+
{lang.t('configure.enable-pre-moderation-text')}
{closedMessage}
- } - {!loggedIn &&{asset.settings.closedMessage}
+ } + {!loggedIn &&Asset ID: {data.asset.id}
+{lang.t('user-no-comment')}
} diff --git a/docs/swagger.yaml b/docs/swagger.yaml index 554afb29e..6f57f3918 100644 --- a/docs/swagger.yaml +++ b/docs/swagger.yaml @@ -916,7 +916,7 @@ definitions: type: array items: type: string - description: Roles occupied by the user (e.g. 'admin', 'moderator', etc.) + description: Roles occupied by the user (e.g. 'ADMIN', 'MODERATOR', etc.) status: type: string description: The current status of the user in the system. diff --git a/graph/context.js b/graph/context.js new file mode 100644 index 000000000..ce8f5eb83 --- /dev/null +++ b/graph/context.js @@ -0,0 +1,23 @@ +const loaders = require('./loaders'); +const mutators = require('./mutators'); + +/** + * Stores the request context. + */ +class Context { + constructor({user = null}) { + + // Load the current logged in user to `user`, otherwise this'll be null. + if (user) { + this.user = user; + } + + // Create the loaders. + this.loaders = loaders(this); + + // Create the mutators. + this.mutators = mutators(this); + } +} + +module.exports = Context; diff --git a/graph/index.js b/graph/index.js new file mode 100644 index 000000000..7fddce2eb --- /dev/null +++ b/graph/index.js @@ -0,0 +1,14 @@ +const schema = require('./schema'); +const Context = require('./context'); + +module.exports = { + createGraphOptions: (req) => ({ + + // Schema is created already, so just include it. + schema, + + // Load in the new context here, this'll create the loaders + mutators for + // the lifespan of this request. + context: new Context(req) + }) +}; diff --git a/graph/loaders/actions.js b/graph/loaders/actions.js new file mode 100644 index 000000000..cc7d43a12 --- /dev/null +++ b/graph/loaders/actions.js @@ -0,0 +1,28 @@ +const DataLoader = require('dataloader'); + +const util = require('./util'); + +const ActionsService = require('../../services/actions'); + +/** + * Looks up actions based on the requested id's all bounded by the user. + * @param {Object} context the context of the request + * @param {Array} ids array of id's to get + * @return {Promise} resolves to the promises of the requested actions + */ +const genActionSummariessByItemID = ({user = {}}, item_ids) => { + return ActionsService + .getActionSummaries(item_ids, user.id) + .then(util.arrayJoinBy(item_ids, 'item_id')); +}; + +/** + * Creates a set of loaders based on a GraphQL context. + * @param {Object} context the context of the GraphQL request + * @return {Object} object of loaders + */ +module.exports = (context) => ({ + Actions: { + getByItemID: new DataLoader((ids) => genActionSummariessByItemID(context, ids)), + } +}); diff --git a/graph/loaders/assets.js b/graph/loaders/assets.js new file mode 100644 index 000000000..a07a18a3f --- /dev/null +++ b/graph/loaders/assets.js @@ -0,0 +1,64 @@ +const DataLoader = require('dataloader'); +const url = require('url'); + +const errors = require('../../errors'); +const scraper = require('../../services/scraper'); +const util = require('./util'); + +const AssetModel = require('../../models/asset'); +const AssetsService = require('../../services/assets'); + +/** + * Retrieves assets by an array of ids. + * @param {Object} context the context of the request + * @param {Array} ids array of ids to lookup + */ +const genAssetsByID = (context, ids) => AssetModel.find({ + id: { + $in: ids + } +}).then(util.singleJoinBy(ids, 'id')); + +/** + * This endpoint find or creates an asset at the given url when it is loaded. + * @param {Object} context the context of the request + * @param {String} asset_url the url passed in from the query + * @returns {Promise} resolves to the asset + */ +const findOrCreateAssetByURL = (context, asset_url) => { + + // Verify that the asset_url is parsable. + let parsed_asset_url = url.parse(asset_url); + if (!parsed_asset_url.protocol) { + return Promise.reject(errors.ErrInvalidAssetURL); + } + + return AssetsService.findOrCreateByUrl(asset_url) + .then((asset) => { + + // If the asset wasn't scraped before, scrape it! Otherwise just return + // the asset. + if (!asset.scraped) { + return scraper.create(asset).then(() => asset); + } + + return asset; + }); +}; + +/** + * Creates a set of loaders based on a GraphQL context. + * @param {Object} context the context of the GraphQL request + * @return {Object} object of loaders + */ +module.exports = (context) => ({ + Assets: { + + // TODO: decide whether we want to move these to mutators or not, as in fact + // this operation create a new asset if one isn't found. + getByURL: (url) => findOrCreateAssetByURL(context, url), + + getByID: new DataLoader((ids) => genAssetsByID(context, ids)), + getAll: new util.SingletonResolver(() => AssetModel.find({})) + } +}); diff --git a/graph/loaders/comments.js b/graph/loaders/comments.js new file mode 100644 index 000000000..9a67bb621 --- /dev/null +++ b/graph/loaders/comments.js @@ -0,0 +1,98 @@ +const DataLoader = require('dataloader'); + +const util = require('./util'); + +const ActionModel = require('../../models/action'); +const CommentModel = require('../../models/comment'); +const CommentsService = require('../../services/comments'); + +/** + * Retrieves comments by an array of asset id's, results are returned in reverse + * chronological order. + * @param {Array} ids array of ids to lookup + */ +const genCommentsByAssetID = (context, ids) => { + return CommentModel.find({ + asset_id: { + $in: ids + }, + parent_id: null, + status: { + $in: [null, 'ACCEPTED'] + } + }) + .sort({created_at: -1}) + .then(util.arrayJoinBy(ids, 'asset_id')); +}; + +/** + * Retrieves comments by an array of parent ids, results are returned in + * chronological order. + * @param {Array} ids array of ids to lookup + */ +const genCommentsByParentID = (context, ids) => { + return CommentModel.find({ + parent_id: { + $in: ids + }, + status: { + $in: [null, 'ACCEPTED'] + } + }) + .sort({created_at: 1}) + .then(util.arrayJoinBy(ids, 'parent_id')); +}; + +const getCommentsByStatusAndAssetID = (context, {status = null, asset_id = null}) => { + + // TODO: remove when we move the enum over to the uppercase. + if (status) { + status = status.toLowerCase(); + } + + return CommentsService.moderationQueue(status, asset_id); +}; + +const getCommentsByActionTypeAndAssetID = (context, {action_type, asset_id = null}) => { + return ActionModel.find({ + action_type, + item_type: 'COMMENTS' + }).then((actions) => { + let comments = CommentModel.find({ + id: { + $in: actions.map((action) => action.item_id) + } + }).sort({created_at: 1}); + + if (asset_id) { + comments = comments.where({asset_id}); + } + + return comments; + }); +}; + +const genCommentsByAuthorID = (context, authorIDs) => { + return CommentModel.find({ + author_id: { + $in: authorIDs + } + }) + .sort({created_at: -1}) + .then(util.arrayJoinBy(authorIDs, 'author_id')); +}; + +/** + * Creates a set of loaders based on a GraphQL context. + * @param {Object} context the context of the GraphQL request + * @return {Object} object of loaders + */ +module.exports = (context) => ({ + Comments: { + getByParentID: new DataLoader((ids) => genCommentsByParentID(context, ids)), + getByAssetID: new DataLoader((ids) => genCommentsByAssetID(context, ids)), + getByStatusAndAssetID: (query) => getCommentsByStatusAndAssetID(context, query), + getByActionTypeAndAssetID: (query) => getCommentsByActionTypeAndAssetID(context, query), + getByAuthorID: new DataLoader((authorIDs) => genCommentsByAuthorID(context, authorIDs)) + } +}); diff --git a/graph/loaders/index.js b/graph/loaders/index.js new file mode 100644 index 000000000..536e40fa9 --- /dev/null +++ b/graph/loaders/index.js @@ -0,0 +1,28 @@ +const _ = require('lodash'); + +const Actions = require('./actions'); +const Assets = require('./assets'); +const Comments = require('./comments'); +const Settings = require('./settings'); +const Users = require('./users'); + +/** + * Creates a set of loaders based on a GraphQL context. + * @param {Object} context the context of the GraphQL request + * @return {Object} object of loaders + */ +module.exports = (context) => { + + // We need to return an object to be accessed. + return _.merge(...[ + Actions, + Assets, + Comments, + Settings, + Users + ].map((loaders) => { + + // Each loader is a function which takes the context. + return loaders(context); + })); +}; diff --git a/graph/loaders/settings.js b/graph/loaders/settings.js new file mode 100644 index 000000000..77ece165f --- /dev/null +++ b/graph/loaders/settings.js @@ -0,0 +1,12 @@ +const SettingsService = require('../../services/settings'); + +const util = require('./util'); + +/** + * Creates a set of loaders based on a GraphQL context. + * @param {Object} context the context of the GraphQL request + * @return {Object} object of loaders + */ +module.exports = () => ({ + Settings: new util.SingletonResolver(() => SettingsService.retrieve()) +}); diff --git a/graph/loaders/users.js b/graph/loaders/users.js new file mode 100644 index 000000000..90c661f71 --- /dev/null +++ b/graph/loaders/users.js @@ -0,0 +1,20 @@ +const DataLoader = require('dataloader'); + +const util = require('./util'); + +const UsersService = require('../../services/users'); + +const genUserByIDs = (context, ids) => UsersService + .findByIdArray(ids) + .then(util.singleJoinBy(ids, 'id')); + +/** + * Creates a set of loaders based on a GraphQL context. + * @param {Object} context the context of the GraphQL request + * @return {Object} object of loaders + */ +module.exports = (context) => ({ + Users: { + getByID: new DataLoader((ids) => genUserByIDs(context, ids)) + } +}); diff --git a/graph/loaders/util.js b/graph/loaders/util.js new file mode 100644 index 000000000..e947f2fa6 --- /dev/null +++ b/graph/loaders/util.js @@ -0,0 +1,68 @@ +const _ = require('lodash'); + +/** + * SingletonResolver is a cached loader for a single result. + */ +class SingletonResolver { + constructor(resolver) { + this._cache = null; + this._resolver = resolver; + } + + load() { + if (this._cache) { + return this._cache; + } + + let promise = this._resolver(arguments).then((result) => { + return result; + }); + + // Set the promise on the cache. + this._cache = promise; + + return promise; + } +} + +/** + * This joins a set of results with a specific keys and sets an empty array in + * place if it was not found. + * @param {Array} ids ids to locate + * @param {String} key key to group by + * @return {Array} array of results + */ +const arrayJoinBy = (ids, key) => (items) => { + const itemsByKey = _.groupBy(items, key); + return ids.map((id) => { + if (id in itemsByKey) { + return itemsByKey[id]; + } + + return []; + }); +}; + +/** + * This joins a set of results with a specific keys and sets null in place if it + * was not found. + * @param {Array} ids ids to locate + * @param {String} key key to group by + * @return {Array} array of results + */ +const singleJoinBy = (ids, key) => (items) => { + const itemsByKey = _.groupBy(items, key); + return ids.map((id) => { + if (id in itemsByKey) { + return itemsByKey[id][0]; + } + + return null; + }); +}; + +module.exports = { + singleJoinBy, + arrayJoinBy, + SingletonResolver +}; diff --git a/graph/mutators/action.js b/graph/mutators/action.js new file mode 100644 index 000000000..ab51c9a20 --- /dev/null +++ b/graph/mutators/action.js @@ -0,0 +1,55 @@ +const ActionModel = require('../../models/action'); +const ActionsService = require('../../services/actions'); + +/** + * Creates an action on a item. + * @param {Object} user the user performing the request + * @param {String} item_id id of the item to add the action to + * @param {String} item_type type of the item + * @param {String} action_type type of the action + * @return {Promise} resolves to the action created + */ +const createAction = ({user = {}}, {item_id, item_type, action_type, metadata = {}}) => { + return ActionsService.insertUserAction({ + item_id, + item_type, + user_id: user.id, + action_type, + metadata + }); +}; + +/** + * Deletes an action based on the user id if the user owns that action. + * @param {Object} user the user performing the request + * @param {String} id the id of the action to delete + * @return {Promise} resolves when the action is deleted + */ +const deleteAction = ({user}, {id}) => { + return ActionModel.remove({ + id, + user_id: user.id + }); +}; + +module.exports = (context) => { + + // TODO: refactor to something that'll return an error in the event an attempt + // is made to mutate state while not logged in. There's got to be a better way + // to do this. + if (context.user && context.user.can('mutation:createAction', 'mutation:deleteAction')) { + return { + Action: { + create: (action) => createAction(context, action), + delete: (action) => deleteAction(context, action) + } + }; + } + + return { + Action: { + create: () => {}, + delete: () => {} + } + }; +}; diff --git a/graph/mutators/comment.js b/graph/mutators/comment.js new file mode 100644 index 000000000..cc62e48df --- /dev/null +++ b/graph/mutators/comment.js @@ -0,0 +1,160 @@ +const errors = require('../../errors'); + +const AssetsService = require('../../services/assets'); +const CommentsService = require('../../services/comments'); + +const Wordlist = require('../../services/wordlist'); + +/** + * Creates a new comment. + * @param {Object} user the user performing the request + * @param {String} body body of the comment + * @param {String} asset_id asset for the comment + * @param {String} parent_id optional parent of the comment + * @param {String} [status=null] the status of the new comment + * @return {Promise} resolves to the created comment + */ +const createComment = ({user}, {body, asset_id, parent_id = null}, status = null) => { + return CommentsService.publicCreate({ + body, + asset_id, + parent_id, + status, + author_id: user.id + }); +}; + +/** + * Filters the comment object and outputs wordlist results. + * @param {Object} context graphql context + * @param {String} body body of a comment + * @return {Object} resolves to the wordlist results + */ +const filterNewComment = (context, {body}) => { + + // Create a new instance of the Wordlist. + const wl = new Wordlist(); + + // Load the wordlist and filter the comment content. + return wl.load().then(() => wl.scan('body', body)); +}; + +/** + * This resolves a given comment's status to take into account moderator actions + * are applied. + * @param {Object} context graphql context + * @param {String} body body of the comment + * @param {String} asset_id asset for the comment + * @param {Object} [wordlist={}] the results of the wordlist scan + * @return {Promise} resolves to the comment's status + */ +const resolveNewCommentStatus = (context, {asset_id, body}, wordlist = {}) => { + + // Decide the status based on whether or not the current asset/settings + // has pre-mod enabled or not. If the comment was rejected based on the + // wordlist, then reject it, otherwise if the moderation setting is + // premod, set it to `premod`. + let status; + + if (wordlist.banned) { + status = Promise.resolve('REJECTED'); + } else { + status = AssetsService + .rectifySettings(AssetsService.findById(asset_id).then((asset) => { + if (!asset) { + return Promise.reject(errors.ErrNotFound); + } + + // Check to see if the asset has closed commenting... + if (asset.isClosed) { + + // They have, ensure that we send back an error. + return Promise.reject(new errors.ErrAssetCommentingClosed(asset.closedMessage)); + } + + return asset; + })) + + // Return `premod` if pre-moderation is enabled and an empty "new" status + // in the event that it is not in pre-moderation mode. + .then(({moderation, charCountEnable, charCount}) => { + + // Reject if the comment is too long + if (charCountEnable && body.length > charCount) { + return 'REJECTED'; + } + return moderation === 'PRE' ? 