feat: gist & co-authors

src/server/database.ts

@@ -5,6 +5,8 @@ import AnonymizedRepositoryModel from "../core/model/anonymizedRepositories/anon
 import AnonymousError from "../core/AnonymousError";
 import AnonymizedPullRequestModel from "../core/model/anonymizedPullRequests/anonymizedPullRequests.model";
 import PullRequest from "../core/PullRequest";
+import AnonymizedGistModel from "../core/model/anonymizedGists/anonymizedGists.model";
+import Gist from "../core/Gist";
 
 const MONGO_URL = `mongodb://${config.DB_USERNAME}:${config.DB_PASSWORD}@${config.DB_HOSTNAME}:27017/`;
 
@@ -59,3 +61,20 @@ export async function getPullRequest(pullRequestId: string) {
     });
   return new PullRequest(data);
 }
+export async function getGist(gistId: string) {
+  if (!gistId || gistId == "undefined") {
+    throw new AnonymousError("gist_not_found", {
+      object: gistId,
+      httpStatus: 404,
+    });
+  }
+  const data = await AnonymizedGistModel.findOne({
+    gistId,
+  });
+  if (!data)
+    throw new AnonymousError("gist_not_found", {
+      object: gistId,
+      httpStatus: 404,
+    });
+  return new Gist(data);
+}

src/server/index.ts

@@ -161,6 +161,8 @@ export default async function start() {
   apiRouter.use("/repo", speedLimiter, router.repositoryPrivate);
   apiRouter.use("/pr", speedLimiter, router.pullRequestPublic);
   apiRouter.use("/pr", speedLimiter, router.pullRequestPrivate);
+  apiRouter.use("/gist", speedLimiter, router.gistPublic);
+  apiRouter.use("/gist", speedLimiter, router.gistPrivate);
   apiRouter.use("/anonymize-preview", speedLimiter, router.anonymizePreview);
 
