Ghost/core/server/api/v0.1/settings.js

// # Settings API
// RESTful API for the Setting resource
const Promise = require('bluebird'),
    _ = require('lodash'),
    moment = require('moment-timezone'),
    fs = require('fs-extra'),
    path = require('path'),
    config = require('../../config'),
    models = require('../../models'),
    canThis = require('../../services/permissions').canThis,
    localUtils = require('./utils'),
    urlService = require('../../services/url'),
    common = require('../../lib/common'),
    settingsCache = require('../../services/settings/cache'),
    docName = 'settings';

let settings,
    settingsFilter,
    settingsResult,
    canEditAllSettings;

// ## Helpers

/**
 * ### Settings Filter
 * Filters an object based on a given filter object
 * @private
 * @param {Object} settings
 * @param {String} filter
 * @returns {*}
 */
settingsFilter = (settings, filter) => {
    let filteredTypes = filter ? filter.split(',') : false;
    return _.filter(settings, (setting) => {
        if (filteredTypes) {
            return _.includes(filteredTypes, setting.type);
        }

        return true;
    });
};

/**
 * ### Settings Result
 *
 * Takes a keyed JSON object
 * E.g.
 * db_hash: {
 *   id: '123abc',
 *   key: 'dbash',
 *   value: 'xxxx',
 *   type: 'core',
 *   timestamps
 *  }
 *
 *  Performs a filter, based on the `type`
 *  And converts the remaining items to our API format by adding a `setting` and `meta` keys.
 *
 * @private
 * @param {Object} settings - a keyed JSON object
 * @param {String} type
 * @returns {{settings: *}}
 */
settingsResult = (settings, type) => {
    let filteredSettings = _.values(settingsFilter(settings, type)),
        result = {
            settings: filteredSettings,
            meta: {}
        };

    if (type) {
        result.meta.filters = {
            type: type
        };
    }

    return result;
};

/**
 * ### Can Edit All Settings
 * Check that this edit request is allowed for all settings requested to be updated
 * @private
 * @param {Object} settingsInfo
 * @returns {*}
 */
canEditAllSettings = (settingsInfo, options) => {
    let checkSettingPermissions = (setting) => {
            if (setting.type === 'core' && !(options.context && options.context.internal)) {
                return Promise.reject(
                    new common.errors.NoPermissionError({message: common.i18n.t('errors.api.settings.accessCoreSettingFromExtReq')})
                );
            }

            return canThis(options.context).edit.setting(setting.key).catch(() => {
                return Promise.reject(new common.errors.NoPermissionError({message: common.i18n.t('errors.api.settings.noPermissionToEditSettings')}));
            });
        },
        checks = settingsInfo.map((settingInfo) => {
            let setting = settingsCache.get(settingInfo.key, {resolve: false});

            if (!setting) {
                return Promise.reject(new common.errors.NotFoundError(
                    {message: common.i18n.t('errors.api.settings.problemFindingSetting', {key: settingInfo.key})}
                ));
            }

            if (setting.key === 'active_theme') {
                return Promise.reject(
                    new common.errors.BadRequestError({
                        message: common.i18n.t('errors.api.settings.activeThemeSetViaAPI.error'),
                        help: common.i18n.t('errors.api.settings.activeThemeSetViaAPI.help')
                    })
                );
            }

            return checkSettingPermissions(setting);
        });

    return Promise.all(checks);
};

/**
 * ## Settings API Methods
 *
 * **See:** [API Methods](constants.js.html#api%20methods)
 */
settings = {

    /**
     * ### Browse
     * @param {Object} options
     * @returns {*}
     */
    browse(options) {
        options = options || {};

        let result = settingsResult(settingsCache.getAll(), options.type);

        // If there is no context, return only blog settings
        if (!options.context) {
            return Promise.resolve(result.settings.filter((setting) => {
                return setting.type === 'blog';
            }));
        }

        // Otherwise return whatever this context is allowed to browse
        return canThis(options.context).browse.setting().then(() => {
            // Omit core settings unless internal request
            if (!options.context.internal) {
                result.settings = result.settings.filter((setting) => {
                    return setting.type !== 'core' && setting.key !== 'permalinks';
                });
            }

            return result;
        });
    },

    /**
     * ### Read
     * @param {Object} options
     * @returns {*}
     */
    read(options) {
        if (_.isString(options)) {
            options = {key: options};
        }

        let setting = settingsCache.get(options.key, {resolve: false}),
            result = {};

        if (!setting) {
            return Promise.reject(new common.errors.NotFoundError(
                {message: common.i18n.t('errors.api.settings.problemFindingSetting', {key: options.key})}
            ));
        }