'PREMOD' : null; + }); + } + + return status; +}; + +/** + * createPublicComment is designed to create a comment from a public source. It + * validates the comment, and performs some automated moderator actions based on + * the settings. + * @param {Object} context the graphql context + * @param {Object} commentInput the new comment to be created + * @return {Promise} resolves to a new comment + */ +const createPublicComment = (context, commentInput) => { + + // First we filter the comment contents to ensure that we note any validation + // issues. + return filterNewComment(context, commentInput) + + // We then take the wordlist and the comment into consideration when + // considering what status to assign the new comment, and resolve the new + // status to set the comment to. + .then((wordlist) => resolveNewCommentStatus(context, commentInput, wordlist) + + // Then we actually create the comment with the new status. + .then((status) => createComment(context, commentInput, status)) + .then((comment) => { + + // If the comment was flagged as being suspect, we need to add a + // flag to it to indicate that it needs to be looked at. + // Otherwise just return the new comment. + + // TODO: Check why the wordlist is undefined + if (wordlist != null) { + + // TODO: this is kind of fragile, we should refactor this to resolve + // all these const's that we're using like 'comments', 'flag' to be + // defined in a checkable schema. + return context.mutators.Action.createAction(null, { + item_id: comment.id, + item_type: 'COMMENTS', + action_type: 'FLAG', + metadata: { + field: 'body', + details: 'Matched suspect word filters.' + } + }).then(() => comment); + } + + // Finally, we return the comment. + return comment; + })); +}; + +module.exports = (context) => { + + // TODO: refactor to something that'll return an error in the event an attempt + // is made to mutate state while not logged in. There's got to be a better way + // to do this. + if (context.user && context.user.can('mutation:createComment')) { + return { + Comment: { + create: (comment) => createPublicComment(context, comment) + } + }; + } + + return { + Comment: { + create: () => {} + } + }; +}; diff --git a/graph/mutators/index.js b/graph/mutators/index.js new file mode 100644 index 000000000..b799cf83d --- /dev/null +++ b/graph/mutators/index.js @@ -0,0 +1,19 @@ +const _ = require('lodash'); + +const Comment = require('./comment'); +const Action = require('./action'); +const User = require('./user'); + +module.exports = (context) => { + + // We need to return an object to be accessed. + return _.merge(...[ + Comment, + Action, + User, + ].map((mutators) => { + + // Each set of mutators is a function which takes the context. + return mutators(context); + })); +}; diff --git a/graph/mutators/user.js b/graph/mutators/user.js new file mode 100644 index 000000000..96049bbab --- /dev/null +++ b/graph/mutators/user.js @@ -0,0 +1,31 @@ +const UsersService = require('../../services/users'); + +/** + * Updates a users settings. + * @param {Object} user the user performing the request + * @param {String} bio the new user bio + * @return {Promise} + */ +const updateUserSettings = ({user}, {bio}) => { + return UsersService.updateSettings(user.id, {bio}); +}; + +module.exports = (context) => { + + // TODO: refactor to something that'll return an error in the event an attempt + // is made to mutate state while not logged in. There's got to be a better way + // to do this. + if (context.user && context.user.can('mutation:updateUserSettings')) { + return { + User: { + updateSettings: (settings) => updateUserSettings(context, settings) + } + }; + } + + return { + User: { + updateSettings: () => {} + } + }; +}; diff --git a/graph/resolvers/action.js b/graph/resolvers/action.js new file mode 100644 index 000000000..e6886653e --- /dev/null +++ b/graph/resolvers/action.js @@ -0,0 +1,12 @@ +const Action = { + + // This will load the user for the specific action. We'll limit this to the + // admin users only. + user({user_id}, _, {loaders, user}) { + if (user.hasRole('ADMIN')) { + return loaders.Users.getByID.load(user_id); + } + } +}; + +module.exports = Action; diff --git a/graph/resolvers/action_summary.js b/graph/resolvers/action_summary.js new file mode 100644 index 000000000..48eff50c7 --- /dev/null +++ b/graph/resolvers/action_summary.js @@ -0,0 +1,3 @@ +const ActionSummary = {}; + +module.exports = ActionSummary; diff --git a/graph/resolvers/asset.js b/graph/resolvers/asset.js new file mode 100644 index 000000000..dcf6e1a75 --- /dev/null +++ b/graph/resolvers/asset.js @@ -0,0 +1,18 @@ +const Asset = { + comments({id}, _, {loaders}) { + return loaders.Comments.getByAssetID.load(id); + }, + settings({settings = null}, _, {loaders}) { + return loaders.Settings.load() + .then((globalSettings) => { + if (settings) { + settings = Object.assign({}, globalSettings.toObject(), settings); + } else { + settings = globalSettings.toObject(); + } + return settings; + }); + } +}; + +module.exports = Asset; diff --git a/graph/resolvers/comment.js b/graph/resolvers/comment.js new file mode 100644 index 000000000..ce2283cda --- /dev/null +++ b/graph/resolvers/comment.js @@ -0,0 +1,16 @@ +const Comment = { + user({author_id}, _, {loaders}) { + return loaders.Users.getByID.load(author_id); + }, + replies({id}, _, {loaders}) { + return loaders.Comments.getByParentID.load(id); + }, + actions({id}, _, {loaders}) { + return loaders.Actions.getByItemID.load(id); + }, + asset({asset_id}, _, {loaders}) { + return loaders.Assets.getByID.load(asset_id); + } +}; + +module.exports = Comment; diff --git a/graph/resolvers/index.js b/graph/resolvers/index.js new file mode 100644 index 000000000..064b1e664 --- /dev/null +++ b/graph/resolvers/index.js @@ -0,0 +1,19 @@ +const Action = require('./action'); +const ActionSummary = require('./action_summary'); +const Asset = require('./asset'); +const Comment = require('./comment'); +const RootMutation = require('./root_mutation'); +const RootQuery = require('./root_query'); +const Settings = require('./settings'); +const User = require('./user'); + +module.exports = { + Action, + ActionSummary, + Asset, + Comment, + RootMutation, + RootQuery, + Settings, + User +}; diff --git a/graph/resolvers/root_mutation.js b/graph/resolvers/root_mutation.js new file mode 100644 index 000000000..bf108671e --- /dev/null +++ b/graph/resolvers/root_mutation.js @@ -0,0 +1,16 @@ +const RootMutation = { + createComment(_, {asset_id, parent_id, body}, {mutators}) { + return mutators.Comment.create({asset_id, parent_id, body}); + }, + createAction(_, {action}, {mutators}) { + return mutators.Action.create(action); + }, + deleteAction(_, {id}, {mutators}) { + return mutators.Action.delete({id}); + }, + updateUserSettings(_, {settings}, {mutators}) { + return mutators.User.updateSettings(settings); + } +}; + +module.exports = RootMutation; diff --git a/graph/resolvers/root_query.js b/graph/resolvers/root_query.js new file mode 100644 index 000000000..5676b4f48 --- /dev/null +++ b/graph/resolvers/root_query.js @@ -0,0 +1,50 @@ +const RootQuery = { + assets(_, args, {loaders, user}) { + if (user == null || !user.hasRoles('ADMIN')) { + return null; + } + + return loaders.Assets.getAll.load(); + }, + asset(_, query, {loaders}) { + if (query.id) { + + // TODO: we may not always have a comment stream here, therefore, when we + // load it, we may also need to create with the url. This may also have to + // move the logic over to the mutators function as an upsert operation + // possibly. + return loaders.Assets.getByID.load(query.id); + } + + return loaders.Assets.getByURL(query.url); + }, + settings(_, args, {loaders}) { + return loaders.Settings.load(); + }, + + // This endpoint is used for loading moderation queues, so hide it in the + // event that we aren't an admin. + comments(_, {query}, {loaders, user}) { + if (user == null || !user.hasRoles('ADMIN')) { + return null; + } + + if (query.action_type) { + return loaders.Comments.getByActionTypeAndAssetID(query); + } else { + return loaders.Comments.getByStatusAndAssetID(query); + } + }, + + // This returns the current user, ensure that if we aren't logged in, we + // return null. + me(_, args, {user}) { + if (user == null) { + return null; + } + + return user; + } +}; + +module.exports = RootQuery; diff --git a/graph/resolvers/settings.js b/graph/resolvers/settings.js new file mode 100644 index 000000000..72608a9c4 --- /dev/null +++ b/graph/resolvers/settings.js @@ -0,0 +1,3 @@ +const Settings = {}; + +module.exports = Settings; diff --git a/graph/resolvers/user.js b/graph/resolvers/user.js new file mode 100644 index 000000000..65882feee --- /dev/null +++ b/graph/resolvers/user.js @@ -0,0 +1,17 @@ +const User = { + actions({id}, _, {loaders}) { + return loaders.Actions.getByID.load(id); + }, + comments({id}, _, {loaders, user}) { + + // If the user is not an admin, only return comment list for the owner of + // the comments. + if (!user.hasRoles('ADMIN') || user.id !== id) { + return null; + } + + return loaders.Comments.getByAuthorID.load(id); + } +}; + +module.exports = User; diff --git a/graph/schema.js b/graph/schema.js new file mode 100644 index 000000000..b4b42b809 --- /dev/null +++ b/graph/schema.js @@ -0,0 +1,8 @@ +const tools = require('graphql-tools'); + +const resolvers = require('./resolvers'); +const typeDefs = require('./typeDefs'); + +const schema = tools.makeExecutableSchema({typeDefs, resolvers}); + +module.exports = schema; diff --git a/graph/typeDefs.graphql b/graph/typeDefs.graphql new file mode 100644 index 000000000..167f75f4f --- /dev/null +++ b/graph/typeDefs.graphql @@ -0,0 +1,177 @@ +interface ActionableItem { + id: ID! +} + +type UserSettings { + # bio of the user. + bio: String +} + +input CommentsInput { + # current status of a comment. + status: COMMENT_STATUS + + # asset that a comment is on. + asset_id: ID + + # action type to find comments that have an action with. + action_type: ACTION_TYPE +} + +# Any person who can author comments, create actions, and view comments on a +# stream. +type User { + id: ID! + + # display name of a user. + displayName: String! + + # actions against a specific user. + actions: [ActionSummary] + + # settings for a user. + settings: UserSettings + + # returns all comments based on a query. + comments(query: CommentsInput): [Comment] +} + +type Comment { + id: ID! + + # the actual comment data. + body: String! + + # the user who authored the comment. + user: User + + # the replies that were made to the comment. + replies(limit: Int = 3): [Comment] + + # the actions made against a comment. + actions: [ActionSummary] + + # the asset that a comment was made on. + asset: Asset + + # the current status of a comment. + status: COMMENT_STATUS + + # the time when the comment was created + created_at: String! +} + +enum ITEM_TYPE { + ASSETS + COMMENTS + USERS +} + +enum ACTION_TYPE { + LIKE + FLAG +} + +type Action { + id: ID! + action_type: ACTION_TYPE! + + item_id: ID! + item_type: ITEM_TYPE! + item: ActionableItem + + user: User! + updated_at: String + created_at: String +} + +type ActionSummary { + action_type: ACTION_TYPE! + item_type: ITEM_TYPE! + count: Int + current_user: Action +} + +enum MODERATION_MODE { + PRE + POST +} + +type Settings { + moderation: MODERATION_MODE! + infoBoxEnable: Boolean + infoBoxContent: String + closeTimeout: Int + closedMessage: String + charCountEnable: Boolean + charCount: Int + requireEmailConfirmation: Boolean +} + +type Asset { + id: ID! + title: String + url: String + comments: [Comment] + settings: Settings! + closedAt: String + created_at: String +} + +enum COMMENT_STATUS { + ACCEPTED + REJECTED + PREMOD +} + +type RootQuery { + # retrieves site wide settings and defaults. + settings: Settings + + # retrieves all assets. + assets: [Asset] + + # retrieves a specific asset. + asset(id: ID, url: String): Asset + + # retrieves comments based on the input query. + comments(query: CommentsInput): [Comment] + + # retrieves the current logged in user. + me: User +} + +input CreateActionInput { + # the type of action. + action_type: ACTION_TYPE! + + # the type of the item. + item_type: ITEM_TYPE! + + # the id of the item that is related to the action. + item_id: ID! +} + +input UpdateUserSettingsInput { + # user bio + bio: String! +} + +type RootMutation { + # creates a comment on the asset. + createComment(asset_id: ID!, parent_id: ID, body: String!): Comment + + # creates an action based on an input. + createAction(action: CreateActionInput!): Action + + # delete an action based on the action id. + deleteAction(id: ID!): Boolean + + # updates a user's settings, it will return if the query was successful. + updateUserSettings(settings: UpdateUserSettingsInput!): Boolean +} + +schema { + query: RootQuery + mutation: RootMutation +} diff --git a/graph/typeDefs.js b/graph/typeDefs.js new file mode 100644 index 000000000..7ac982269 --- /dev/null +++ b/graph/typeDefs.js @@ -0,0 +1,11 @@ +// TODO: Adjust `RootQuery.asset(id: ID, url: String)` to instead be +// `RootQuery.asset(id: ID, url: String!)` because we'll always need the url, if +// this change is done now everything will likely break on the front end. + +const fs = require('fs'); +const path = require('path'); + +// Load the typeDefs from the graphql file. +const typeDefs = fs.readFileSync(path.join(__dirname, 'typeDefs.graphql'), 'utf8'); + +module.exports = typeDefs; diff --git a/init.js b/init.js index c29684b23..eb17963a6 100644 --- a/init.js +++ b/init.js @@ -1,7 +1,13 @@ -const Setting = require('./models/setting'); +const SettingsService = require('./services/settings'); module.exports = () => Promise.all([ // Upsert the settings object. - Setting.init({id: '1', moderation: 'pre', wordlist: {banned: [], suspect: []}}) + SettingsService.init({ + moderation: 'PRE', + wordlist: { + banned: [], + suspect: [] + } + }) ]); diff --git a/middleware/authorization.js b/middleware/authorization.js index efe4b1034..d93913109 100644 --- a/middleware/authorization.js +++ b/middleware/authorization.js @@ -17,7 +17,11 @@ const ErrNotAuthorized = require('../errors').ErrNotAuthorized; * @return {Boolean} true if the user has all the roles required, false * otherwise */ -authorization.has = (user, ...roles) => roles.every((role) => user.roles.indexOf(role) >= 0); +authorization.has = (user, ...roles) => roles.every((role) => { + + // TODO: remove toUpperCase once we've migrated over the roles. + return user.roles.indexOf(role.toUpperCase()) >= 0; +}); /** * needed is a connect middleware layer that ensures that all requests coming diff --git a/middleware/payload-filter.js b/middleware/payload-filter.js deleted file mode 100644 index b4cf90021..000000000 --- a/middleware/payload-filter.js +++ /dev/null @@ -1,74 +0,0 @@ -// The maximum depth to recurse into nested objects checking for mongoose -// objects. -const maxRecursion = 3; - -/** - * Middleware to wrap the `res.json` function to ensure that we can filter the - * payload response first based on user and role. - */ -module.exports = (req, res, next) => { - - /** - * Updates the original document based on filtering out for roles. - * @param {Mixed} o original object to be modified - * @param {Integer} l current level of depth in the first object - * @return {Mixed} (possibly) modified object - */ - const wrap = (o, d = 0) => { - if (d > maxRecursion) { - return o; - } - - // If this is an array, we need to walk over all the object's elements. - if (Array.isArray(o)) { - - // Map each of the array elements. - return o.map((ob) => wrap(ob, d + 1)); - - } else if (o && o.constructor && o.constructor.name === 'model') { - - // The object here is definitly a mongoose model. - - // Check to see if it has a `filterForUser` method. - if (typeof o.filterForUser === 'function') { - - // The object here actually has the `filterForUser` function, so filter - // the object! - o = o.filterForUser(req.user); - } - - } else if (typeof o === 'object') { - - // Iterate over the props, find only properties owned by the object. - for (let prop in o) { - - // If and only if the object owns the property do we actually pull the - // property out. - if (typeof o.hasOwnProperty === 'function' && o.hasOwnProperty(prop)) { - - // Wrap the property with one more layer down. - o[prop] = wrap(o[prop], d + 1); - } - } - - } - - return o; - }; - - // Save a reference to the original json function. - const json = res.json; - - // Override the original json function. - res.json = (payload) => { - - // Restore the old pointer. - res.json = json; - - // Send it down the pipe after we've filtered it. - res.json(wrap(payload)); - }; - - // Now that we've overridden the `res.json`, let's hand it down. - next(); -}; diff --git a/models/SETTINGS_ROADMAP.md b/models/SETTINGS_ROADMAP.md deleted file mode 100644 index b49a0f8a9..000000000 --- a/models/SETTINGS_ROADMAP.md +++ /dev/null @@ -1,30 +0,0 @@ -These are some settings we're