   apiRouter.get("/message", async (_, res) => {

src/server/routes/gist-private.ts

@@ -0,0 +1,224 @@
+import * as express from "express";
+import { ensureAuthenticated } from "./connection";
+
+import { getGist, getUser, handleError, isOwnerOrAdmin } from "./route-utils";
+import AnonymousError from "../../core/AnonymousError";
+import { IAnonymizedGistDocument } from "../../core/model/anonymizedGists/anonymizedGists.types";
+import Gist from "../../core/Gist";
+import AnonymizedGistModel from "../../core/model/anonymizedGists/anonymizedGists.model";
+import { RepositoryStatus } from "../../core/types";
+
+const router = express.Router();
+
+// user needs to be connected for all user API
+router.use(ensureAuthenticated);
+
+// refresh gist
+router.post(
+  "/:gistId/refresh",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const gist = await getGist(req, res, { nocheck: true });
+      if (!gist) return;
+
+      const user = await getUser(req);
+      isOwnerOrAdmin([gist.owner.id], user);
+      await gist.updateIfNeeded({ force: true });
+      res.json({ status: gist.status });
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+// delete a gist
+router.delete(
+  "/:gistId/",
+  async (req: express.Request, res: express.Response) => {
+    const gist = await getGist(req, res, { nocheck: true });
+    if (!gist) return;
+    try {
+      if (gist.status == "removed")
+        throw new AnonymousError("is_removed", {
+          object: req.params.gistId,
+          httpStatus: 410,
+        });
+      const user = await getUser(req);
+      isOwnerOrAdmin([gist.owner.id], user);
+      await gist.remove();
+      return res.json({ status: gist.status });
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+// fetch GitHub gist details (used by anonymize form)
+router.get(
+  "/source/:gistId",
+  async (req: express.Request, res: express.Response) => {
+    const user = await getUser(req);
+    try {
+      const gist = new Gist(
+        new AnonymizedGistModel({
+          owner: user.id,
+          source: {
+            gistId: req.params.gistId,
+          },
+        })
+      );
+      gist.owner = user;
+      await gist.download();
+      res.json(gist.toJSON());
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+// get gist information
+router.get(
+  "/:gistId/",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const gist = await getGist(req, res, { nocheck: true });
+      if (!gist) return;
+
+      const user = await getUser(req);
+      isOwnerOrAdmin([gist.owner.id], user);
+      res.json(gist.toJSON());
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function validateNewGist(gistUpdate: any): void {
+  const validCharacters = /^[0-9a-zA-Z\-_]+$/;
+  if (
+    !gistUpdate.gistId ||
+    !gistUpdate.gistId.match(validCharacters) ||
+    gistUpdate.gistId.length < 3
+  ) {
+    throw new AnonymousError("invalid_gistId", {
+      object: gistUpdate,
+      httpStatus: 400,
+    });
+  }
+  if (!gistUpdate.source || !gistUpdate.source.gistId) {
+    throw new AnonymousError("gistId_not_specified", {
+      object: gistUpdate,
+      httpStatus: 400,
+    });
+  }
+  if (!gistUpdate.options) {
+    throw new AnonymousError("options_not_provided", {
+      object: gistUpdate,
+      httpStatus: 400,
+    });
+  }
+  if (!Array.isArray(gistUpdate.terms)) {
+    throw new AnonymousError("invalid_terms_format", {
+      object: gistUpdate,
+      httpStatus: 400,
+    });
+  }
+}
+
+function updateGistModel(
+  model: IAnonymizedGistDocument,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  gistUpdate: any
+) {
+  model.options = {
+    terms: gistUpdate.terms,
+    expirationMode: gistUpdate.options.expirationMode,
+    expirationDate: gistUpdate.options.expirationDate
+      ? new Date(gistUpdate.options.expirationDate)
+      : undefined,
+    update: gistUpdate.options.update,
+    image: gistUpdate.options.image,
+    link: gistUpdate.options.link,
+    body: gistUpdate.options.body,
+    title: gistUpdate.options.title,
+    username: gistUpdate.options.username,
+    origin: gistUpdate.options.origin,
+    content: gistUpdate.options.content,
+    comments: gistUpdate.options.comments,
+    date: gistUpdate.options.date,
+  };
+}
+
+// update a gist
+router.post(
+  "/:gistId/",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const gist = await getGist(req, res, { nocheck: true });
+      if (!gist) return;
+      const user = await getUser(req);
+
+      isOwnerOrAdmin([gist.owner.id], user);
+      const gistUpdate = req.body;
+      validateNewGist(gistUpdate);
+      gist.model.anonymizeDate = new Date();
+
+      updateGistModel(gist.model, gistUpdate);
+      gist.model.conference = gistUpdate.conference;
+      await gist.updateStatus(RepositoryStatus.PREPARING);
+      await gist.updateIfNeeded({ force: true });
+      res.json(gist.toJSON());
+    } catch (error) {
+      return handleError(error, res, req);
+    }
+  }
+);
+
+// add gist
+router.post("/", async (req: express.Request, res: express.Response) => {
+  const user = await getUser(req);
+  const gistUpdate = req.body;
+
+  try {
+    validateNewGist(gistUpdate);
+
+    const gist = new Gist(
+      new AnonymizedGistModel({
+        owner: user.id,
+        options: gistUpdate.options,
+      })
+    );
+
+    gist.model.gistId = gistUpdate.gistId;
+    gist.model.anonymizeDate = new Date();
+    gist.model.owner = user.id;
+
+    updateGistModel(gist.model, gistUpdate);
+    gist.source.accessToken = user.accessToken;
+    gist.source.gistId = gistUpdate.source.gistId;
+
+    gist.model.conference = gistUpdate.conference;
+
+    await gist.anonymize();
+    res.send(gist.toJSON());
+  } catch (error) {
+    if (
+      error instanceof Error &&
+      error.message.indexOf(" duplicate key") > -1
+    ) {
+      return handleError(
+        new AnonymousError("gistId_already_used", {
+          httpStatus: 400,
+          cause: error,
+          object: gistUpdate,
+        }),
+        res,
+        req
+      );
+    }
+    return handleError(error, res, req);
+  }
+});
+
+export default router;