        result[options.key] = setting;

        if (setting.type === 'core' && !(options.context && options.context.internal)) {
            return Promise.reject(
                new common.errors.NoPermissionError({message: common.i18n.t('errors.api.settings.accessCoreSettingFromExtReq')})
            );
        }

        if (setting.key === 'permalinks') {
            return Promise.reject(new common.errors.NotFoundError({
                message: common.i18n.t('errors.errors.resourceNotFound')
            }));
        }

        if (setting.type === 'blog') {
            return Promise.resolve(settingsResult(result));
        }

        return canThis(options.context).read.setting(options.key).then(() => {
            return settingsResult(result);
        }, () => {
            return Promise.reject(new common.errors.NoPermissionError({message: common.i18n.t('errors.api.settings.noPermissionToReadSettings')}));
        });
    },

    /**
     * ### Edit
     * Update properties of a setting
     * @param {{settings: }} object Setting or a single string name
     * @param {{id (required), include,...}} options (optional) or a single string value
     * @return {Promise(Setting)} Edited Setting
     */
    edit(object, options) {
        options = options || {};
        let type;

        // Allow shorthand syntax where a single key and value are passed to edit instead of object and options
        if (_.isString(object)) {
            object = {settings: [{key: object, value: options}]};
        }

        // clean data
        object.settings.forEach((setting) => {
            if (!_.isString(setting.value)) {
                setting.value = JSON.stringify(setting.value);
            }
        });

        type = object.settings.find((setting) => {
            return setting.key === 'type';
        });

        if (_.isObject(type)) {
            type = type.value;
        }

        object.settings = _.reject(object.settings, (setting) => {
            return setting.key === 'type';
        });

        if (object.settings[0].key === 'permalinks') {
            return Promise.reject(new common.errors.NotFoundError({
                message: common.i18n.t('errors.errors.resourceNotFound')
            }));
        }

        return canEditAllSettings(object.settings, options).then(() => {
            return localUtils.checkObject(object, docName).then((checkedData) => {
                return models.Settings.edit(checkedData.settings, options);
            }).then((settingsModelsArray) => {
                // Instead of a standard bookshelf collection, Settings.edit returns an array of Settings Models.
                // We convert this to JSON, by calling toJSON on each Model (using invokeMap for ease)
                // We use keyBy to create an object that uses the 'key' as a key for each setting.
                let settingsKeyedJSON = _.keyBy(_.invokeMap(settingsModelsArray, 'toJSON'), 'key');
                return settingsResult(settingsKeyedJSON, type);
            });
        });
    },

    /**
     * The `routes.yaml` file offers a way to configure your Ghost blog. It's currently a setting feature
     * we have added. That's why the `routes.yaml` file is treated as a "setting" right now.
     * If we want to add single permissions for this file (e.g. upload/download routes.yaml), we can add later.
     *
     * How does it work?
     *
     * - we first reset all url generators (each url generator belongs to one express router)
     *   - we don't destroy the resources, we only release them (this avoids reloading all resources from the db again)
     * - then we reload the whole site app, which will reset all routers and re-create the url generators
     */
    upload(options) {
        const backupRoutesPath = path.join(config.getContentPath('settings'), `routes-${moment().format('YYYY-MM-DD-HH-mm-ss')}.yaml`);

        return localUtils.handlePermissions('settings', 'edit')(options)
            .then(() => {
                return fs.copy(`${config.getContentPath('settings')}/routes.yaml`, backupRoutesPath);
            })
            .then(() => {
                return fs.copy(options.path, `${config.getContentPath('settings')}/routes.yaml`);
            })
            .then(() => {
                urlService.resetGenerators({releaseResourcesOnly: true});
            })
            .then(() => {
                const siteApp = require('../../web/site/app');

                try {
                    return siteApp.reload();
                } catch (err) {
                    // bring back backup, otherwise your Ghost blog is broken
                    return fs.copy(backupRoutesPath, `${config.getContentPath('settings')}/routes.yaml`)
                        .then(() => {
                            return siteApp.reload();
                        })
                        .then(() => {
                            throw err;
                        });
                }
            });
    },

    download(options) {
        const routesPath = path.join(config.getContentPath('settings'), 'routes.yaml');

        return localUtils.handlePermissions('settings', 'browse')(options)
            .then(() => {
                return fs.readFile(routesPath, 'utf-8');
            })
            .catch((err) => {
                if (err.code === 'ENOENT') {
                    return Promise.resolve([]);
                }

                if (common.errors.utils.isIgnitionError(err)) {
                    throw err;
                }

                throw new common.errors.NotFoundError({
                    err: err
                });
            });
    }
};

module.exports = settings;