planning on implementing in the future. -I'm keeping them in this file for reference - -```javascript -anonymous_users: {type: Boolean, default: false}, -block_mute_enabled: {type: Boolean, default: false}, -comment_count: {type: Boolean, default: false}, -comment_editing_enabled: {type: Boolean, default: false}, -comments_hidden: {type: Boolean, default: false}, -community_guidelines: {type: Boolean, default: false}, -detailed_flags: {type: Boolean, default: false}, -emojis_enabled: {type: Boolean, default: false}, -following: {type: Boolean, default: false}, -likes_enabled: {type: Boolean, default: false}, -mentions: {type: Boolean, default: false}, -nested_replies: {type: Boolean, default: false}, -notification_timeout: {type: Number, default: 4500}, -permalinks: {type: Boolean, default: false}, -post_button_text: {type: String, default: 'Post'}, -pseudonyms: {type: Boolean, default: false}, -public_profile: {type: Boolean, default: false}, -reactions_enabled: {type: Boolean, default: false}, -reply_button_text: {type: String, default: 'Reply'}, -rich_content: {type: Boolean, default: false}, -show_staff_picks: {type: Boolean, default: false}, -up_down_voting: {type: Boolean, default: false}, -user_badges: {type: Boolean, default: false}, -user_mods_enabled: {type: Boolean, default: false}, -user_stats_enabled: {type: Boolean, default: false} -``` diff --git a/models/action.js b/models/action.js index 8e6634072..ed871f56b 100644 --- a/models/action.js +++ b/models/action.js @@ -1,16 +1,32 @@ const mongoose = require('../services/mongoose'); const uuid = require('uuid'); -const _ = require('lodash'); const Schema = mongoose.Schema; +const ACTION_TYPES = [ + 'LIKE', + 'FLAG' +]; + +const ITEM_TYPES = [ + 'ASSETS', + 'COMMENTS', + 'USERS' +]; + const ActionSchema = new Schema({ id: { type: String, default: uuid.v4, unique: true }, - action_type: String, - item_type: String, + action_type: { + type: String, + enum: ACTION_TYPES + }, + item_type: { + type: String, + enum: ITEM_TYPES + }, item_id: String, user_id: String, metadata: Schema.Types.Mixed @@ -21,179 +37,6 @@ const ActionSchema = new Schema({ } }); -/** - * Finds an action by the id. - * @param {String} id identifier of the action (uuid) -*/ -ActionSchema.statics.findById = function(id) { - return Action.findOne({id}); -}; - -/** - * Add an action. - * @param {String} item_id identifier of the comment (uuid) - * @param {String} user_id user id of the action (uuid) - * @param {String} action the new action to the comment - * @return {Promise} - */ -ActionSchema.statics.insertUserAction = (action) => { - - // Actions are made unique by using a query that can be reproducable, i.e., - // not containing user inputable values. - let query = { - action_type: action.action_type, - item_type: action.item_type, - item_id: action.item_id, - user_id: action.user_id - }; - - // Create/Update the action. - return Action.findOneAndUpdate(query, action, { - - // Ensure that if it's new, we return the new object created. - new: true, - - // Perform an upsert in the event that this doesn't exist. - upsert: true, - - // Set the default values if not provided based on the mongoose models. - setDefaultsOnInsert: true - }); -}; - -/** - * Finds actions in an array of ids. - * @param {String} ids array of user identifiers (uuid) -*/ -ActionSchema.statics.findByItemIdArray = function(item_ids) { - return Action.find({ - 'item_id': {$in: item_ids} - }); -}; - -/** - * Fetches the action summaries for the given asset, and comments around the - * given user id. - * @param {[type]} asset_id [description] - * @param {[type]} comments [description] - * @param {String} [current_user_id=''] [description] - * @return {[type]} [description] - */ -ActionSchema.statics.getActionSummariesFromComments = (asset_id = '', comments, current_user_id = '') => { - - // Get the user id's from the author id's as a unique array that gets - // sorted. - let userIDs = _.uniq(comments.map((comment) => comment.author_id)).sort(); - - // Fetch the actions for pretty much everything at this point. - return Action.getActionSummaries(_.uniq([ - - // Actions can be on assets... - asset_id, - - // Comments... - ...comments.map((comment) => comment.id), - - // Or Authors... - ...userIDs - ].filter((e) => e)), current_user_id); -}; - -/** - * Returns summaries of actions for an array of ids - * @param {String} ids array of user identifiers (uuid) -*/ -ActionSchema.statics.getActionSummaries = function(item_ids, current_user_id = '') { - return Action.aggregate([ - { - - // only grab items that match the specified item id's - $match: { - item_id: { - $in: item_ids - } - } - }, - { - $group: { - - // group unique documents by these properties, we are leveraging the - // fact that each uuid is completly unique. - _id: { - item_id: '$item_id', - action_type: '$action_type' - }, - - // and sum up all actions matching the above grouping criteria - count: { - $sum: 1 - }, - - // we are leveraging the fact that each uuid is completly unique and - // just grabbing the last instance of the item type here. - item_type: { - $last: '$item_type' - }, - - current_user: { - $max: { - $cond: { - if: { - $eq: ['$user_id', current_user_id], - }, - then: '$$CURRENT', - else: null - } - } - } - } - }, - { - $project: { - - // suppress the _id field - _id: false, - - // map the fields from the _id grouping down a level - item_id: '$_id.item_id', - action_type: '$_id.action_type', - - // map the field directly - count: '$count', - item_type: '$item_type', - - // set the current user to false here - current_user: '$current_user' - } - } - ]) - .exec(); -}; - -/* - * Finds all comments for a specific action. - * @param {String} action_type type of action - * @param {String} item_type type of item the action is on -*/ -ActionSchema.statics.findByType = function(action_type, item_type) { - return Action.find({ - 'action_type': action_type, - 'item_type': item_type - }); -}; - -/** - * Finds all comments ids for a specific action. - * @param {String} action_type type of action - * @param {String} item_type type of item the action is on -*/ -ActionSchema.statics.findCommentsIdByActionType = function(action_type, item_type) { - return Action.find({ - 'action_type': action_type, - 'item_type': item_type - }, 'item_id'); -}; - const Action = mongoose.model('Action', ActionSchema); module.exports = Action; diff --git a/models/asset.js b/models/asset.js index ac87e006f..f0046aef0 100644 --- a/models/asset.js +++ b/models/asset.js @@ -1,8 +1,5 @@ const mongoose = require('../services/mongoose'); const Schema = mongoose.Schema; - -const Setting = require('./setting'); - const uuid = require('uuid'); const AssetSchema = new Schema({ @@ -68,18 +65,6 @@ AssetSchema.index({ background: true }); -/** - * Finds an asset by its id. - * @param {String} id identifier of the asset (uuid). - */ -AssetSchema.statics.findById = (id) => Asset.findOne({id}); - -/** - * Finds a asset by its url. - * @param {String} url identifier of the asset (uuid). - */ -AssetSchema.statics.findByUrl = (url) => Asset.findOne({url}); - /** * Returns true if the asset is closed, false else. */ @@ -87,85 +72,6 @@ AssetSchema.virtual('isClosed').get(function() { return this.closedAt && this.closedAt.getTime() <= new Date().getTime(); }); -/** - * Retrieves the settings given an asset query and rectifies it against the - * global settings. - * @param {Promise} assetQuery an asset query that returns a single asset. - * @return {Promise} - */ -AssetSchema.statics.rectifySettings = (assetQuery) => Promise.all([ - Setting.retrieve(), - assetQuery -]).then(([settings, asset]) => { - - // If the asset exists and has settings then return the merged object. - if (asset && asset.settings) { - settings.merge(asset.settings); - } - - return settings; -}); - -/** - * Finds a asset by its url. - * - * NOTE: This function has scalability concerns regarding mongoose's decision - * always write {updated_at: new Date()} on every call to findOneAndUpdate - * even though the update document exactly matches the query document... In - * the future this function should never update, only findOneAndCreate but this - * is not possible with the mongoose driver. - * - * @param {String} url identifier of the asset (uuid). - * @return {Promise} - */ -AssetSchema.statics.findOrCreateByUrl = (url) => Asset.findOneAndUpdate({url}, {url}, { - - // Ensure that if it's new, we return the new object created. - new: true, - - // Perform an upsert in the event that this doesn't exist. - upsert: true, - - // Set the default values if not provided based on the mongoose models. - setDefaultsOnInsert: true -}); - -/** - * Updates the settings for the asset. - * @param {[type]} id [description] - * @param {[type]} settings [description] - * @return {[type]} [description] - */ -AssetSchema.statics.overrideSettings = (id, settings) => Asset.findOneAndUpdate({id}, { - $set: { - settings - } -}, { - new: true -}); - -/** - * Finds assets matching keywords on the model. If `value` is an empty string, - * then it will not even perform a text search query. - * @param {String} value string to search by. - * @return {Promise} - */ -AssetSchema.statics.search = (value) => value.length === 0 ? Asset.find({}) : Asset.find({ - $text: { - $search: value - } -}); - -/** - * Finds multiple assets with matching ids - * @param {Array} ids an array of Strings of asset_id - * @return {Promise} resolves to list of Assets - */ -AssetSchema.statics.findMultipleById = function (ids) { - const query = ids.map(id => ({id})); - return Asset.find(query); -}; - const Asset = mongoose.model('Asset', AssetSchema); module.exports = Asset; diff --git a/models/comment.js b/models/comment.js index 99eaec069..b656f9238 100644 --- a/models/comment.js +++ b/models/comment.js @@ -1,8 +1,13 @@ const mongoose = require('../services/mongoose'); const Schema = mongoose.Schema; -const _ = require('lodash'); const uuid = require('uuid'); -const Action = require('./action'); + +const STATUSES = [ + 'ACCEPTED', + 'REJECTED', + 'PREMOD', + null +]; /** * The Mongo schema for a Comment Status. @@ -11,11 +16,7 @@ const Action = require('./action'); const StatusSchema = new Schema({ type: { type: String, - enum: [ - 'accepted', - 'rejected', - 'premod', - ], + enum: STATUSES, }, // The User ID of the user that assigned the status. @@ -56,228 +57,6 @@ const CommentSchema = new Schema({ } }); -/** - * toJSON overrides to remove fields from the json - * output. - */ -CommentSchema.options.toJSON = {}; -CommentSchema.options.toJSON.virtuals = true; -CommentSchema.options.toJSON.hide = '_id'; -CommentSchema.options.toJSON.transform = (doc, ret, options) => { - if (options.hide) { - options.hide.split(' ').forEach((prop) => { - delete ret[prop]; - }); - } - - return ret; -}; - -/** - * Filters the object for the given user only allowing those with the allowed - * roles/permissions to access particular parameters. - */ -CommentSchema.method('filterForUser', function(user = false) { - if (!user || !user.roles.includes('admin')) { - return _.pick(this.toJSON(), ['id', 'body', 'asset_id', 'author_id', 'parent_id', 'status']); - } - - return this.toJSON(); -}); - -/** - * Creates a new Comment that came from a public source. - * @param {Mixed} comment either a single comment or an array of comments. - * @return {Promise} - */ -CommentSchema.statics.publicCreate = (comment) => { - - // Check to see if this is an array of comments, if so map it out. - if (Array.isArray(comment)) { - return Promise.all(comment.map(Comment.publicCreate)); - } - - const { - body, - asset_id, - parent_id, - status = null, - author_id - } = comment; - - comment = new Comment({ - body, - asset_id, - parent_id, - status_history: status ? [{ - type: status, - created_at: new Date() - }] : [], - status, - author_id - }); - - return comment.save(); -}; - -/** - * Finds a comment by the id. - * @param {String} id identifier of comment (uuid) - * @return {Promise} - */ -CommentSchema.statics.findById = (id) => Comment.findOne({id}); - -/** - * Finds ALL the comments by the asset_id. - * @param {String} asset_id identifier of the asset which owns this comment (uuid) - * @return {Promise} - */ -CommentSchema.statics.findByAssetId = (asset_id) => Comment.find({ - asset_id -}); - -/** - * findByAssetIdWithStatuses finds all the comments where the asset id matches - * what's provided and the status is one of the ones listed in the statuses - * array. - * @param {String} asset_id the asset id to search by - * @param {Array} [statuses=[]] the array of statuses to search by - * @return {Promise} resolves to an array of comments - */ -CommentSchema.statics.findByAssetIdWithStatuses = (asset_id, statuses = []) => Comment.find({ - asset_id, - status: { - $in: statuses - } -}); - -/** - * Find comments by an action that was performed on them. - * @param {String} action_type the type of action that was performed on the comment - * @return {Promise} - */ -CommentSchema.statics.findByActionType = (action_type) => Action - .findCommentsIdByActionType(action_type, 'comment') - .then((actions) => Comment.find({ - id: { - $in: actions.map((a) => a.item_id) - } - })); - -/** - * Find comment id's where the action type matches the argument. - * @param {String} action_type the type of action that was performed on the comment - * @return {Promise} - */ -CommentSchema.statics.findIdsByActionType = (action_type) => Action - .findCommentsIdByActionType(action_type, 'comments') - .then((actions) => actions.map(a => a.item_id)); - -/** - * Find comments by current status - * @param {String} status status of the comment to search for - * @return {Promise} resovles to comment array - */ -CommentSchema.statics.findByStatus = (status = null) => { - return Comment.find({status}); -}; - -/** - * Find comments that need to be moderated (aka moderation queue). - * @param {String} asset_id - * @return {Promise} - */ -CommentSchema.statics.moderationQueue = (status, asset_id = null) => { - - // Fetch the comments with statuses. - let comments = Comment.findByStatus(status); - - if (asset_id) { - comments = comments.where('asset_id', asset_id); - } - - return comments; -}; - -/** - * Pushes a new status in for the user. - * @param {String} id identifier of the comment (uuid) - * @param {String} status the new status of the comment - * @param {String} assigned_by the user id for the user who performed the - * moderation action - * @return {Promise} - */ -CommentSchema.statics.pushStatus = (id, status, assigned_by = null) => Comment.update({id}, { - $push: { - status_history: { - type: status, - created_at: new Date(), - assigned_by - } - }, - $set: {status} -}); - -/** - * Add an action to the comment. - * @param {String} item_id identifier of the comment (uuid) - * @param {String} user_id user id of the action (uuid) - * @param {String} action the new action to the comment - * @return {Promise} - */ -CommentSchema.statics.addAction = (item_id, user_id, action_type, metadata) => Action.insertUserAction({ - item_id, - item_type: 'comments', - user_id, - action_type, - metadata -}); - -/** - * Change the status of a comment. - * @param {String} id identifier of the comment (uuid) - * @param {String} status the new status of the comment - * @return {Promise} - */ -CommentSchema.statics.removeById = (id) => Comment.remove({id}); - -/** - * Remove an action from the comment. - * @param {String} id identifier of the comment (uuid) - * @param {String} action_type the type of the action to be removed - * @param {String} user_id the id of the user performing the action - * @return {Promise} - */ -CommentSchema.statics.removeAction = (item_id, user_id, action_type) => Action.remove({ - action_type, - item_type: 'comment', - item_id, - user_id -}); - -/** - * Returns all the comments in the collection. - * @return {Promise} - */ -CommentSchema.statics.all = () => Comment.find(); - -/** - * Returns all the comments by user - * probably to be paginated at some point in the future - * @return {Promise} array resolves to an array of comments by that user - */ -CommentSchema.statics.findByUserId = function (author_id, admin = false) { - - // do not return un-published comments for non-admins - let query = {author_id}; - - if (!admin) { - query.