mirror of
https://github.com/TryGhost/Ghost.git
synced 2024-12-16 20:43:01 +03:00
80f9765a35
refs #10318 - cheap and dirty way of removing settings we don't use - rewritten the settingsFilter function as that was unnecessarily complex - aslo fixed the require of default-settings in the importer
324 lines
11 KiB
JavaScript
324 lines
11 KiB
JavaScript
// # Settings API
|
|
// RESTful API for the Setting resource
|
|
const Promise = require('bluebird'),
|
|
_ = require('lodash'),
|
|
moment = require('moment-timezone'),
|
|
fs = require('fs-extra'),
|
|
path = require('path'),
|
|
config = require('../../config'),
|
|
models = require('../../models'),
|
|
canThis = require('../../services/permissions').canThis,
|
|
localUtils = require('./utils'),
|
|
urlService = require('../../services/url'),
|
|
common = require('../../lib/common'),
|
|
settingsCache = require('../../services/settings/cache'),
|
|
docName = 'settings';
|
|
|
|
let settings,
|
|
settingsFilter,
|
|
settingsResult,
|
|
canEditAllSettings;
|
|
|
|
// ## Helpers
|
|
|
|
/**
|
|
* ### Settings Filter
|
|
* Filters an object based on a given filter object
|
|
* @private
|
|
* @param {Object} settings
|
|
* @param {String} filter
|
|
* @returns {*}
|
|
*/
|
|
settingsFilter = (settings, filter) => {
|
|
let filteredTypes = filter ? filter.split(',') : false;
|
|
return _.filter(settings, (setting) => {
|
|
if (filteredTypes) {
|
|
return _.includes(filteredTypes, setting.type);
|
|
}
|
|
|
|
return true;
|
|
});
|
|
};
|
|
|
|
/**
|
|
* ### Settings Result
|
|
*
|
|
* Takes a keyed JSON object
|
|
* E.g.
|
|
* db_hash: {
|
|
* id: '123abc',
|
|
* key: 'dbash',
|
|
* value: 'xxxx',
|
|
* type: 'core',
|
|
* timestamps
|
|
* }
|
|
*
|
|
* Performs a filter, based on the `type`
|
|
* And converts the remaining items to our API format by adding a `setting` and `meta` keys.
|
|
*
|
|
* @private
|
|
* @param {Object} settings - a keyed JSON object
|
|
* @param {String} type
|
|
* @returns {{settings: *}}
|
|
*/
|
|
settingsResult = (settings, type) => {
|
|
let filteredSettings = _.values(settingsFilter(settings, type)),
|
|
result = {
|
|
settings: filteredSettings,
|
|
meta: {}
|
|
};
|
|
|
|
if (type) {
|
|
result.meta.filters = {
|
|
type: type
|
|
};
|
|
}
|
|
|
|
return result;
|
|
};
|
|
|
|
/**
|
|
* ### Can Edit All Settings
|
|
* Check that this edit request is allowed for all settings requested to be updated
|
|
* @private
|
|
* @param {Object} settingsInfo
|
|
* @returns {*}
|
|
*/
|
|
canEditAllSettings = (settingsInfo, options) => {
|
|
let checkSettingPermissions = (setting) => {
|
|
if (setting.type === 'core' && !(options.context && options.context.internal)) {
|
|
return Promise.reject(
|
|
new common.errors.NoPermissionError({message: common.i18n.t('errors.api.settings.accessCoreSettingFromExtReq')})
|
|
);
|
|
}
|
|
|
|
return canThis(options.context).edit.setting(setting.key).catch(() => {
|
|
return Promise.reject(new common.errors.NoPermissionError({message: common.i18n.t('errors.api.settings.noPermissionToEditSettings')}));
|
|
});
|
|
},
|
|
checks = settingsInfo.map((settingInfo) => {
|
|
let setting = settingsCache.get(settingInfo.key, {resolve: false});
|
|
|
|
if (!setting) {
|
|
return Promise.reject(new common.errors.NotFoundError(
|
|
{message: common.i18n.t('errors.api.settings.problemFindingSetting', {key: settingInfo.key})}
|
|
));
|
|
}
|
|
|
|
if (setting.key === 'active_theme') {
|
|
return Promise.reject(
|
|
new common.errors.BadRequestError({
|
|
message: common.i18n.t('errors.api.settings.activeThemeSetViaAPI.error'),
