Merge branch 'master' of github.com:coralproject/talk into asset-comment-settings

routes/api/comments/index.js

@@ -97,7 +97,7 @@ router.post('/', wordlist.filter('body'), (req, res, next) => {
   .then((comment) => {
 
     // The comment was created! Send back the created comment.
-    res.status(201).send(comment);
+    res.status(201).json(comment);
   })
   .catch((err) => {
     next(err);

routes/api/index.js

@@ -1,8 +1,12 @@
 const express = require('express');
 const authorization = require('../../middleware/authorization');
+const payloadFilter = require('../../middleware/payload-filter');
 
 const router = express.Router();
 
+// Filter all content going down the pipe based on user roles.
+router.use(payloadFilter);
+
 router.use('/asset', authorization.needed('admin'), require('./asset'));
 router.use('/settings', authorization.needed('admin'), require('./settings'));
 router.use('/queue', authorization.needed('admin'), require('./queue'));

routes/api/stream/index.js

@@ -1,21 +1,32 @@
 const express = require('express');
 const _ = require('lodash');
 const scraper = require('../../../services/scraper');
+const url = require('url');
 
 const Comment = require('../../../models/comment');
 const User = require('../../../models/user');
 const Action = require('../../../models/action');
 const Asset = require('../../../models/asset');
 const Setting = require('../../../models/setting');
+const ErrInvalidAssetURL = new Error('asset_url is invalid');
+ErrInvalidAssetURL.status = 400;
 
 const router = express.Router();
 
 router.get('/', (req, res, next) => {
 
+  let asset_url = decodeURIComponent(req.query.asset_url);
+
+  // Verify that the asset_url is parsable.
+  let parsed_asset_url = url.parse(asset_url);
+  if (!parsed_asset_url.protocol) {
+    return next(ErrInvalidAssetURL);
+  }
+
   // Get the asset_id for this url (or create it if it doesn't exist)
   Promise.all([
     // Find or create the asset by url.
-    Asset.findOrCreateByUrl(decodeURIComponent(req.query.asset_url))
+    Asset.findOrCreateByUrl(asset_url)
 
       // Add the found asset to the scraper if it's not already scraped.
       .then((asset) => {
@@ -34,7 +45,7 @@ router.get('/', (req, res, next) => {
     // Merge the asset specific settings with the returned settings object in
     // the event that the asset that was returned also had settings.
     if (asset && asset.settings) {
-      settings = Object.assign({}, settings, asset.settings);
+      settings.merge(asset.settings);
     }
 
     // Fetch the appropriate comments stream.
@@ -98,7 +109,7 @@ router.get('/', (req, res, next) => {
       comments,
       users,
       actions,
-      settings: Setting.public(settings)
+      settings
     });
   })
   .catch(error => {

routes/api/user/index.js

@@ -26,26 +26,15 @@ router.get('/', authorization.needed('admin'), (req, res, next) => {
       .limit(limit),
     User.count()
   ])
-  .then(([data, count]) => {
-    const users = data.map((user) => {
-      const {id, displayName, created_at} = user;
-      return {
-        id,
-        displayName,
-        created_at,
-        profiles: user.toObject().profiles,
-        roles: user.toObject().roles
-      };
-    });
+  .then(([result, count]) => {
 
     res.json({
-      result: users,
+      result,
       limit: Number(limit),
       count,
       page: Number(page),
-      totalPages: Math.ceil(count / limit)
+      totalPages: Math.ceil(count / (limit === 0 ? 1 : limit))
     });
-
   })
   .catch(next);
 });
@@ -53,8 +42,8 @@ router.get('/', authorization.needed('admin'), (req, res, next) => {
 router.post('/:user_id/role', authorization.needed('admin'), (req, res, next) => {
   User
     .addRoleToUser(req.params.user_id, req.body.role)
-    .then(role => {
-      res.send(role);
+    .then(() => {
+      res.status(204).end();
     })
     .catch(next);
 });
@@ -65,13 +54,17 @@ router.post('/', (req, res, next) => {
   User
     .createLocalUser(email, password, displayName)
     .then(user => {
-      res.status(201).send(user);
+
+      res.status(201).json(user);
     })
     .catch(err => {
       next(err);
     });
 });
 
+const ErrPasswordTooShort = new Error('password must be at least 8 characters');
+ErrPasswordTooShort.status = 400;
+
 /**
  * expects 2 fields in the body of the request
  * 1) the token that was in the url of the email link {String}
@@ -81,7 +74,7 @@ router.post('/update-password', (req, res, next) => {
   const {token, password} = req.body;
 
   if (!password || password.length < 8) {
-    return res.status(400).send('Password must be at least 8 characters');
+    return next(ErrPasswordTooShort);
   }
 
   User.verifyPasswordResetToken(token)
@@ -93,7 +86,8 @@ router.post('/update-password', (req, res, next) => {
     })
     .catch(error => {
       console.error(error);
-      res.status(401).send('Not Authorized');
+
+      next(authorization.ErrNotAuthorized);
     });
 });
 
@@ -133,10 +127,8 @@ router.post('/request-password-reset', (req, res, next) => {
       // if we fail on missing emails, it would reveal if people are registered or not.
       res.status(204).end();
     })
-    .catch(error => {
-      const errorMsg = typeof error === 'string' ? error : error.message;
-
-      res.status(500).json({error: errorMsg});
+    .catch((err) => {
+      next(err);
     });
 });
 
@@ -150,10 +142,11 @@ router.put('/:user_id/bio', (req, res, next) => {
 
   User
     .addBio(user_id, bio)
-    .then(user => res.status(200).send(user))
-    .catch(error => {
-      const errorMsg = typeof error === 'string' ? error : error.message;
-      res.status(500).json({error: errorMsg});
+    .then(user => {
+      res.json(user);
+    })
+    .catch((err) => {
+      next(err);
     });
 });