$nor = [{status: 'premod'}, {status: 'rejected'}]; - } - - return Comment.find(query); -}; - // Comment model. const Comment = mongoose.model('Comment', CommentSchema); diff --git a/models/setting.js b/models/setting.js index ed41acfa6..3d478b2d9 100644 --- a/models/setting.js +++ b/models/setting.js @@ -1,6 +1,5 @@ const mongoose = require('../services/mongoose'); const Schema = mongoose.Schema; -const _ = require('lodash'); const WordlistSchema = new Schema({ banned: [String], @@ -21,10 +20,10 @@ const SettingSchema = new Schema({ moderation: { type: String, enum: [ - 'pre', - 'post' + 'PRE', + 'POST' ], - default: 'pre' + default: 'PRE' }, infoBoxEnable: { type: Boolean, @@ -64,12 +63,6 @@ const SettingSchema = new Schema({ } }); -/** - * toJSON provides settings overrides to this object's serialization methods. - */ -SettingSchema.options.toJSON = {}; -SettingSchema.options.toJSON.virtuals = true; - /** * Merges two settings objects. */ @@ -88,72 +81,9 @@ SettingSchema.method('merge', function(src) { }); }); -/** - * Filters the object for the given user only allowing those with the allowed - * roles/permissions to access particular parameters. - */ -SettingSchema.method('filterForUser', function(user = false) { - if (!user || !user.roles.includes('admin')) { - return _.pick(this.toJSON(), [ - 'moderation', - 'infoBoxEnable', - 'infoBoxContent', - 'closeTimeout', - 'closedMessage', - 'charCountEnable', - 'charCount', - 'requireEmailConfirmation' - ]); - } - - return this.toJSON(); -}); - /** * The Mongo Mongoose object. */ const Setting = mongoose.model('Setting', SettingSchema); -/** - * The Setting Service object exposing the Setting model. - * @type {Object} - */ -const SettingService = module.exports = {}; - -/** - * The selector used to uniquely identify the settings document. - */ -const selector = {id: '1'}; - -/** - * Gets the entire settings record and sends it back - * @return {Promise} settings the whole settings record - */ -SettingService.retrieve = () => Setting.findOne(selector); - -/** - * This will update the settings object with whatever you pass in - * @param {object} setting a hash of whatever settings you want to update - * @return {Promise} settings Promise that resolves to the entire (updated) settings object. - */ -SettingService.update = (settings) => Setting.findOneAndUpdate(selector, { - $set: settings -}, { - upsert: true, - new: true, - setDefaultsOnInsert: true -}); - -/** - * This is run once when the app starts to ensure settings are populated. - * @return {Promise} null initialize the global settings object - */ -SettingService.init = (defaults) => { - - // Inject the defaults on top of the passed in defaults to ensure that the new - // settings conform to the required selector. - defaults = Object.assign({}, defaults, selector); - - // Actually update the settings collection. - return SettingService.update(defaults); -}; +module.exports = Setting; diff --git a/models/user.js b/models/user.js index a0ca34d7a..9c447fa5d 100644 --- a/models/user.js +++ b/models/user.js @@ -1,40 +1,18 @@ const mongoose = require('../services/mongoose'); const uuid = require('uuid'); -const _ = require('lodash'); -const bcrypt = require('bcrypt'); -const jwt = require('jsonwebtoken'); -const Action = require('./action'); -const Comment = require('./comment'); -const Wordlist = require('../services/wordlist'); -const errors = require('../errors'); - -const EMAIL_CONFIRM_JWT_SUBJECT = 'email_confirm'; -const PASSWORD_RESET_JWT_SUBJECT = 'password_reset'; - -// SALT_ROUNDS is the number of rounds that the bcrypt algorithm will run -// through during the salting process. -const SALT_ROUNDS = 10; // USER_ROLES is the array of roles that is permissible as a user role. const USER_ROLES = [ - 'admin', - 'moderator' + 'ADMIN', + 'MODERATOR' ]; -// USER_STATUSES is the list of statuses that are permitted for the user status. +// USER_STATUS is the list of statuses that are permitted for the user status. const USER_STATUS = [ - 'active', - 'banned' + 'ACTIVE', + 'BANNED' ]; -// In the event that the TALK_SESSION_SECRET is missing but we are testing, then -// set the process.env.TALK_SESSION_SECRET. -if (process.env.NODE_ENV === 'test' && !process.env.TALK_SESSION_SECRET) { - process.env.TALK_SESSION_SECRET = 'keyboard cat'; -} else if (!process.env.TALK_SESSION_SECRET) { - throw new Error('TALK_SESSION_SECRET must be defined to encode JSON Web Tokens and other auth functionality'); -} - // ProfileSchema is the mongoose schema defined as the representation of a // User's profile stored in MongoDB. const ProfileSchema = new mongoose.Schema({ @@ -103,11 +81,18 @@ const UserSchema = new mongoose.Schema({ // Roles provides an array of roles (as strings) that is associated with a // user. - roles: [String], + roles: [{ + type: String, + enum: USER_ROLES + }], // Status provides a string that says in which state the account is. // When the account is banned, the user login is disabled. - status: {type: String, enum: USER_STATUS, default: 'active'}, + status: { + type: String, + enum: USER_STATUS, + default: 'ACTIVE' + }, // User's settings settings: { @@ -135,619 +120,46 @@ UserSchema.index({ }); /** - * toJSON overrides to remove the password field from the json - * output. + * Returns true if the user has all the roles specified. */ -UserSchema.options.toJSON = {}; -UserSchema.options.toJSON.hide = '_id password'; -UserSchema.options.toJSON.virtuals = true; -UserSchema.options.toJSON.transform = (doc, ret, options) => { - if (options.hide) { - options.hide.split(' ').forEach((prop) => { - delete ret[prop]; - }); - } +UserSchema.method('hasRoles', function(...roles) { + return roles.every((role) => { - return ret; -}; + // TODO: remove toUpperCase() once we've migrated usage. + return this.roles.indexOf(role.toUpperCase()) >= 0; + }); +}); /** - * Filters the object for the given user only allowing those with the allowed - * roles/permissions to access particular parameters. + * All the graph operations that are available for a user. + * @type {Array} */ -UserSchema.method('filterForUser', function(user = false) { - if (!user || !user.roles.includes('admin')) { - let allowed = ['id', 'displayName', 'settings', 'created_at', 'updated_at']; +const USER_GRAPH_OPERATIONS = [ + 'mutation:createComment', + 'mutation:createAction', + 'mutation:deleteAction', + 'mutation:updateUserSettings' +]; - if (user && user.id === this.id) { - allowed.push('roles'); - } - - return _.pick(this.toJSON(), allowed); +/** + * Can returns true if the user is allowed to perform a specific graph + * operation. + */ +UserSchema.method('can', function(...actions) { + if (actions.some((action) => USER_GRAPH_OPERATIONS.indexOf(action) === -1)) { + throw new Error(`invalid actions: ${actions}`); } - return this.toJSON(); + if (this.status === 'BANNED') { + return false; + } + + return true; }); // Create the User model. const UserModel = mongoose.model('User', UserSchema); -// UserService is the interface for the application to interact with the -// UserModel through. -const UserService = module.exports = {}; - -/** - * Finds a user given their email address that we have for them in the system - * and ensures that the retuned user matches the password passed in as well. - * @param {string} email - email to look up the user by - * @param {string} password - password to match against the found user - * @param {Function} done [description] - */ -UserService.findLocalUser = (email, password) => { - if (!email || typeof email !== 'string') { - return Promise.reject('email is required for findLocalUser'); - } - - return UserModel.findOne({ - profiles: { - $elemMatch: { - id: email.toLowerCase(), - provider: 'local' - } - } - }) - .then((user) => { - if (!user) { - return false; - } - - return new Promise((resolve, reject) => { - bcrypt.compare(password, user.password, (err, res) => { - if (err) { - return reject(err); - } - - if (!res) { - return resolve(false); - } - - return resolve(user); - }); - }); - }); -}; - -/** - * Merges two users together by taking all the profiles on a given user and - * pushing them into the source user followed by deleting the destination user's - * user account. This will not merge the roles associated with the source user. - * @param {String} dstUserID id of the user to which is the target of the merge - * @param {String} srcUserID id of the user to which is the source of the merge - * @return {Promise} resolves when the users are merged - */ -UserService.mergeUsers = (dstUserID, srcUserID) => { - let srcUser, dstUser; - - return Promise - .all([ - UserModel.findOne({id: dstUserID}).exec(), - UserModel.findOne({id: srcUserID}).exec() - ]) - .then((users) => { - dstUser = users[0]; - srcUser = users[1]; - - srcUser.profiles.forEach((profile) => { - dstUser.profiles.push(profile); - }); - - return srcUser.remove(); - }) - .then(() => dstUser.save()); -}; - -/** - * Finds a user given a social profile and if the user does not exist, creates - * them. - * @param {Object} profile - User social/external profile - * @param {Function} done [description] - */ -UserService.findOrCreateExternalUser = (profile) => { - return UserModel - .findOne({ - profiles: { - $elemMatch: { - id: profile.id, - provider: profile.provider - } - } - }) - .then((user) => { - if (user) { - return user; - } - - // The user was not found, lets create them! - user = new UserModel({ - displayName: profile.displayName, - roles: [], - profiles: [ - { - id: profile.id, - provider: profile.provider - } - ] - }); - - return user.save(); - }); -}; - -UserService.changePassword = (id, password) => { - return new Promise((resolve, reject) => { - bcrypt.hash(password, SALT_ROUNDS, (err, hashedPassword) => { - if (err) { - return reject(err); - } - - resolve(hashedPassword); - }); - }) - .then((hashedPassword) => { - return UserModel.update({id}, { - $inc: {__v: 1}, - $set: { - password: hashedPassword - } - }); - }); -}; - -/** - * Creates local users. - * @param {Array} users Users to create - * @return {Promise} Resolves with the users that were created - */ -UserService.createLocalUsers = (users) => { - return Promise.all(users.map((user) => { - return UserService - .createLocalUser(user.email, user.password, user.displayName); - })); -}; - -/** - * Check the requested displayname for naughty words (currently in English) and special chars - * @param {String} displayName word to be checked for profanity - * @return {Promise} rejected if the machine's sensibilites are offended - */ -const isValidDisplayName = (displayName) => { - const onlyLettersNumbersUnderscore = /^[a-z0-9_]+$/; - - if (!displayName) { - return Promise.reject(errors.ErrMissingDisplay); - } - - if (!onlyLettersNumbersUnderscore.test(displayName)) { - - return Promise.reject(errors.ErrSpecialChars); - } - - // check for profanity - return Wordlist.displayNameCheck(displayName); -}; - -/** - * Creates the local user with a given email, password, and name. - * @param {String} email email of the new user - * @param {String} password plaintext password of the new user - * @param {String} displayName name of the display user - * @param {Function} done callback - */ -UserService.createLocalUser = (email, password, displayName) => { - - if (!email) { - return Promise.reject(errors.ErrMissingEmail); - } - - email = email.toLowerCase().trim(); - displayName = displayName.toLowerCase().trim(); - - if (!password) { - return Promise.reject(errors.ErrMissingPassword); - } - - if (password.length < 8) { - return Promise.reject(errors.ErrPasswordTooShort); - } - - return isValidDisplayName(displayName) - .then(() => { // displayName is valid - return new Promise((resolve, reject) => { - bcrypt.hash(password, SALT_ROUNDS, (err, hashedPassword) => { - if (err) { - return reject(err); - } - - let user = new UserModel({ - displayName: displayName, - password: hashedPassword, - roles: [], - profiles: [ - { - id: email, - provider: 'local' - } - ] - }); - - user.save((err) => { - if (err) { - if (err.code === 11000) { - if (err.message.match('displayName')) { - return reject(errors.ErrDisplayTaken); - } - return reject(errors.ErrEmailTaken); - } - return reject(err); - } - return resolve(user); - }); - }); - }); - }); -}; - -/** - * Disables a given user account. - * @param {String} id id of a user - * @param {Function} done callback after the operation is complete - */ -UserService.disableUser = (id) => { - return UserModel.update({ - id: id - }, { - $set: { - disabled: true - } - }); -}; - -/** - * Enables a given user account. - * @param {String} id id of a user - * @param {Function} done callback after the operation is complete - */ -UserService.enableUser = (id) => { - return UserModel.update({ - id: id - }, { - $set: { - disabled: false - } - }); -}; - -/** - * Adds a role to a user. - * @param {String} id id of a user - * @param {String} role role to add - * @param {Function} done callback after the operation is complete - */ -UserService.addRoleToUser = (id, role) => { - - // Check to see if the user role is in the allowable set of roles. - if (USER_ROLES.indexOf(role) === -1) { - - // User role is not supported! Error out here. - return Promise.reject(new Error(`role ${role} is not supported`)); - } - - return UserModel.update({ - id: id - }, { - $addToSet: { - roles: role - } - }); -}; - -/** - * Removes a role from a user. - * @param {String} id id of a user - * @param {String} role role to remove - * @param {Function} done callback after the operation is complete - */ -UserService.removeRoleFromUser = (id, role) => { - return UserModel.update({ - id: id - }, { - $pull: { - roles: role - } - }); -}; - -/** - * Set status of a user. - * @param {String} id id of a user - * @param {String} status status to set - * @param {String} comment_id id of the comment that the user was ban for. - * @param {Function} done callback after the operation is complete - */ -UserService.setStatus = (id, status, comment_id) => { - - // Check to see if the user status is in the allowable set of roles. - if (USER_STATUS.indexOf(status) === -1) { - - // User status is not supported! Error out here. - return Promise.reject(new Error(`status ${status} is not supported`)); - } - - // If ban then reject the comment and update status - if (status === 'banned') { - return UserModel.update({ - id: id - }, { - $set: { - status: status - } - }) - .then(() => { - return Comment.pushStatus(comment_id, 'rejected', id); - }); - } - - if (status === 'active') { - return UserModel.update({ - id: id - }, { - $set: { - status: status - } - }); - } -}; - -/** - * Finds a user with the id. - * @param {String} id user id (uuid) -*/ -UserService.findById = (id) => { - return UserModel.findOne({id}); -}; - -/** - * Finds users in an array of ids. - * @param {Array} ids array of user identifiers (uuid) -*/ -UserService.findByIdArray = (ids) => { - return UserModel.find({ - 'id': {$in: ids} - }); -}; - -/** - * Finds public user information by an array of ids. - * @param {Array} ids array of user identifiers (uuid) -*/ -UserService.findPublicByIdArray = (ids) => { - return UserModel.find({ - 'id': {$in: ids} - }, 'id displayName'); -}; - -/** - * Creates a JWT from a user email. Only works for local accounts. - * @param {String} email of the local user - */ -UserService.createPasswordResetToken = function (email) { - if (!email || typeof email !== 'string') { - return Promise.reject('email is required when creating a JWT for resetting passord'); - } - - email = email.toLowerCase(); - - return UserModel.findOne({profiles: {$elemMatch: {id: email}}}) - .then((user) => { - if (!user) { - - // Since we don't want to reveal that the email does/doesn't exist - // just go ahead and resolve the Promise with null and check in the - // endpoint. - return; - } - - const payload = { - jti: uuid.v4(), - email, - userId: user.id, - version: user.