compile project_id, test_user_id, {}, (error, status) ->
clearTimeout handler if handler?
if error?
sendRes 500, "Compiler returned error #{error.message}"
else if status is "success"
sendRes 200, "Compiler returned in less than 10 seconds"
else
sendRes 500, "Compiler returned failure #{status}"
2014-02-12 05:23:40 -05:00
2017-06-19 10:54:57 -04:00
webRouter.get "/ip", (req, res, next) ->
2014-06-25 06:06:04 -04:00
res.send({
ip: req.ip
ips: req.ips
headers: req.headers
})
webRouter.get '/oops-express', (req, res, next) -> next(new Error("Test error"))
webRouter.get '/oops-internal', (req, res, next) -> throw new Error("Test error")
webRouter.get '/oops-mongo', (req, res, next) ->
2014-02-12 05:23:40 -05:00
require("./models/Project").Project.findOne {}, () ->
throw new Error("Test error")
privateApiRouter.get '/opps-small', (req, res, next)->
2014-09-18 09:37:23 -04:00
logger.err "test error occured"
res.send()
webRouter.post '/error/client', (req, res, next) ->
logger.warn err: req.body.error, meta: req.body.meta, "client side error"
metrics.inc("client-side-error")
2015-07-08 11:56:38 -04:00
res.sendStatus(204)
2017-09-22 09:54:35 -04:00
webRouter.get '/read/:read_only_token([a-z]+)',
RateLimiterMiddlewear.rateLimit({
endpointName: 'read-only-token',
maxRequests: 10,
timeInterval: 60
}),
2017-09-22 09:54:35 -04:00
TokenAccessController.readOnlyToken
webRouter.get '/:read_and_write_token([0-9]+[a-z]+)',
RateLimiterMiddlewear.rateLimit({
endpointName: 'read-and-write-token',
maxRequests: 10,
timeInterval: 60
}),
2017-09-22 09:54:35 -04:00
TokenAccessController.readAndWriteToken
2016-08-10 11:42:56 -04:00
webRouter.get '*', ErrorController.notFound
2017-10-25 05:34:18 -04:00