Merge branch 'master' of https://github.com/coralproject/talk into settings-in-stream

routes/api/actions/index.js

@@ -6,7 +6,8 @@ const router = express.Router();
 router.delete('/:action_id', (req, res, next) => {
   Action
     .findOneAndRemove({
-      id: req.params.action_id
+      id: req.params.action_id,
+      user_id: req.user.id
     })
     .then(() => {
       res.status(204).end();

routes/api/asset/index.js

@@ -1,44 +1,81 @@
 const express = require('express');
 const router = express.Router();
-const Asset = require('../../../models/asset');
 
-// Search assets.
+const Asset = require('../../../models/asset');
+const scraper = require('../../../services/scraper');
+
+// List assets.
 router.get('/', (req, res, next) => {
 
-  let query = {};
+  const {
+    limit = 20,
+    skip = 0,
+    sort = 'asc',
+    field = 'created_at'
+  } = req.query;
 
-  if (typeof req.query.url !== 'undefined') {
-    query.url = req.query.url;
-  }
+  // Find all the assets.
+  Promise.all([
+    Asset
+      .find({})
+      .sort({[field]: (sort === 'asc') ? 1 : -1})
+      .skip(skip)
+      .limit(limit),
+    Asset.count()
+  ])
+  .then(([result, count]) => {
 
-  Asset.search(query)
-    .then((asset) => {
-      res.json(asset);
-    })
-    .catch(next);
+    // Send back the asset data.
+    res.json({
+      result,
+      count
+    });
+  })
+  .catch((err) => {
+    next(err);
+  });
 
 });
 
-// Get an asset by id
-router.get('/:id', (req, res, next) => {
+// Get an asset by id.
+router.get('/:asset_id', (req, res, next) => {
 
-  Asset.findById(req.params.id)
+  // Send back the asset.
+  Asset
+    .findById(req.params.asset_id)
     .then((asset) => {
+      if (!asset) {
+        return res.status(404).end();
+      }
+
       res.json(asset);
     })
-    .catch(next);
-
+    .catch((err) => {
+      next(err);
+    });
 });
 
-// Upsert an asset and return the affected document.
-router.put('/', (req, res, next) => {
+// Adds the asset id to the queue to be scraped.
+router.post('/:asset_id/scrape', (req, res, next) => {
 
-  Asset.upsert(req.body)
+  // Create a new asset scrape job.
+  Asset
+    .findById(req.params.asset_id)
     .then((asset) => {
-      res.json(asset);
-    })
-    .catch(next);
+      if (!asset) {
+        return res.status(404).end();
+      }
 
+      return scraper.create(asset);
+    })
+    .then((job) => {
+
+      // Send the job back for monitoring.
+      res.status(201).json(job);
+    })
+    .catch((err) => {
+      next(err);
+    });
 });
 
 module.exports = router;

routes/api/auth/index.js

@@ -7,14 +7,25 @@ const router = express.Router();
 /**
  * This returns the user if they are logged in.
  */
-router.get('/', authorization.needed(), (req, res) => {
+router.get('/', (req, res, next) => {
+  if (req.user) {
+    return next();
+  }
+
+  // When there is no user on the request, then just send back a 204 to this
+  // request. It's not really "an error" if what they asked for isn't available,
+  // but it could be.
+  res.status(204).end();
+}, (req, res) => {
+
+  // Send back the user object.
   res.json(req.user.toObject());
 });
 
 /**
  * This destroys the session of a user, if they have one.
  */
-router.delete('/', (req, res) => {
+router.delete('/', authorization.needed(), (req, res) => {
   req.session.destroy(() => {
     res.status(204).end();
   });

routes/api/comments/index.js

@@ -1,10 +1,11 @@
 const express = require('express');
 const Comment = require('../../../models/comment');
 const wordlist = require('../../../services/wordlist');
+const authorization = require('../../../middleware/authorization');
 
 const router = express.Router();
 