__v - }; - - return jwt.sign(payload, process.env.TALK_SESSION_SECRET, { - algorithm: 'HS256', - expiresIn: '1d', - subject: PASSWORD_RESET_JWT_SUBJECT - }); - }); -}; - -/** - * Verifies that the token was indeed signed by the session secret. - * @param {String} token JWT token from the client - * @return {Promise} - */ -UserService.verifyToken = (token, options = {}) => { - return new Promise((resolve, reject) => { - - // Set the allowed algorithms. - options.algorithms = ['HS256']; - - jwt.verify(token, process.env.TALK_SESSION_SECRET, options, (err, decoded) => { - if (err) { - return reject(err); - } - - resolve(decoded); - }); - }); -}; - -/** - * Verifies a jwt and returns the associated user. - * @param {String} token the JSON Web Token to verify - */ -UserService.verifyPasswordResetToken = (token) => { - return UserService - .verifyToken(token, { - subject: PASSWORD_RESET_JWT_SUBJECT - }) - .then((decoded) => UserService.findById(decoded.userId)); -}; - -/** - * Finds a user using a value which gets compared using a prefix match against - * the user's email address and/or their display name. - * @param {String} value value to search by - * @return {Promise} - */ -UserService.search = (value) => { - return UserModel.find({ - $or: [ - - // Search by a prefix match on the displayName. - { - 'displayName': { - $regex: new RegExp(`^${value}`), - $options: 'i' - } - }, - - // Search by a prefix match on the email address. - { - 'profiles': { - $elemMatch: { - id: { - $regex: new RegExp(`^${value}`), - $options: 'i' - }, - provider: 'local' - } - } - } - ] - }); -}; - -/** - * Returns a count of the current users. - * @return {Promise} - */ -UserService.count = () => UserModel.count(); - -/** - * Returns all the users. - * @return {Promise} - */ -UserService.all = () => UserModel.find(); - -/** - * Updates the user's settings. - * @return {Promise} - */ -UserService.updateSettings = (id, settings) => UserModel.update({ - id -}, { - $set: { - settings - } -}); - -/** - * Add an action to the user. - * @param {String} item_id identifier of the user (uuid) - * @param {String} user_id user id of the action (uuid) - * @param {String} action the new action to the user - * @return {Promise} - */ -UserService.addAction = (item_id, user_id, action_type, metadata) => Action.insertUserAction({ - item_id, - item_type: 'users', - user_id, - action_type, - metadata -}); - -/** - * This creates a token based around confirming the local profile. - * @param {String} userID The user id for the user that we are creating the - * token for. - * @param {String} email The email that we are needing to get confirmed. - * @return {Promise} - */ -UserService.createEmailConfirmToken = (userID, email) => { - if (!email || typeof email !== 'string') { - return Promise.reject('email is required when creating a JWT for resetting passord'); - } - - email = email.toLowerCase(); - - return UserService - .findById(userID) - .then((user) => { - if (!user) { - return Promise.reject(new Error('user not found')); - } - - // Get the profile representing the local account. - let profile = user.profiles.find((profile) => profile.id === email && profile.provider === 'local'); - - // Ensure that the user email hasn't already been verified. - if (profile && profile.metadata && profile.metadata.confirmed_at) { - return Promise.reject(new Error('email address already confirmed')); - } - - const payload = { - email, - userID - }; - - return jwt.sign(payload, process.env.TALK_SESSION_SECRET, { - jwtid: uuid.v4(), - algorithm: 'HS256', - expiresIn: '1d', - subject: EMAIL_CONFIRM_JWT_SUBJECT - }); - }); -}; - -/** - * This verifies that a given token was for the email confirmation and updates - * that user's profile with a 'confirmed_at' parameter with the current date. - * @param {String} token the token containing the email confirmation details - * signed with our secret. - * @return {Promise} - */ -UserService.verifyEmailConfirmation = (token) => { - return UserService - .verifyToken(token, { - subject: EMAIL_CONFIRM_JWT_SUBJECT - }) - .then(({userID, email}) => { - - return UserModel - .update({ - id: userID, - profiles: { - $elemMatch: { - id: email, - provider: 'local' - } - } - }, { - $set: { - 'profiles.$.metadata.confirmed_at': new Date() - } - }); - }); -}; +module.exports = UserModel; +module.exports.USER_ROLES = USER_ROLES; +module.exports.USER_STATUS = USER_STATUS; diff --git a/package.json b/package.json index 26cd2d5d4..41b11e848 100644 --- a/package.json +++ b/package.json @@ -10,8 +10,8 @@ "build-watch": "NODE_ENV=development webpack --config webpack.config.dev.js --watch", "lint": "eslint bin/* .", "lint-fix": "eslint bin/* . --fix", - "test": "TEST_MODE=unit NODE_ENV=test mocha --compilers js:babel-core/register tests/helpers/*.js --require ignore-styles --recursive tests", - "test-watch": "TEST_MODE=unit NODE_ENV=test mocha --compilers js:babel-core/register --recursive -w tests", + "test": "TEST_MODE=unit NODE_ENV=test mocha -R ${NPM_PACKAGE_CONFIG_MOCHA_REPORTER:-spec}", + "test-cover": "TEST_MODE=unit NODE_ENV=test istanbul cover _mocha --report text --check-coverage -- -R spec", "pree2e": "NODE_ENV=test scripts/pree2e.sh", "e2e": "NODE_ENV=test nightwatch", "poste2e": "NODE_ENV=test scripts/poste2e.sh", @@ -49,18 +49,24 @@ }, "homepage": "https://github.com/coralproject/talk#readme", "dependencies": { + "apollo-client": "^0.7.3", "bcrypt": "^0.8.7", "body-parser": "^1.15.2", "cli-table": "^0.3.1", "commander": "^2.9.0", "connect-redis": "^3.1.0", "csurf": "^1.9.0", + "dataloader": "^1.2.0", "debug": "^2.2.0", "dotenv": "^4.0.0", "ejs": "^2.5.2", "env-rewrite": "^1.0.2", "express": "^4.14.0", "express-session": "^1.14.2", + "graphql": "^0.8.2", + "graphql-server-express": "^0.5.0", + "graphql-tag": "^1.2.3", + "graphql-tools": "^0.9.0", "helmet": "^3.1.0", "jsonwebtoken": "^7.1.9", "kue": "^0.11.5", @@ -75,6 +81,7 @@ "passport-facebook": "^2.1.1", "passport-local": "^1.0.0", "prompt": "^1.0.0", + "react-apollo": "^0.8.1", "redis": "^2.6.3", "uuid": "^2.0.3" }, @@ -116,6 +123,7 @@ "ignore-styles": "^5.0.1", "immutable": "^3.8.1", "imports-loader": "^0.6.5", + "istanbul": "^1.1.0-alpha.1", "jsdom": "^9.8.3", "json-loader": "^0.5.4", "keymaster": "^1.6.2", diff --git a/routes/admin/index.js b/routes/admin/index.js index 6241dcedb..2a37e8f0f 100644 --- a/routes/admin/index.js +++ b/routes/admin/index.js @@ -3,13 +3,17 @@ const router = express.Router(); // Get /password-reset expects a signed token (JWT) in the hash. // Links to this endpoint are generated by /views/password-reset-email.ejs. -router.get('/password-reset', (req, res, next) => { +router.get('/password-reset', (req, res) => { // TODO: store the redirect uri in the token or something fancy. // admins and regular users should probably be redirected to different places. res.render('password-reset', {redirectUri: process.env.TALK_ROOT_URL}); }); +router.get('/login', (req, res, next) => { + res.render('admin/login'); +}); + router.get('*', (req, res) => { res.render('admin', {basePath: '/client/coral-admin'}); }); diff --git a/routes/api/account/index.js b/routes/api/account/index.js index 3f699a51d..57647a89d 100644 --- a/routes/api/account/index.js +++ b/routes/api/account/index.js @@ -1,6 +1,6 @@ const express = require('express'); const router = express.Router(); -const User = require('../../../models/user'); +const UsersService = require('../../../services/users'); const mailer = require('../../../services/mailer'); const authorization = require('../../../middleware/authorization'); const errors = require('../../../errors'); @@ -26,7 +26,7 @@ router.post('/email/confirm', (req, res, next) => { return next(errors.ErrMissingToken); } - User + UsersService .verifyEmailConfirmation(token) .then(() => { res.status(204).end(); @@ -47,7 +47,7 @@ router.post('/password/reset', (req, res, next) => { return next('you must submit an email when requesting a password.'); } - User + UsersService .createPasswordResetToken(email) .then((token) => { @@ -100,9 +100,10 @@ router.put('/password/reset', (req, res, next) => { return next(errors.ErrPasswordTooShort); } - User.verifyPasswordResetToken(token) + UsersService + .verifyPasswordResetToken(token) .then(user => { - return User.changePassword(user.id, password); + return UsersService.changePassword(user.id, password); }) .then(() => { res.status(204).end(); @@ -120,7 +121,7 @@ router.put('/settings', authorization.needed(), (req, res, next) => { bio } = req.body; - User + UsersService .updateSettings(req.user.id, {bio}) .then(() => { res.status(204).end(); diff --git a/routes/api/actions/index.js b/routes/api/actions/index.js index 9724f5a73..20316d93b 100644 --- a/routes/api/actions/index.js +++ b/routes/api/actions/index.js @@ -1,10 +1,10 @@ const express = require('express'); -const Action = require('../../../models/action'); +const ActionsService = require('../../../services/actions'); const router = express.Router(); router.delete('/:action_id', (req, res, next) => { - Action + ActionsService .findOneAndRemove({ id: req.params.action_id, user_id: req.user.id diff --git a/routes/api/assets/index.js b/routes/api/assets/index.js index f5a4afe44..0b6762de8 100644 --- a/routes/api/assets/index.js +++ b/routes/api/assets/index.js @@ -1,8 +1,10 @@ const express = require('express'); const router = express.Router(); -const Asset = require('../../../models/asset'); const scraper = require('../../../services/scraper'); +const AssetsService = require('../../../services/assets'); + +const AssetModel = require('../../../models/asset'); // List assets. router.get('/', (req, res, next) => { @@ -46,13 +48,13 @@ router.get('/', (req, res, next) => { Promise.all([ // Find the actuall assets. - FilterOpenAssets(Asset.search(search), filter) + FilterOpenAssets(AssetsService.search(search), filter) .sort({[field]: (sort === 'asc') ? 1 : -1}) .skip(parseInt(skip)) .limit(parseInt(limit)), // Get the count of actual assets. - FilterOpenAssets(Asset.search(search), filter) + FilterOpenAssets(AssetsService.search(search), filter) .count() ]) .then(([result, count]) => { @@ -73,7 +75,7 @@ router.get('/', (req, res, next) => { router.get('/:asset_id', (req, res, next) => { // Send back the asset. - Asset + AssetsService .findById(req.params.asset_id) .then((asset) => { if (!asset) { @@ -91,7 +93,7 @@ router.get('/:asset_id', (req, res, next) => { router.post('/:asset_id/scrape', (req, res, next) => { // Create a new asset scrape job. - Asset + AssetsService .findById(req.params.asset_id) .then((asset) => { if (!asset) { @@ -113,7 +115,7 @@ router.post('/:asset_id/scrape', (req, res, next) => { router.put('/:asset_id/settings', (req, res, next) => { // Override the settings for the asset. - Asset + AssetsService .overrideSettings(req.params.asset_id, req.body) .then(() => res.status(204).end()) .catch((err) => next(err)); @@ -128,7 +130,7 @@ router.put('/:asset_id/status', (req, res, next) => { closedMessage } = req.body; - Asset + AssetModel .update({id}, { $set: { closedAt, diff --git a/routes/api/comments/index.js b/routes/api/comments/index.js index 1d5d73ea0..19346274d 100644 --- a/routes/api/comments/index.js +++ b/routes/api/comments/index.js @@ -1,10 +1,12 @@ const express = require('express'); const errors = require('../../../errors'); -const Comment = require('../../../models/comment'); -const Asset = require('../../../models/asset'); -const User = require('../../../models/user'); -const Action = require('../../../models/action'); -const wordlist = require('../../../services/wordlist'); + +const CommentModel = require('../../../models/comment'); +const CommentsService = require('../../../services/comments'); +const AssetsService = require('../../../services/assets'); +const UsersService = require('../../../services/users'); +const ActionsService = require('../../../services/actions'); + const authorization = require('../../../middleware/authorization'); const _ = require('lodash'); @@ -20,13 +22,13 @@ router.get('/', (req, res, next) => { } = req.query; // everything on this route requires admin privileges besides listing comments for owner of said comments - if (!authorization.has(req.user, 'admin') && !user_id) { + if (!authorization.has(req.user, 'ADMIN') && !user_id) { next(errors.ErrNotAuthorized); return; } // if the user is not an admin, only return comment list for the owner of the comments - if (req.user.id !== user_id && !authorization.has(req.user, 'admin')) { + if (req.user.id !== user_id && !authorization.has(req.user, 'ADMIN')) { next(errors.ErrNotAuthorized); return; } @@ -48,27 +50,27 @@ router.get('/', (req, res, next) => { // otherwise this will be a vulnerability if you pass user_id and something else, // the app will return admin-level data without the proper checks if (user_id) { - query = Comment.findByUserId(user_id, authorization.has(req.user, 'admin')); + query = CommentsService.findByUserId(user_id, authorization.has(req.user, 'ADMIN')); } else if (status) { - query = assetIDWrap(Comment.findByStatus(status === 'new' ? null : status)); + query = assetIDWrap(CommentsService.findByStatus(status === 'NEW' ? null : status)); } else if (action_type) { - query = Comment + query = CommentsService .findIdsByActionType(action_type) - .then((ids) => assetIDWrap(Comment.find({ + .then((ids) => assetIDWrap(CommentModel.find({ id: { $in: ids } }))); } else { - query = assetIDWrap(Comment.all()); + query = assetIDWrap(CommentsService.all()); } query.then((comments) => { return Promise.all([ comments, - Asset.findMultipleById(comments.map(comment => comment.asset_id)), - User.findByIdArray(_.uniq(comments.map((comment) => comment.author_id))), - Action.getActionSummariesFromComments(asset_id, comments, req.user ? req.user.id : false) + AssetsService.findMultipleById(comments.map(comment => comment.asset_id)), + UsersService.findByIdArray(_.uniq(comments.map((comment) => comment.author_id))), + ActionsService.getActionSummariesFromComments(asset_id, comments, req.user ? req.user.id : false) ]); }) .then(([comments, assets, users, actions]) => @@ -83,79 +85,8 @@ router.get('/', (req, res, next) => { }); }); -router.post('/', wordlist.filter('body'), (req, res, next) => { - - const { - body, - asset_id, - parent_id - } = req.body; - - // Decide the status based on whether or not the current asset/settings - // has pre-mod enabled or not. If the comment was rejected based on the - // wordlist, then reject it, otherwise if the moderation setting is - // premod, set it to `premod`. - let status; - - if (req.wordlist.banned) { - status = Promise.resolve('rejected'); - } else { - status = Asset - .rectifySettings(Asset.findById(asset_id).then((asset) => { - if (!asset) { - return Promise.reject(errors.ErrNotFound); - } - - // Check to see if the asset has closed commenting... - if (asset.isClosed) { - - // They have, ensure that we send back an error. - return Promise.reject(new errors.ErrAssetCommentingClosed(asset.closedMessage)); - } - - return asset; - })) - - // Return `premod` if pre-moderation is enabled and an empty "new" status - // in the event that it is not in pre-moderation mode. - .then(({moderation, charCountEnable, charCount}) => { - - // Reject if the comment is too long - if (charCountEnable && body.length > charCount) { - return 'rejected'; - } - return moderation === 'pre' ? 'premod' : null; - }); - } - - status.then((status) => Comment.publicCreate({ - body, - asset_id, - parent_id, - status, - author_id: req.user.id - })) - .then((comment) => { - if (req.wordlist.suspect) { - return Comment - .addAction(comment.id, null, 'flag', {field: 'body', details: 'Matched suspect word filters.'