src/server/routes/gist-public.ts

@@ -0,0 +1,85 @@
+import * as express from "express";
+
+import { getGist, handleError } from "./route-utils";
+import AnonymousError from "../../core/AnonymousError";
+
+const router = express.Router();
+
+router.get(
+  "/:gistId/options",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      res.header("Cache-Control", "no-cache");
+      const gist = await getGist(req, res, { nocheck: true });
+      if (!gist) return;
+      let redirectURL = null;
+      if (
+        gist.status == "expired" &&
+        gist.options.expirationMode == "redirect"
+      ) {
+        redirectURL = `https://gist.github.com/${gist.source.gistId}`;
+      } else {
+        if (
+          gist.status == "expired" ||
+          gist.status == "expiring" ||
+          gist.status == "removing" ||
+          gist.status == "removed"
+        ) {
+          throw new AnonymousError("gist_expired", {
+            object: gist,
+            httpStatus: 410,
+          });
+        }
+
+        const fiveMinuteAgo = new Date();
+        fiveMinuteAgo.setMinutes(fiveMinuteAgo.getMinutes() - 5);
+        if (gist.status != "ready") {
+          if (gist.model.statusDate < fiveMinuteAgo) {
+            await gist.updateIfNeeded({ force: true });
+          }
+          if (gist.status == "error") {
+            throw new AnonymousError(
+              gist.model.statusMessage
+                ? gist.model.statusMessage
+                : "gist_not_available",
+              {
+                object: gist,
+                httpStatus: 500,
+              }
+            );
+          }
+          throw new AnonymousError("gist_not_ready", {
+            httpStatus: 404,
+            object: gist,
+          });
+        }
+
+        await gist.updateIfNeeded();
+      }
+
+      res.json({
+        url: redirectURL,
+        lastUpdateDate: gist.model.statusDate,
+      });
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+router.get(
+  "/:gistId/content",
+  async (req: express.Request, res: express.Response) => {
+    const gist = await getGist(req, res);
+    if (!gist) return;
+    try {
+      await gist.countView();
+      res.header("Cache-Control", "no-cache");
+      res.json(gist.content());
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+export default router;

src/server/routes/index.ts

@@ -1,5 +1,7 @@
 import pullRequestPrivate from "./pullRequest-private";
 import pullRequestPublic from "./pullRequest-public";
+import gistPrivate from "./gist-private";
+import gistPublic from "./gist-public";
 import repositoryPrivate from "./repository-private";
 import repositoryPublic from "./repository-public";
 import conference from "./conference";
@@ -13,6 +15,8 @@ import anonymizePreview from "./anonymize-preview";
 export default {
   pullRequestPrivate,
   pullRequestPublic,
+  gistPrivate,
+  gistPublic,
   repositoryPrivate,
   repositoryPublic,
   file,

src/server/routes/repository-private.ts

@@ -2,7 +2,13 @@ import * as express from "express";
 import { ensureAuthenticated } from "./connection";
 
 import * as db from "../database";
-import { getRepo, getUser, handleError, isOwnerOrAdmin } from "./route-utils";
+import {
+  getRepo,
+  getUser,
+  handleError,
+  isOwnerOrAdmin,
+  isOwnerCoauthorOrAdmin,
+} from "./route-utils";
 import { getRepositoryFromGitHub } from "../../core/source/GitHubRepository";
 import gh = require("parse-github-url");
 import AnonymizedRepositoryModel from "../../core/model/anonymizedRepositories/anonymizedRepositories.model";
@@ -16,7 +22,7 @@ import RepositoryModel from "../../core/model/repositories/repositories.model";
 import User from "../../core/User";
 import { RepositoryStatus } from "../../core/types";
 import { IUserDocument } from "../../core/model/users/users.types";
-import { checkToken } from "../../core/GitHubUtils";
+import { checkToken, octokit } from "../../core/GitHubUtils";
 
 const router = express.Router();
 