-router.get('/', (req, res, next) => {
+router.get('/', authorization.needed('admin'), (req, res, next) => {
   let query;
 
   if (req.query.status) {
@@ -28,8 +29,7 @@ router.post('/', wordlist.filter('body'), (req, res, next) => {
   const {
     body,
     asset_id,
-    parent_id,
-    author_id
+    parent_id
   } = req.body;
 
   Comment
@@ -38,7 +38,7 @@ router.post('/', wordlist.filter('body'), (req, res, next) => {
       asset_id,
       parent_id,
       status: req.wordlist.matched ? 'rejected' : '',
-      author_id
+      author_id: req.user.id
     })
     .then((comment) => {
 
@@ -49,7 +49,7 @@ router.post('/', wordlist.filter('body'), (req, res, next) => {
     });
 });
 
-router.get('/:comment_id', (req, res, next) => {
+router.get('/:comment_id', authorization.needed('admin'), (req, res, next) => {
   Comment
     .findById(req.params.comment_id)
     .then(comment => {
@@ -65,7 +65,7 @@ router.get('/:comment_id', (req, res, next) => {
     });
 });
 
-router.delete('/:comment_id', (req, res, next) => {
+router.delete('/:comment_id', authorization.needed('admin'), (req, res, next) => {
   Comment
     .removeById(req.params.comment_id)
     .then(() => {
@@ -76,7 +76,7 @@ router.delete('/:comment_id', (req, res, next) => {
     });
 });
 
-router.put('/:comment_id/status', (req, res, next) => {
+router.put('/:comment_id/status', authorization.needed('admin'), (req, res, next) => {
 
   const {
     status
@@ -95,12 +95,11 @@ router.put('/:comment_id/status', (req, res, next) => {
 router.post('/:comment_id/actions', (req, res, next) => {
 
   const {
-    user_id,
     action_type
   } = req.body;
 
   Comment
-    .addAction(req.params.comment_id, user_id, action_type)
+    .addAction(req.params.comment_id, req.user.id, action_type)
     .then((action) => {
       res.status(201).json(action);
     })

routes/api/index.js

@@ -1,14 +1,20 @@
 const express = require('express');
+const authorization = require('../../middleware/authorization');
 
 const router = express.Router();
 
-router.use('/asset', require('./asset'));
+router.use('/asset', authorization.needed('admin'), require('./asset'));
+router.use('/settings', authorization.needed('admin'), require('./settings'));
+router.use('/queue', authorization.needed('admin'), require('./queue'));
+
+router.use('/comments', authorization.needed(), require('./comments'));
+router.use('/actions', authorization.needed(), require('./actions'));
+
 router.use('/auth', require('./auth'));
-router.use('/comments', require('./comments'));
-router.use('/queue', require('./queue'));
-router.use('/settings', require('./settings'));
 router.use('/stream', require('./stream'));
 router.use('/user', require('./user'));
-router.use('/actions', require('./actions'));
+
+// Bind the kue handler to the /kue path.
+router.use('/kue', authorization.needed('admin'), require('../../kue').kue.app);
 
 module.exports = router;

routes/api/queue/index.js

@@ -1,6 +1,5 @@
 const express = require('express');
 const Comment = require('../../../models/comment');
-
 const Setting = require('../../../models/setting');
 
 const router = express.Router();

routes/api/settings/index.js

@@ -1,7 +1,8 @@
-const _ = require('lodash');
 const express = require('express');
-const router = express.Router();
 const Setting = require('../../../models/setting');
+const _ = require('lodash');
+
+const router = express.Router();
 
 router.get('/', (req, res, next) => {
   Setting

routes/api/stream/index.js

@@ -1,24 +1,33 @@
 const express = require('express');
 const _ = require('lodash');
+const scraper = require('../../../services/scraper');
 
 const Comment = require('../../../models/comment');
 const User = require('../../../models/user');
 const Action = require('../../../models/action');
 const Asset = require('../../../models/asset');
-
 const Setting = require('../../../models/setting');
 
 const router = express.Router();
 
-// Find all the comments by a specific asset_url.
-//  . if pre: get the comments that are accepted.
-//  . if post: get the comments that are new and accepted.
 router.get('/', (req, res, next) => {
 