}) - .then(() => comment); - } - - return comment; - }) - .then((comment) => { - - // The comment was created! Send back the created comment. - res.status(201).json(comment); - }) - .catch((err) => { - next(err); - }); -}); - -router.get('/:comment_id', authorization.needed('admin'), (req, res, next) => { - Comment +router.get('/:comment_id', authorization.needed('ADMIN'), (req, res, next) => { + CommentsService .findById(req.params.comment_id) .then(comment => { if (!comment) { @@ -170,8 +101,8 @@ router.get('/:comment_id', authorization.needed('admin'), (req, res, next) => { }); }); -router.delete('/:comment_id', authorization.needed('admin'), (req, res, next) => { - Comment +router.delete('/:comment_id', authorization.needed('ADMIN'), (req, res, next) => { + CommentsService .removeById(req.params.comment_id) .then(() => { res.status(204).end(); @@ -181,12 +112,12 @@ router.delete('/:comment_id', authorization.needed('admin'), (req, res, next) => }); }); -router.put('/:comment_id/status', authorization.needed('admin'), (req, res, next) => { +router.put('/:comment_id/status', authorization.needed('ADMIN'), (req, res, next) => { const { status } = req.body; - Comment + CommentsService .pushStatus(req.params.comment_id, status, req.user.id) .then(() => { res.status(204).end(); @@ -203,7 +134,7 @@ router.post('/:comment_id/actions', (req, res, next) => { metadata } = req.body; - Comment + CommentsService .addAction(req.params.comment_id, req.user.id, action_type, metadata) .then((action) => { res.status(201).json(action); diff --git a/routes/api/index.js b/routes/api/index.js index 120fd47ec..c40c428b4 100644 --- a/routes/api/index.js +++ b/routes/api/index.js @@ -1,25 +1,20 @@ const express = require('express'); const authorization = require('../../middleware/authorization'); -const payloadFilter = require('../../middleware/payload-filter'); const router = express.Router(); -// Filter all content going down the pipe based on user roles. -router.use(payloadFilter); - -router.use('/assets', authorization.needed('admin'), require('./assets')); -router.use('/settings', authorization.needed('admin'), require('./settings')); -router.use('/queue', authorization.needed('admin'), require('./queue')); +router.use('/assets', authorization.needed('ADMIN'), require('./assets')); +router.use('/settings', authorization.needed('ADMIN'), require('./settings')); +router.use('/queue', authorization.needed('ADMIN'), require('./queue')); router.use('/comments', authorization.needed(), require('./comments')); router.use('/actions', authorization.needed(), require('./actions')); router.use('/auth', require('./auth')); -router.use('/stream', require('./stream')); router.use('/users', require('./users')); router.use('/account', require('./account')); // Bind the kue handler to the /kue path. -router.use('/kue', authorization.needed('admin'), require('../../services/kue').kue.app); +router.use('/kue', authorization.needed('ADMIN'), require('../../services/kue').kue.app); module.exports = router; diff --git a/routes/api/queue/index.js b/routes/api/queue/index.js index 34902557c..c106f17f7 100644 --- a/routes/api/queue/index.js +++ b/routes/api/queue/index.js @@ -1,7 +1,8 @@ const express = require('express'); -const Comment = require('../../../models/comment'); -const User = require('../../../models/user'); -const Action = require('../../../models/action'); +const CommentsService = require('../../../services/comments'); +const CommentModel = require('../../../models/comment'); +const UsersService = require('../../../services/users'); +const ActionsService = require('../../../services/actions'); const authorization = require('../../../middleware/authorization'); const _ = require('lodash'); @@ -10,8 +11,8 @@ const router = express.Router(); function gatherActionsAndUsers (comments) { return Promise.all([ comments, - User.findByIdArray(_.uniq(comments.map((comment) => comment.author_id))), - Action.getActionSummaries(_.uniq([ + UsersService.findByIdArray(_.uniq(comments.map((comment) => comment.author_id))), + ActionsService.getActionSummaries(_.uniq([ ...comments.map((comment) => comment.id), ...comments.map((comment) => comment.author_id) ])) @@ -26,11 +27,11 @@ function gatherActionsAndUsers (comments) { // depending on the settings. The :moderation overwrites this settings. // Pre-moderation: New comments are shown in the moderator queues immediately. // Post-moderation: New comments do not appear in moderation queues unless they are flagged by other users. -router.get('/comments/pending', authorization.needed('admin'), (req, res, next) => { +router.get('/comments/pending', authorization.needed('ADMIN'), (req, res, next) => { const {asset_id} = req.query; - Comment.moderationQueue('premod', asset_id) + CommentsService.moderationQueue('PREMOD', asset_id) .then(gatherActionsAndUsers) .then(([comments, users, actions]) => { res.json({comments, users, actions}); @@ -40,10 +41,10 @@ router.get('/comments/pending', authorization.needed('admin'), (req, res, next) }); }); -router.get('/comments/rejected', authorization.needed('admin'), (req, res, next) => { +router.get('/comments/rejected', authorization.needed('ADMIN'), (req, res, next) => { const {asset_id} = req.query; - Comment.moderationQueue('rejected', asset_id) + CommentsService.moderationQueue('REJECTED', asset_id) .then(gatherActionsAndUsers) .then(([comments, users, actions]) => { res.json({comments, users, actions}); @@ -53,7 +54,7 @@ router.get('/comments/rejected', authorization.needed('admin'), (req, res, next) }); }); -router.get('/comments/flagged', authorization.needed('admin'), (req, res, next) => { +router.get('/comments/flagged', authorization.needed('ADMIN'), (req, res, next) => { const {asset_id} = req.query; const assetIDWrap = (query) => { @@ -64,8 +65,8 @@ router.get('/comments/flagged', authorization.needed('admin'), (req, res, next) return query; }; - Comment.findIdsByActionType('flag') - .then(ids => assetIDWrap(Comment.find({ + CommentsService.findIdsByActionType('FLAG') + .then(ids => assetIDWrap(CommentModel.find({ id: {$in: ids} }))) .then(gatherActionsAndUsers) diff --git a/routes/api/settings/index.js b/routes/api/settings/index.js index 76d16c7ec..f1a5fe9f7 100644 --- a/routes/api/settings/index.js +++ b/routes/api/settings/index.js @@ -1,24 +1,26 @@ const express = require('express'); -const Setting = require('../../../models/setting'); +const SettingsService = require('../../../services/settings'); const router = express.Router(); router.get('/', (req, res, next) => { - Setting.retrieve().then((settings) => { - res.json(settings); - }) - .catch((err) => { - next(err); - }); + SettingsService + .retrieve().then((settings) => { + res.json(settings); + }) + .catch((err) => { + next(err); + }); }); router.put('/', (req, res, next) => { - Setting.update(req.body).then(() => { - res.status(204).end(); - }) - .catch((err) => { - next(err); - }); + SettingsService + .update(req.body).then(() => { + res.status(204).end(); + }) + .catch((err) => { + next(err); + }); }); module.exports = router; diff --git a/routes/api/stream/index.js b/routes/api/stream/index.js deleted file mode 100644 index 06845a21a..000000000 --- a/routes/api/stream/index.js +++ /dev/null @@ -1,112 +0,0 @@ -const express = require('express'); -const _ = require('lodash'); -const scraper = require('../../../services/scraper'); -const errors = require('../../../errors'); -const url = require('url'); - -const Comment = require('../../../models/comment'); -const User = require('../../../models/user'); -const Action = require('../../../models/action'); -const Asset = require('../../../models/asset'); -const Setting = require('../../../models/setting'); - -const router = express.Router(); - -router.get('/', (req, res, next) => { - - let asset_url = decodeURIComponent(req.query.asset_url); - - // Verify that the asset_url is parsable. - let parsed_asset_url = url.parse(asset_url); - if (!parsed_asset_url.protocol) { - return next(errors.ErrInvalidAssetURL); - } - - // Get the asset_id for this url (or create it if it doesn't exist) - Promise.all([ - - // Find or create the asset by url. - Asset.findOrCreateByUrl(asset_url) - - // Add the found asset to the scraper if it's not already scraped. - .then((asset) => { - if (!asset.scraped) { - return scraper.create(asset).then(() => asset); - } - - return asset; - }), - - // Get the moderation setting from the settings. - Setting.retrieve() - ]) - .then(([asset, settings]) => { - - // Merge the asset specific settings with the returned settings object in - // the event that the asset that was returned also had settings. - if (asset && asset.settings) { - settings.merge(asset.settings); - } - - return Promise.all([ - - // This is the promised component... Fetch the comments based on the - // moderation settings. - Comment.findByAssetIdWithStatuses(asset.id, [null, 'accepted']), - - // Send back the reference to the asset. - asset, - - // Send back the settings to the stream. - settings - ]); - }) - - // Get all the users and actions for those comments. - .then(([comments, asset, settings]) => { - - // Get the user id's from the author id's as a unique array that gets - // sorted. - let userIDs = _.uniq(comments.map((comment) => comment.author_id)).sort(); - - // Fetch the users for which there is a comment available for them. - let users = userIDs.length > 0 ? User.findByIdArray(userIDs) : []; - - // Fetch the actions for pretty much everything at this point. - let actions = Action.getActionSummariesFromComments(asset.id, comments, req.user ? req.user.id : false); - - return Promise.all([ - - // Pass back the asset that we loaded... - asset, - - // It's comments... - comments, - - // The users who wrote those comments - users, - - // And all actions about the asset, comments, and users. - actions, - - // Pass back the settings that we loaded. - settings - ]); - }) - .then(([asset, comments, users, actions, settings]) => { - - // Send back the payload containing all this data. - res.json({ - assets: [asset], - comments, - users, - actions, - settings - }); - }) - .catch(error => { - next(error); - }); -}); - -module.exports = router; diff --git a/routes/api/users/index.js b/routes/api/users/index.js index 756293c16..3ea3f3213 100644 --- a/routes/api/users/index.js +++ b/routes/api/users/index.js @@ -1,11 +1,12 @@ const express = require('express'); const router = express.Router(); -const User = require('../../../models/user'); -const Setting = require('../../../models/setting'); +const UsersService = require('../../../services/users'); +const SettingsService = require('../../../services/settings'); +const CommentsService = require('../../../services/comments'); const mailer = require('../../../services/mailer'); const authorization = require('../../../middleware/authorization'); -router.get('/', authorization.needed('admin'), (req, res, next) => { +router.get('/', authorization.needed('ADMIN'), (req, res, next) => { const { value = '', field = 'created_at', @@ -15,12 +16,12 @@ router.get('/', authorization.needed('admin'), (req, res, next) => { } = req.query; Promise.all([ - User + UsersService .search(value) .sort({[field]: (asc === 'true') ? 1 : -1}) .skip((page - 1) * limit) .limit(limit), - User.count() + UsersService.count() ]) .then(([result, count]) => { res.json({ @@ -34,8 +35,8 @@ router.get('/', authorization.needed('admin'), (req, res, next) => { .catch(next); }); -router.post('/:user_id/role', authorization.needed('admin'), (req, res, next) => { - User +router.post('/:user_id/role', authorization.needed('ADMIN'), (req, res, next) => { + UsersService .addRoleToUser(req.params.user_id, req.body.role) .then(() => { res.status(204).end(); @@ -43,11 +44,15 @@ router.post('/:user_id/role', authorization.needed('admin'), (req, res, next) => .catch(next); }); -router.post('/:user_id/status', (req, res, next) => { - User - .setStatus(req.params.user_id, req.body.status, req.body.comment_id) +router.post('/:user_id/status', authorization.needed('ADMIN'), (req, res, next) => { + UsersService + .setStatus(req.params.user_id, req.body.status) .then((status) => { res.status(201).json(status); + + if (status === 'BANNED' && req.body.comment_id) { + return CommentsService.pushStatus(req.body.comment_id, 'rejected', req.params.user_id); + } }) .catch(next); }); @@ -64,7 +69,7 @@ router.post('/:user_id/status', (req, res, next) => { * @param {String} userID the id for the user to send the email to * @param {String} email the email for the user to send the email to */ -const SendEmailConfirmation = (app, userID, email) => User +const SendEmailConfirmation = (app, userID, email) => UsersService .createEmailConfirmToken(userID, email) .then((token) => { return mailer.sendSimple({ @@ -87,14 +92,14 @@ router.post('/', (req, res, next) => { displayName } = req.body; - User + UsersService .createLocalUser(email, password, displayName) .then((user) => { // Get the settings from the database to find out if we need to send an // email confirmation. The Front end will know about the // requireEmailConfirmation as it's included in the settings get endpoint. - return Setting.retrieve().then(({requireEmailConfirmation = false}) => { + return SettingsService.retrieve().then(({requireEmailConfirmation = false}) => { if (requireEmailConfirmation) { @@ -123,7 +128,7 @@ router.post('/:user_id/actions', authorization.needed(), (req, res, next) => { metadata } = req.body; - User + UsersService .addAction(req.params.user_id, req.user.id, action_type, metadata) .then((action) => { res.status(201).json(action); @@ -133,12 +138,12 @@ router.post('/:user_id/actions', authorization.needed(), (req, res, next) => { }); }); -router.post('/:user_id/email/confirm', authorization.needed('admin'), (req, res, next) => { +router.post('/:user_id/email/confirm', authorization.needed('ADMIN'), (req, res, next) => { const { user_id } = req.params; - User + UsersService .findById(user_id) .then((user) => { if (!user) { diff --git a/services/actions.js b/services/actions.js new file mode 100644 index 000000000..c336dd974 --- /dev/null +++ b/services/actions.js @@ -0,0 +1,177 @@ +const ActionModel = require('../models/action'); +const _ = require('lodash'); + +module.exports = class ActionsService { + + /** + * Finds an action by the id. + * @param {String} id identifier of the action (uuid) + */ + static findById(id) { + return ActionModel.findOne({id}); + } + + /** + * Add an action. + * @param {String} item_id identifier of the comment (uuid) + * @param {String} user_id user id of the action (uuid) + * @param {String} action the new action to the comment + * @return {Promise} + */ + static insertUserAction(action) { + + // Actions are made unique by using a query that can be reproducable, i.e., + // not containing user inputable values. + let query = { + action_type: action.action_type, + item_type: action.item_type, + item_id: action.item_id, + user_id: action.user_id + }; + + // Create/Update the action. + return ActionModel.findOneAndUpdate(query, action, { + + // Ensure that if it's new, we return the new object created. + new: true, + + // Perform an upsert in the event that this doesn't exist. + upsert: true, + + // Set the default values if not provided based on the mongoose models. + setDefaultsOnInsert: true + }); + } + + /** + * Finds actions in an array of ids. + * @param {String} ids array of user identifiers (uuid) + */ + static findByItemIdArray(item_ids) { + return ActionModel.find({ + 'item_id': {$in: item_ids} + }); + } + + /** + * Fetches the action summaries for the given asset, and comments around the + * given user id. + * @param {[type]} asset_id [description] + * @param {[type]} comments [description] + * @param {String} [current_user_id=''] [description] + * @return {[type]} [description] + */ + static getActionSummariesFromComments(asset_id = '', comments, current_user_id = '') { + + // Get the user id's from the author id's as a unique array that gets + // sorted. + let userIDs = _.uniq(comments.map((comment) => comment.author_id)).sort(); + + // Fetch the actions for pretty much everything at this point. + return ActionsService.getActionSummaries(_.uniq([ + + // Actions can be on assets... + asset_id, + + // Comments... + ...comments.map((comment) => comment.id), + + // Or Authors... + ...userIDs + ].filter((e) => e)), current_user_id); + } + + /** + * Returns summaries of actions for an array of ids + * @param {String} ids array of user identifiers (uuid) + */ + static getActionSummaries(item_ids, current_user_id = '') { + return ActionModel.aggregate([ + { + + // only grab items that match the specified item id's + $match: { + item_id: { + $in: item_ids + } + } + }, + { + $group: { + + // group unique documents by these properties, we are leveraging the + // fact that each uuid is completly unique. + _id: { + item_id: '$item_id', + action_type: '$action_type' + }, + + // and sum up all actions matching the above grouping criteria + count: { + $sum: 1 + }, + + // we are leveraging the fact that each uuid is completly unique and + // just grabbing the last instance of the item type here. + item_type: { + $last: '$item_type' + }, + + current_user: { + $max: { + $cond: { + if: { + $eq: ['$user_id', current_user_id], + }, + then: '$$CURRENT', + else: null + } + } + } + } + }, + { + $project: { + + // suppress the _id field + _id: false, + + // map the fields from the _id grouping down a level + item_id: '$_id.item_id', + action_type: '$_id.action_type', + + // map the field directly + count: '$count', + item_type: '$item_type', + + // set the current user to false here + current_user: '$current_user' + } + } + ]); + } + + /* + * Finds all comments for a specific action. + * @param {String} action_type type of action + * @param {String} item_type type of item the action is on + */ + static findByType(action_type, item_type) { + return ActionModel.find({ + 'action_type': action_type, + 'item_type': item_type + }); + } + + /** + * Finds all comments ids for a specific action. + * @param {String} action_type type of action + * @param {String} item_type type of item the action is on + */ + static findCommentsIdByActionType(action_type, item_type) { + return ActionModel.find({ + 'action_type': action_type, + 'item_type': item_type + }, 'item_id'); + } +}; diff --git a/services/assets.js b/services/assets.js new file mode 100644 index 000000000..569c7ee2d --- /dev/null +++ b/services/assets.js @@ -0,0 +1,116 @@ +const AssetModel = require('../models/asset'); +const SettingsService = require('./settings'); + +module.exports = class AssetsService { + + /** + * Finds an asset by its id. + * @param {String} id identifier of the asset (uuid). + */ + static findById(id) { + return AssetModel.findOne({id}); + } + + /** + * Finds a asset by its url. + * @param {String} url identifier of the asset (uuid). + */ + static findByUrl(url) { + return AssetModel.findOne({url}); + } + + /** + * Retrieves the settings given an asset query and rectifies it against the + * global settings. + * @param {Promise} assetQuery an asset query that returns a single asset. + * @return {Promise} + */ + static rectifySettings(assetQuery) { + return Promise.all([ + SettingsService.retrieve(), + assetQuery + ]).then(([settings, asset]) => { + + // If the asset exists and has settings then return the merged object. + if (asset && asset.settings) { + settings.merge(asset.settings); + } + + return settings; + }); + } + + /** + * Finds a asset by its url. + * + * NOTE: This function has scalability concerns regarding mongoose's decision + * always write {updated_at: new Date()} on every call to findOneAndUpdate + * even though the update document exactly matches the query document... In + * the future this function should never update, only findOneAndCreate but this + * is not possible with the mongoose driver. + * + * @param {String} url identifier of the asset (uuid). + * @return {Promise} + */ + static findOrCreateByUrl(url) { + return AssetModel.findOneAndUpdate({url}, {url}, { + + // Ensure that if it's new, we return the new object created. + new: true, + + // Perform an upsert in the event that this doesn't exist. + upsert: true, + + // Set the default values if not provided based on the mongoose models. + setDefaultsOnInsert: true + }); + } + + /** + * Updates the settings for the asset. + * @param {[type]} id [description] + * @param {[type]} settings [description] + * @return {[type]} [description] + */ + static overrideSettings(id, settings) { + return AssetModel.findOneAndUpdate({id}, { + $set: { + settings + } + }, { + new: true + }); + } + + /** + * Finds assets matching keywords on the model. If `value` is an empty string, + * then it will not even perform a text search query. + * @param {String} value string to search by. + * @return {Promise} + */ + static search(value) { + if (value.length === 0) { + return AssetsService.all(); + } else { + return AssetModel.find({ + $text: { + $search: value + } + }); + } + } + + /** + * Finds multiple assets with matching ids + * @param {Array} ids an array of Strings of asset_id + * @return {Promise} resolves to list of Assets + */ + static findMultipleById(ids) { + const query = ids.map(id => ({id})); + return AssetModel.find(query); + } + + static all() { + return AssetModel.find({}); + } +}; diff --git a/services/comments.js b/services/comments.js new file mode 100644 index 000000000..5d39a129e --- /dev/null +++ b/services/comments.js @@ -0,0 +1,220 @@ +const CommentModel = require('../models/comment'); + +const ActionModel = require('../models/action'); +const ActionsService = require('./actions'); + +module.exports = class CommentsService { + + /** + * Creates a new Comment that came from a public source. + * @param {Mixed} comment either a single comment or an array of comments. + * @return {Promise} + */ + static publicCreate(comment) { + + // Check to see if this is an array of comments, if so map it out. + if (Array.isArray(comment)) { + return Promise.all(comment.map(CommentsService.publicCreate)); + } + + const { + body, + asset_id, + parent_id, + status = null, + author_id + } = comment; + + comment = new CommentModel({ + body, + asset_id, + parent_id, + status_history: status ? [{ + type: status, + created_at: new Date() + }] : [], + status, + author_id + }); + + return comment.save(); + } + + /** + * Finds a comment by the id. + * @param {String} id identifier of comment (uuid) + * @return {Promise} + */ + static findById(id) { + return CommentModel.findOne({id}); + } + + /** + * Finds ALL the comments by the asset_id. + * @param {String} asset_id identifier of the asset which owns this comment (uuid) + * @return {Promise} + */ + static findByAssetId(asset_id) { + return CommentModel.find({ + asset_id + }); + } + + /** + * findByAssetIdWithStatuses finds all the comments where the asset id matches + * what's provided and the status is one of the ones listed in the statuses + * array. + * @param {String} asset_id the asset id to search by + * @param {Array} [statuses=[]] the array of statuses to search by + * @return {Promise} resolves to an array of comments + */ + static findByAssetIdWithStatuses(asset_id, statuses = []) { + return CommentModel.find({ + asset_id, + status: { + $in: statuses + } + }); + } + + /** + * Find comments by an action that was performed on them. + * @param {String} action_type the type of action that was performed on the comment + * @return {Promise} + */ + static findByActionType(action_type) { + return ActionsService + .findCommentsIdByActionType(action_type, 'COMMENTS') + .then((actions) => CommentModel.find({ + id: { + $in: actions.map((a) => a.item_id) + } + })); + } + + /** + * Find comment id's where the action type matches the argument. + * @param {String} action_type the type of action that was performed on the comment + * @return {Promise} + */ + static findIdsByActionType(action_type) { + return ActionsService + .findCommentsIdByActionType(action_type, 'COMMENTS') + .then((actions) => actions.map(a => a.item_id)); + } + + /** + * Find comments by current status + * @param {String} status status of the comment to search for + * @return {Promise} resovles to comment array + */ + static findByStatus(status = null) { + return CommentModel.find({status}); + } + + /** + * Find comments that need to be moderated (aka moderation queue). + * @param {String} asset_id + * @return {Promise} + */ + static moderationQueue(status = null, asset_id = null) { + + // Fetch the comments with statuses. + let comments = CommentModel.find({status}); + + if (asset_id) { + comments = comments.where({asset_id}); + } + + return comments; + } + + /** + * Pushes a new status in for the user. + * @param {String} id identifier of the comment (uuid) + * @param {String} status the new status of the comment + * @param {String} assigned_by the user id for the user who performed the + * moderation action + * @return {Promise} + */ + static pushStatus(id, status, assigned_by = null) { + return CommentModel.update({id}, { + $push: { + status_history: { + type: status, + created_at: new Date(), + assigned_by + } + }, + $set: {status} + }); + } + + /** + * Add an action to the comment. + * @param {String} item_id identifier of the comment (uuid) + * @param {String} user_id user id of the action (uuid) + * @param {String} action the new action to the comment + * @return {Promise} + */ + static addAction(item_id, user_id, action_type, metadata) { + return ActionsService.insertUserAction({ + item_id, + item_type: 'COMMENTS', + user_id, + action_type, + metadata + }); + } + + /** + * Change the status of a comment. + * @param {String} id identifier of the comment (uuid) + * @param {String} status the new status of the comment + * @return {Promise} + */ + static removeById(id) { + return CommentModel.remove({id}); + } + + /** + * Remove an action from the comment. + * @param {String} id identifier of the comment (uuid) + * @param {String} action_type the type of the action to be removed + * @param {String} user_id the id of the user performing the action + * @return {Promise} + */ + static removeAction(item_id, user_id, action_type) { + return ActionModel.remove({ + action_type, + item_type: 'COMMENTS', + item_id, + user_id + }); + } + + /** + * Returns all the comments in the collection. + * @return {Promise} + */ + static all() { + return CommentModel.find({}); + } + + /** + * Returns all the comments by user + * probably to be paginated at some point in the future + * @return {Promise} array resolves to an array of comments by that user + */ + static findByUserId(author_id, admin = false) { + + // do not return un-published comments for non-admins + let query = {author_id}; + + if (!admin) { + query.$nor = [{status: 'PREMOD'}, {status: 'REJECTED'}]; + } + + return CommentModel.find(query); + } +}; diff --git a/services/mongoose.js b/services/mongoose.js index 1b9097760..c7092326f 100644 --- a/services/mongoose.js +++ b/services/mongoose.js @@ -57,3 +57,12 @@ mongoose.connect(url, (err) => { }); module.exports = mongoose; + +// Here we include all the models that mongoose is used for, this ensures that +// when we import mongoose that we also start up all the indexing opreations +// here. +require('../models/action'); +require('../models/asset'); +require('../models/comment'); +require('../models/setting'); +require('../models/user'); diff --git a/services/passport.js b/services/passport.js index 130de234d..f24d12165 100644 --- a/services/passport.js +++ b/services/passport.js @@ -1,6 +1,6 @@ const passport = require('passport'); -const User = require('../models/user'); -const Setting = require('../models/setting'); +const UsersService = require('./users'); +const SettingsService = require('./settings'); const LocalStrategy = require('passport-local').Strategy; const FacebookStrategy = require('passport-facebook').Strategy; @@ -13,7 +13,7 @@ passport.serializeUser((user, done) => { }); passport.deserializeUser((id, done) => { - User + UsersService .findById(id) .then((user) => { done(null, user); @@ -43,7 +43,7 @@ function ValidateUserLogin(loginProfile, user, done) { } // The user is a local user, check if we need email confirmation. - return Setting.retrieve().then(({requireEmailConfirmation = false}) => { + return SettingsService.retrieve().then(({requireEmailConfirmation = false}) => { // If we have the requirement of checking that emails for users are // verified, then we need to check the email address to ensure that it has @@ -77,7 +77,7 @@ passport.use(new LocalStrategy({ usernameField: 'email', passwordField: 'password' }, (email, password, done) => { - User + UsersService .findLocalUser(email, password) .then((user) => { if (!user) { @@ -103,7 +103,7 @@ if (process.env.TALK_FACEBOOK_APP_ID && process.env.TALK_FACEBOOK_APP_SECRET && callbackURL: `${process.env.TALK_ROOT_URL}/api/v1/auth/facebook/callback`, profileFields: ['id', 'displayName', 'picture.type(large)'] }, (accessToken, refreshToken, profile, done) => { - User + UsersService .findOrCreateExternalUser(profile) .then((user) => { return ValidateUserLogin(profile, user, done); diff --git a/services/scraper.js b/services/scraper.js index 6a3260757..aa56bf61b 100644 --- a/services/scraper.js +++ b/services/scraper.js @@ -1,6 +1,7 @@ const kue = require('./kue'); const debug = require('debug')('talk:services:scraper'); -const Asset = require('../models/asset'); +const AssetModel = require('../models/asset'); +const AssetsService = require('./assets'); const metascraper = require('metascraper'); @@ -49,7 +50,7 @@ const scraper = { * Updates an Asset based on scraped asset metadata. */ update(id, meta) { - return Asset.update({id}, { + return AssetModel.update({id}, { $set: { title: meta.title || '', description: meta.description || '', @@ -74,7 +75,7 @@ const scraper = { debug(`Starting on Job[${job.id}] for Asset[${job.data.asset_id}]`); - Asset + AssetsService // Find the asset, or complain that it doesn't exist. .findById(job.data.asset_id) diff --git a/services/settings.js b/services/settings.js new file mode 100644 index 000000000..d82fb91a5 --- /dev/null +++ b/services/settings.js @@ -0,0 +1,49 @@ +const SettingModel = require('../models/setting'); + +/** + * The selector used to uniquely identify the settings document. + */ +const selector = {id: '1'}; + +/** + * The Setting Service object exposing the Setting model. + */ +module.exports = class SettingsService { + + /** + * Gets the entire settings record and sends it back + * @return {Promise} settings the whole settings record + */ + static retrieve() { + return SettingModel.findOne(selector); + } + + /** + * This will update the settings object with whatever you pass in + * @param {object} setting a hash of whatever settings you want to update + * @return {Promise} settings Promise that resolves to the entire (updated) settings object. + */ + static update(settings) { + return SettingModel.findOneAndUpdate(selector, { + $set: settings + }, { + upsert: true, + new: true, + setDefaultsOnInsert: true + }); + } + + /** + * This is run once when the app starts to ensure settings are populated. + * @return {Promise} null initialize the global settings object + */ + static init(defaults) { + + // Inject the defaults on top of the passed in defaults to ensure that the new + // settings conform to the required selector. + defaults = Object.assign({}, defaults, selector); + + // Actually update the settings collection. + return SettingsService.update(defaults); + } +}; diff --git a/services/users.js b/services/users.js new file mode 100644 index 000000000..0bf22e9e0 --- /dev/null +++ b/services/users.js @@ -0,0 +1,601 @@ +const bcrypt = require('bcrypt'); +const jwt = require('jsonwebtoken'); +const Wordlist = require('./wordlist'); +const errors = require('../errors'); +const uuid = require('uuid'); + +const UserModel = require('../models/user'); +const USER_STATUS = require('../models/user').USER_STATUS; +const USER_ROLES = require('../models/user').USER_ROLES; + +const ActionsService = require('./actions'); + +// In the event that the TALK_SESSION_SECRET is missing but we are testing, then +// set the process.env.TALK_SESSION_SECRET. +if (process.env.NODE_ENV === 'test' && !process.env.TALK_SESSION_SECRET) { + process.env.TALK_SESSION_SECRET = 'keyboard cat'; +} else if (!process.env.TALK_SESSION_SECRET) { + throw new Error('TALK_SESSION_SECRET must be defined to encode JSON Web Tokens and other auth functionality'); +} + +const EMAIL_CONFIRM_JWT_SUBJECT = 'email_confirm'; +const PASSWORD_RESET_JWT_SUBJECT = 'password_reset'; + +// SALT_ROUNDS is the number of rounds that the bcrypt algorithm will run +// through during the salting process. +const SALT_ROUNDS = 10; + +// UsersService is the interface for the application to interact with the +// UserModel through. +module.exports = class UsersService { + + /** + * Finds a user given their email address that we have for them in the system + * and ensures that the retuned user matches the password passed in as well. + * @param {string} email - email to look up the user by + * @param {string} password - password to match against the found user + * @param {Function} done [description] + */ + static findLocalUser(email, password) { + if (!email || typeof email !