@@ -142,7 +148,7 @@ router.post(
         return;
 
       const user = await getUser(req);
-      isOwnerOrAdmin([repo.owner.id], user);
+      isOwnerCoauthorOrAdmin(repo, user);
       await repo.updateIfNeeded({ force: true });
       res.json({ status: repo.status });
     } catch (error) {
@@ -273,8 +279,17 @@ router.get("/:repoId/", async (req: express.Request, res: express.Response) => {
     if (!repo) return;
 
     const user = await getUser(req);
-    isOwnerOrAdmin([repo.owner.id], user);
-    res.json((await db.getRepository(req.params.repoId)).toJSON());
+    isOwnerCoauthorOrAdmin(repo, user);
+    const fullRepo = await db.getRepository(req.params.repoId);
+    const json = fullRepo.toJSON() as Record<string, unknown>;
+    json.ownerId = fullRepo.owner.id;
+    json.role =
+      user.isAdmin && fullRepo.owner.id !== user.model.id
+        ? "admin"
+        : fullRepo.owner.id === user.model.id
+        ? "owner"
+        : "coauthor";
+    res.json(json);
   } catch (error) {
     handleError(error, res, req);
   }
@@ -359,7 +374,7 @@ router.post(
       if (!repo) return;
       const user = await getUser(req);
 
-      isOwnerOrAdmin([repo.owner.id], user);
+      isOwnerCoauthorOrAdmin(repo, user);
 
       const repoUpdate = req.body;
 
@@ -567,4 +582,108 @@ router.post("/", async (req: express.Request, res: express.Response) => {
   }
 });
 
+// list coauthors
+router.get(
+  "/:repoId/coauthors",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const repo = await getRepo(req, res, { nocheck: true });
+      if (!repo) return;
+      const user = await getUser(req);
+      isOwnerCoauthorOrAdmin(repo, user);
+      res.json(repo.coauthors);
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+// add a coauthor (owner/admin only)
+router.post(
+  "/:repoId/coauthors",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const repo = await getRepo(req, res, { nocheck: true });
+      if (!repo) return;
+      const user = await getUser(req);
+      isOwnerOrAdmin([repo.owner.id], user);
+
+      const username = (req.body.username || "").trim();
+      if (!username) {
+        throw new AnonymousError("username_not_defined", {
+          object: req.body,
+          httpStatus: 400,
+        });
+      }
+
+      // verify the GitHub user exists and capture identity fields
+      const oct = octokit(user.accessToken);
+      let ghUser;
+      try {
+        const r = await oct.users.getByUsername({ username });
+        ghUser = r.data;
+      } catch (e) {
+        throw new AnonymousError("github_user_not_found", {
+          object: { username },
+          httpStatus: 404,
+        });
+      }
+
+      if (ghUser.login.toLowerCase() === user.username.toLowerCase()) {
+        throw new AnonymousError("cannot_coauthor_self", {
+          httpStatus: 400,
+        });
+      }
+
+      const list = repo.model.coauthors || [];
+      if (
+        list.some(
+          (c) => c.username.toLowerCase() === ghUser.login.toLowerCase()
+        )
+      ) {
+        return res.json(list);
+      }
+      list.push({
+        username: ghUser.login,
+        githubId: String(ghUser.id),
+        photo: ghUser.avatar_url,
+        addedAt: new Date(),
+      });
+      repo.model.coauthors = list;
+      await repo.model.save();
+      res.json(repo.model.coauthors);
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+// remove a coauthor (owner/admin only, or the coauthor themselves)
+router.delete(
+  "/:repoId/coauthors/:username",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const repo = await getRepo(req, res, { nocheck: true });
+      if (!repo) return;
+      const user = await getUser(req);
+      const target = req.params.username;
+      const isOwner = repo.owner.id === user.model.id;
+      const isSelf =
+        !!user.username &&
+        user.username.toLowerCase() === target.toLowerCase();
+      if (!isOwner && !isSelf && !user.isAdmin) {
+        throw new AnonymousError("not_authorized", { httpStatus: 401 });
+      }
+
+      repo.model.coauthors = (repo.model.coauthors || []).filter(
+        (c) => c.username.toLowerCase() !== target.toLowerCase()
+      );
+      await repo.model.save();
+      res.json(repo.model.coauthors);
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
 export default router;

src/server/routes/route-utils.ts

@@ -3,9 +3,35 @@ import AnonymousError from "../../core/AnonymousError";
 import * as db from "../database";
 import UserModel from "../../core/model/users/users.model";
 import User from "../../core/User";
+import Repository from "../../core/Repository";
 import { HTTPError } from "got";
 import { RepositoryStatus } from "../../core/types";
 