   // Get the asset_id for this url (or create it if it doesn't exist)
   Promise.all([
-    Asset.findOrCreateByUrl(decodeURIComponent(req.query.asset_url)),
-    Setting.getSettings()
+    // Find or create the asset by url.
+    Asset.findOrCreateByUrl(decodeURIComponent(req.query.asset_url))
+
+      // Add the found asset to the scraper if it's not already scraped.
+      .then((asset) => {
+        if (!asset.scraped) {
+          return scraper.create(asset).then(() => asset);
+        }
+
+        return asset;
+      }),
+
+    // Get the moderation setting from the settings.
+    Setting.getModerationSetting()
   ])
   .then(([asset, settings]) => {
     // Get the sitewide moderation setting and return the appropriate comments
@@ -31,23 +40,49 @@ router.get('/', (req, res, next) => {
       return Promise.reject(new Error('Moderation setting not found.'));
     }
   })
-  // Get all the users and actions for those comments.
   .then(([comments, asset, settings]) => {
+
+    // Get the user id's from the author id's as a unique array that gets
+    // sorted.
+    let userIDs = _.uniq(comments.map((comment) => comment.author_id)).sort();
+
+    // Fetch the users for which there is a comment available for them.
+    let users = userIDs.length > 0 ? User.findByIdArray(userIDs) : [];
+
+    // Fetch the actions for pretty much everything at this point.
+    let actions = Action.getActionSummaries(_.uniq([
+
+      // Actions can be on assets...
+      asset.id,
+
+      // Comments...
+      ...comments.map((comment) => comment.id),
+
+      // Or Authors...
+      ...userIDs
+    ]), req.user ? req.user.id : false);
+
     return Promise.all([
-      [asset],
+
+      // Pass back the asset that we loaded...
+      asset,
+
+      // It's comments...
       comments,
-      User.findByIdArray(_.uniq(comments.map((comment) => comment.author_id))),
-      Action.getActionSummaries(_.uniq([
-        asset.id,
-        ...comments.map((comment) => comment.id),
-        ...comments.map((comment) => comment.author_id)
-      ])),
+
+      // The users who wrote those comments
+      users,
+
+      // The actions on the above items
+      actions,
+
+      // And the relevant settings
       settings
     ]);
   })
-  .then(([assets, comments, users, actions, settings]) => {
+  .then(([asset, comments, users, actions, settings]) => {
     res.json({
-      assets,
+      assets: [asset],
       comments,
       users,
       actions,

routes/api/user/index.js

@@ -7,15 +7,16 @@ const fs = require('fs');
 const path = require('path');
 const resetEmailFile = fs.readFileSync(path.resolve(__dirname, '../../../views/password-reset-email.ejs'));
 const resetEmailTemplate = ejs.compile(resetEmailFile.toString());
+const authorization = require('../../../middleware/authorization');
 
-router.get('/', (req, res, next) => {
+router.get('/', authorization.needed('admin'), (req, res, next) => {
   const {
     value = '',
     field = 'created_at',
     page = 1,
     asc = 'false',
     limit = 50 // Total Per Page
-    } = req.query;
+  } = req.query;
 
   Promise.all([
     User
@@ -49,7 +50,7 @@ router.get('/', (req, res, next) => {
   .catch(next);
 });
 
-router.post('/:user_id/role', (req, res, next) => {
+router.post('/:user_id/role', authorization.needed('admin'), (req, res, next) => {
   User
     .addRoleToUser(req.params.user_id, req.body.role)
     .then(role => {
@@ -127,9 +128,10 @@ router.post('/request-password-reset', (req, res, next) => {
       return mailer.sendSimple(options);
     })
     .then(() => {
+
       // we want to send a 204 regardless of the user being found in the db
       // if we fail on missing emails, it would reveal if people are registered or not.
-      res.status(204).send('OK');
+      res.status(204).end();
     })
     .catch(error => {
       const errorMsg = typeof error === 'string' ? error : error.message;