== 'string') { + return Promise.reject('email is required for findLocalUser'); + } + + return UserModel.findOne({ + profiles: { + $elemMatch: { + id: email.toLowerCase(), + provider: 'local' + } + } + }) + .then((user) => { + if (!user) { + return false; + } + + return new Promise((resolve, reject) => { + bcrypt.compare(password, user.password, (err, res) => { + if (err) { + return reject(err); + } + + if (!res) { + return resolve(false); + } + + return resolve(user); + }); + }); + }); + } + + /** + * Merges two users together by taking all the profiles on a given user and + * pushing them into the source user followed by deleting the destination user's + * user account. This will not merge the roles associated with the source user. + * @param {String} dstUserID id of the user to which is the target of the merge + * @param {String} srcUserID id of the user to which is the source of the merge + * @return {Promise} resolves when the users are merged + */ + static mergeUsers(dstUserID, srcUserID) { + let srcUser, dstUser; + + return Promise + .all([ + UserModel.findOne({id: dstUserID}).exec(), + UserModel.findOne({id: srcUserID}).exec() + ]) + .then((users) => { + dstUser = users[0]; + srcUser = users[1]; + + srcUser.profiles.forEach((profile) => { + dstUser.profiles.push(profile); + }); + + return srcUser.remove(); + }) + .then(() => dstUser.save()); + } + + /** + * Finds a user given a social profile and if the user does not exist, creates + * them. + * @param {Object} profile - User social/external profile + * @param {Function} done [description] + */ + static findOrCreateExternalUser(profile) { + return UserModel + .findOne({ + profiles: { + $elemMatch: { + id: profile.id, + provider: profile.provider + } + } + }) + .then((user) => { + if (user) { + return user; + } + + // The user was not found, lets create them! + user = new UserModel({ + displayName: profile.displayName, + roles: [], + profiles: [ + { + id: profile.id, + provider: profile.provider + } + ] + }); + + return user.save(); + }); + } + + static changePassword(id, password) { + return new Promise((resolve, reject) => { + bcrypt.hash(password, SALT_ROUNDS, (err, hashedPassword) => { + if (err) { + return reject(err); + } + + resolve(hashedPassword); + }); + }) + .then((hashedPassword) => { + return UserModel.update({id}, { + $inc: {__v: 1}, + $set: { + password: hashedPassword + } + }); + }); + } + + /** + * Creates local users. + * @param {Array} users Users to create + * @return {Promise} Resolves with the users that were created + */ + static createLocalUsers(users) { + return Promise.all(users.map((user) => { + return UsersService + .createLocalUser(user.email, user.password, user.displayName); + })); + } + + /** + * Check the requested displayname for naughty words (currently in English) and special chars + * @param {String} displayName word to be checked for profanity + * @return {Promise} rejected if the machine's sensibilites are offended + */ + static isValidDisplayName(displayName) { + const onlyLettersNumbersUnderscore = /^[a-z0-9_]+$/; + + if (!displayName) { + return Promise.reject(errors.ErrMissingDisplay); + } + + if (!onlyLettersNumbersUnderscore.test(displayName)) { + + return Promise.reject(errors.ErrSpecialChars); + } + + // check for profanity + return Wordlist.displayNameCheck(displayName); + } + + /** + * Creates the local user with a given email, password, and name. + * @param {String} email email of the new user + * @param {String} password plaintext password of the new user + * @param {String} displayName name of the display user + * @param {Function} done callback + */ + static createLocalUser(email, password, displayName) { + + if (!email) { + return Promise.reject(errors.ErrMissingEmail); + } + + email = email.toLowerCase().trim(); + displayName = displayName.toLowerCase().trim(); + + if (!password) { + return Promise.reject(errors.ErrMissingPassword); + } + + if (password.length < 8) { + return Promise.reject(errors.ErrPasswordTooShort); + } + + return UsersService.isValidDisplayName(displayName) + .then(() => { // displayName is valid + return new Promise((resolve, reject) => { + bcrypt.hash(password, SALT_ROUNDS, (err, hashedPassword) => { + if (err) { + return reject(err); + } + + let user = new UserModel({ + displayName: displayName, + password: hashedPassword, + roles: [], + profiles: [ + { + id: email, + provider: 'local' + } + ] + }); + + user.save((err) => { + if (err) { + if (err.code === 11000) { + if (err.message.match('displayName')) { + return reject(errors.ErrDisplayTaken); + } + return reject(errors.ErrEmailTaken); + } + return reject(err); + } + return resolve(user); + }); + }); + }); + }); + } + + /** + * Disables a given user account. + * @param {String} id id of a user + * @param {Function} done callback after the operation is complete + */ + static disableUser(id) { + return UserModel.update({ + id: id + }, { + $set: { + disabled: true + } + }); + } + + /** + * Enables a given user account. + * @param {String} id id of a user + * @param {Function} done callback after the operation is complete + */ + static enableUser(id) { + return UserModel.update({ + id: id + }, { + $set: { + disabled: false + } + }); + } + + /** + * Adds a role to a user. + * @param {String} id id of a user + * @param {String} role role to add + * @param {Function} done callback after the operation is complete + */ + static addRoleToUser(id, role) { + + // Check to see if the user role is in the allowable set of roles. + if (USER_ROLES.indexOf(role) === -1) { + + // User role is not supported! Error out here. + return Promise.reject(new Error(`role ${role} is not supported`)); + } + + return UserModel.update({ + id: id + }, { + $addToSet: { + roles: role + } + }); + } + + /** + * Removes a role from a user. + * @param {String} id id of a user + * @param {String} role role to remove + * @param {Function} done callback after the operation is complete + */ + static removeRoleFromUser(id, role) { + + // Check to see if the user role is in the allowable set of roles. + if (USER_ROLES.indexOf(role) === -1) { + + // User role is not supported! Error out here. + return Promise.reject(new Error(`role ${role} is not supported`)); + } + + return UserModel.update({ + id: id + }, { + $pull: { + roles: role + } + }); + } + + /** + * Set status of a user. + * @param {String} id id of a user + * @param {String} status status to set + * @param {Function} done callback after the operation is complete + */ + static setStatus(id, status) { + + // Check to see if the user status is in the allowable set of roles. + if (USER_STATUS.indexOf(status) === -1) { + + // User status is not supported! Error out here. + return Promise.reject(new Error(`status ${status} is not supported`)); + } + + return UserModel.update({id}, {$set: {status}}); + } + + /** + * Finds a user with the id. + * @param {String} id user id (uuid) + */ + static findById(id) { + return UserModel.findOne({id}); + } + + /** + * Finds users in an array of ids. + * @param {Array} ids array of user identifiers (uuid) + */ + static findByIdArray(ids) { + return UserModel.find({ + id: {$in: ids} + }); + } + + /** + * Finds public user information by an array of ids. + * @param {Array} ids array of user identifiers (uuid) + */ + static findPublicByIdArray(ids) { + return UserModel.find({ + id: {$in: ids} + }, 'id displayName'); + } + + /** + * Creates a JWT from a user email. Only works for local accounts. + * @param {String} email of the local user + */ + static createPasswordResetToken(email) { + if (!email || typeof email !== 'string') { + return Promise.reject('email is required when creating a JWT for resetting passord'); + } + + email = email.toLowerCase(); + + return UserModel.findOne({profiles: {$elemMatch: {id: email}}}) + .then((user) => { + if (!user) { + + // Since we don't want to reveal that the email does/doesn't exist + // just go ahead and resolve the Promise with null and check in the + // endpoint. + return; + } + + const payload = { + jti: uuid.v4(), + email, + userId: user.id, + version: user.__v + }; + + return jwt.sign(payload, process.env.TALK_SESSION_SECRET, { + algorithm: 'HS256', + expiresIn: '1d', + subject: PASSWORD_RESET_JWT_SUBJECT + }); + }); + } + + /** + * Verifies that the token was indeed signed by the session secret. + * @param {String} token JWT token from the client + * @return {Promise} + */ + static verifyToken(token, options = {}) { + return new Promise((resolve, reject) => { + + // Set the allowed algorithms. + options.algorithms = ['HS256']; + + jwt.verify(token, process.env.TALK_SESSION_SECRET, options, (err, decoded) => { + if (err) { + return reject(err); + } + + resolve(decoded); + }); + }); + } + + /** + * Verifies a jwt and returns the associated user. + * @param {String} token the JSON Web Token to verify + */ + static verifyPasswordResetToken(token) { + return UsersService + .verifyToken(token, { + subject: PASSWORD_RESET_JWT_SUBJECT + }) + .then((decoded) => UsersService.findById(decoded.userId)); + } + + /** + * Finds a user using a value which gets compared using a prefix match against + * the user's email address and/or their display name. + * @param {String} value value to search by + * @return {Promise} + */ + static search(value) { + return UserModel.find({ + $or: [ + + // Search by a prefix match on the displayName. + { + 'displayName': { + $regex: new RegExp(`^${value}`), + $options: 'i' + } + }, + + // Search by a prefix match on the email address. + { + 'profiles': { + $elemMatch: { + id: { + $regex: new RegExp(`^${value}`), + $options: 'i' + }, + provider: 'local' + } + } + } + ] + }); + } + + /** + * Returns a count of the current users. + * @return {Promise} + */ + static count() { + return UserModel.count(); + } + + /** + * Returns all the users. + * @return {Promise} + */ + static all() { + return UserModel.find(); + } + + /** + * Updates the user's settings. + * @return {Promise} + */ + static updateSettings(id, settings) { + return UserModel.update({ + id + }, { + $set: { + settings + } + }); + } + + /** + * Add an action to the user. + * @param {String} item_id identifier of the user (uuid) + * @param {String} user_id user id of the action (uuid) + * @param {String} action the new action to the user + * @return {Promise} + */ + static addAction(item_id, user_id, action_type, metadata) { + return ActionsService.insertUserAction({ + item_id, + item_type: 'users', + user_id, + action_type, + metadata + }); + } + + /** + * This creates a token based around confirming the local profile. + * @param {String} userID The user id for the user that we are creating the + * token for. + * @param {String} email The email that we are needing to get confirmed. + * @return {Promise} + */ + static createEmailConfirmToken(userID, email) { + if (!email || typeof email !== 'string') { + return Promise.reject('email is required when creating a JWT for resetting passord'); + } + + email = email.toLowerCase(); + + return UsersService + .findById(userID) + .then((user) => { + if (!user) { + return Promise.reject(new Error('user not found')); + } + + // Get the profile representing the local account. + let profile = user.profiles.find((profile) => profile.id === email && profile.provider === 'local'); + + // Ensure that the user email hasn't already been verified. + if (profile && profile.metadata && profile.metadata.confirmed_at) { + return Promise.reject(new Error('email address already confirmed')); + } + + const payload = { + email, + userID + }; + + return jwt.sign(payload, process.env.TALK_SESSION_SECRET, { + jwtid: uuid.v4(), + algorithm: 'HS256', + expiresIn: '1d', + subject: EMAIL_CONFIRM_JWT_SUBJECT + }); + }); + } + + /** + * This verifies that a given token was for the email confirmation and updates + * that user's profile with a 'confirmed_at' parameter with the current date. + * @param {String} token the token containing the email confirmation details + * signed with our secret. + * @return {Promise} + */ + static verifyEmailConfirmation(token) { + return UsersService + .verifyToken(token, { + subject: EMAIL_CONFIRM_JWT_SUBJECT + }) + .then(({userID, email}) => { + + return UserModel + .update({ + id: userID, + profiles: { + $elemMatch: { + id: email, + provider: 'local' + } + } + }, { + $set: { + 'profiles.$.metadata.confirmed_at': new Date() + } + }); + }); + } + +}; diff --git a/services/wordlist.js b/services/wordlist.js index e912abc43..a06801e87 100644 --- a/services/wordlist.js +++ b/services/wordlist.js @@ -2,7 +2,7 @@ const debug = require('debug')('talk:services:wordlist'); const _ = require('lodash'); const natural = require('natural'); const tokenizer = new natural.WordTokenizer(); -const Setting = require('../models/setting'); +const SettingsService = require('./settings'); const Errors = require('../errors'); /** @@ -22,7 +22,7 @@ class Wordlist { * Loads wordlists in from the database */ load() { - return Setting + return SettingsService .retrieve() .then((settings) => { @@ -118,6 +118,42 @@ class Wordlist { }); } + /** + * Scans a specific field for wordlist violations. + */ + scan(fieldName, phrase) { + let errors = {}; + + // If the field doesn't exist in the body, then it can't be profane! + if (!phrase) { + + // Return that there wasn't a profane word here. + return errors; + } + + // Check if the field contains a banned word. + if (this.match(this.lists.banned, phrase)) { + debug(`the field "${fieldName}" contained a phrase "${phrase}" which contained a banned word/phrase`); + + errors.banned = Errors.ErrContainsProfanity; + + // Stop looping through the fields now, we discovered the worst possible + // situation (a banned word). + return errors; + } + + // Check if the field contains a banned word. + if (this.match(this.lists.suspect, phrase)) { + debug(`the field "${fieldName}" contained a phrase "${phrase}" which contained a suspected word/phrase`); + + errors.suspect = Errors.ErrContainsProfanity; + + // Continue looping through the fields now, we discovered a possible bad + // word (suspect). + return errors; + } + } + /** * Perform the filtering based on the loaded wordlists. */ @@ -129,9 +165,9 @@ class Wordlist { // Loop over all the fields from the body that we want to check. for (let i = 0; i < fields.length; i++) { - let field = fields[i]; + let fieldName = fields[i]; - let phrase = _.get(body, field, false); + let phrase = _.get(body, fieldName, false); // If the field doesn't exist in the body, then it can't be profane! if (!phrase) { @@ -140,11 +176,10 @@ class Wordlist { continue; } - // Check if the field contains a banned word. - if (this.match(this.lists.banned, phrase)) { - debug(`the field "${field}" contained a phrase "${phrase}" which contained a banned word/phrase`); + errors = Object.assign(errors, this.scan(fieldName, phrase)); - errors.banned = Errors.ErrContainsProfanity; + // Check if the field contains a banned word. + if (errors.banned) { // Stop looping through the fields now, we discovered the worst possible // situation (a banned word). @@ -152,10 +187,7 @@ class Wordlist { } // Check if the field contains a banned word. - if (this.match(this.lists.suspect, phrase)) { - debug(`the field "${field}" contained a phrase "${phrase}" which contained a suspected word/phrase`); - - errors.suspect = Errors.ErrContainsProfanity; + if (errors.suspect) { // Continue looping through the fields now, we discovered a possible bad // word (suspect). diff --git a/tests/.eslintrc.json b/test/.eslintrc.json similarity index 100% rename from tests/.eslintrc.json rename to test/.eslintrc.json diff --git a/tests/client/.eslintrc.json b/test/client/.eslintrc.json similarity index 100% rename from tests/client/.eslintrc.json rename to test/client/.eslintrc.json diff --git a/tests/client/coral-admin/actions/assets.js b/test/client/coral-admin/actions/assets.js similarity index 100% rename from tests/client/coral-admin/actions/assets.js rename to test/client/coral-admin/actions/assets.js diff --git a/tests/client/coral-admin/reducers/assets.js b/test/client/coral-admin/reducers/assets.js similarity index 100% rename from tests/client/coral-admin/reducers/assets.js rename to test/client/coral-admin/reducers/assets.js diff --git a/tests/client/coral-framework/store/itemActions.js b/test/client/coral-framework/store/itemActions.js similarity index 100% rename from tests/client/coral-framework/store/itemActions.js rename to test/client/coral-framework/store/itemActions.js diff --git a/tests/client/coral-framework/store/itemReducer.js b/test/client/coral-framework/store/itemReducer.js similarity index 100% rename from tests/client/coral-framework/store/itemReducer.js rename to test/client/coral-framework/store/itemReducer.js diff --git a/tests/client/coral-framework/store/notificationReducer.spec.js b/test/client/coral-framework/store/notificationReducer.spec.js similarity index 100% rename from tests/client/coral-framework/store/notificationReducer.spec.js rename to test/client/coral-framework/store/notificationReducer.spec.js diff --git a/tests/client/coral-plugin-history/Comment.spec.js b/test/client/coral-plugin-history/Comment.spec.js similarity index 85% rename from tests/client/coral-plugin-history/Comment.spec.js rename to test/client/coral-plugin-history/Comment.spec.js index 78ad104bf..6d69d54cd 100644 --- a/tests/client/coral-plugin-history/Comment.spec.js +++ b/test/client/coral-plugin-history/Comment.spec.js @@ -9,20 +9,19 @@ describe('coral-plugin-history/Comment', () => { const asset = {url: 'https://google.com'}; beforeEach(() => { - render = shallow(