+export async function getGist(
+  req: express.Request,
+  res: express.Response,
+  opt?: { nocheck?: boolean }
+) {
+  try {
+    const gist = await db.getGist(req.params.gistId);
+    if (opt?.nocheck !== true) {
+      if (
+        gist.status == "expired" &&
+        gist.options.expirationMode == "redirect"
+      ) {
+        res.redirect(`https://gist.github.com/${gist.source.gistId}`);
+        return null;
+      }
+
+      await gist.check();
+    }
+    return gist;
+  } catch (error) {
+    handleError(error, res, req);
+    return null;
+  }
+}
+
 export async function getPullRequest(
   req: express.Request,
   res: express.Response,
@@ -71,6 +97,20 @@ export function isOwnerOrAdmin(authorizedUsers: string[], user: User) {
   }
 }
 
+export function isCoauthor(repo: Repository, user: User): boolean {
+  if (!user.username) return false;
+  return (repo.model.coauthors || []).some((c) => c.username === user.username);
+}
+
+export function isOwnerCoauthorOrAdmin(repo: Repository, user: User) {
+  if (user.isAdmin) return;
+  if (repo.owner.id === user.model.id) return;
+  if (isCoauthor(repo, user)) return;
+  throw new AnonymousError("not_authorized", {
+    httpStatus: 401,
+  });
+}
+
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function printError(error: any, req?: express.Request) {
   if (error instanceof AnonymousError) {

src/server/routes/user.ts

@@ -6,6 +6,7 @@ import UserModel from "../../core/model/users/users.model";
 import User from "../../core/User";
 import FileModel from "../../core/model/files/files.model";
 import { isConnected } from "../database";
+import { octokit } from "../../core/GitHubUtils";
 
 const router = express.Router();
 
@@ -41,7 +42,9 @@ router.get("/", async (req: express.Request, res: express.Response) => {
 router.get("/quota", async (req: express.Request, res: express.Response) => {
   try {
     const user = await getUser(req);
-    const repositories = await user.getRepositories();
+    const repositories = (await user.getRepositories()).filter(
+      (r) => r.owner.id === user.model.id
+    );
     const ready = repositories.filter((r) => r.status == "ready");
 
     let totalStorage = 0;
@@ -138,6 +141,23 @@ router.get(
       const user = await getUser(req);
       res.json(
         (await user.getRepositories()).map((x) => {
+          const json = x.toJSON() as Record<string, unknown>;
+          json.role = x.owner.id === user.model.id ? "owner" : "coauthor";
+          return json;
+        })
+      );
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+router.get(
+  "/anonymized_gists",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const user = await getUser(req);
+      res.json(
+        (await user.getGists()).map((x) => {
           return x.toJSON();
         })
       );
@@ -162,6 +182,31 @@ router.get(
   }
 );
 
+// search GitHub users (used by the coauthor picker)
+router.get(
+  "/search/github-users",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const user = await getUser(req);
+      const q = (req.query.q as string) || "";
+      if (!q || q.length < 2) {
+        return res.json([]);
+      }
+      const oct = octokit(user.accessToken);
+      const r = await oct.search.users({ q, per_page: 10 });
+      res.json(
+        r.data.items.map((u) => ({
+          username: u.login,
+          githubId: String(u.id),
+          photo: u.avatar_url,
+        }))
+      );
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
 async function getAllRepositories(user: User, force: boolean) {
   const repos = await user.getGitHubRepositories({
     force,