|
|
help: common.i18n.t('errors.api.settings.activeThemeSetViaAPI.help')
|
|
})
|
|
);
|
|
}
|
|
|
|
return checkSettingPermissions(setting);
|
|
});
|
|
|
|
return Promise.all(checks);
|
|
};
|
|
|
|
/**
|
|
* ## Settings API Methods
|
|
*
|
|
* **See:** [API Methods](constants.js.html#api%20methods)
|
|
*/
|
|
settings = {
|
|
|
|
/**
|
|
* ### Browse
|
|
* @param {Object} options
|
|
* @returns {*}
|
|
*/
|
|
browse(options) {
|
|
options = options || {};
|
|
|
|
let result = settingsResult(settingsCache.getAll(), options.type);
|
|
|
|
// If there is no context, return only blog settings
|
|
if (!options.context) {
|
|
return Promise.resolve(result.settings.filter((setting) => {
|
|
return setting.type === 'blog';
|
|
}));
|
|
}
|
|
|
|
// Otherwise return whatever this context is allowed to browse
|
|
return canThis(options.context).browse.setting().then(() => {
|
|
// Omit core settings unless internal request
|
|
if (!options.context.internal) {
|
|
result.settings = result.settings.filter((setting) => {
|
|
return setting.type !== 'core' && setting.key !== 'permalinks';
|
|
});
|
|
}
|
|
|
|
return result;
|
|
});
|
|
},
|
|
|
|
/**
|
|
* ### Read
|
|
* @param {Object} options
|
|
* @returns {*}
|
|
*/
|
|
read(options) {
|
|
if (_.isString(options)) {
|
|
options = {key: options};
|
|
}
|
|
|
|
let setting = settingsCache.get(options.key, {resolve: false}),
|
|
result = {};
|
|
|
|
if (!setting) {
|
|
return Promise.reject(new common.errors.NotFoundError(
|
|
{message: common.i18n.t('errors.api.settings.problemFindingSetting', {key: options.key})}
|
|
));
|
|
}
|
|
|
|
result[options.key] = setting;
|
|
|
|
if (setting.type === 'core' && !(options.context && options.context.internal)) {
|
|
return Promise.reject(
|
|
new common.errors.NoPermissionError({message: common.i18n.t('errors.api.settings.accessCoreSettingFromExtReq')})
|
|
);
|
|
}
|
|
|
|
if (setting.key === 'permalinks') {
|
|
return Promise.reject(new common.errors.NotFoundError({
|
|
message: common.i18n.t('errors.errors.resourceNotFound')
|
|
}));
|
|
}
|
|
|
|
if (setting.type === 'blog') {
|
|
return Promise.resolve(settingsResult(result));
|
|
}
|
|
|
|
return canThis(options.context).read.setting(options.key).then(() => {
|
|
return settingsResult(result);
|
|
}, () => {
|
|
return Promise.reject(new common.errors.NoPermissionError({message: common.i18n.t('errors.api.settings.noPermissionToReadSettings')}));
|
|
});
|
|
},
|
|
|
|
/**
|
|
* ### Edit
|
|
* Update properties of a setting
|
|
* @param {{settings: }} object Setting or a single string name
|
|
* @param {{id (required), include,...}} options (optional) or a single string value
|
|
* @return {Promise(Setting)} Edited Setting
|
|
*/
|
|
edit(object, options) {
|
|
options = options || {};
|
|
let type;
|
|
|
|
// Allow shorthand syntax where a single key and value are passed to edit instead of object and options
|
|
if (_.isString(object)) {
|
|
object = {settings: [{key: object, value: options}]};
|
|
}
|
|
|
|
// clean data
|
|
object.settings.forEach((setting) => {
|
|
if (!_.isString(setting.value)) {
|
|
setting.value = JSON.stringify(setting.value);
|
|
}
|
|
});
|
|
|
|
type = object.settings.find((setting) => {
|
|
return setting.key === 'type';
|
|
});
|
|
|
|
if (_.isObject(type)) {
|
|
type = type.value;
|
|
}
|
|
|
|
object.settings = _.reject(object.settings, (setting) => {
|
|
return setting.key === 'type';
|
|
});
|
|
|
|
if (object.settings[0].key === 'permalinks') {
|
|
return Promise.reject(new common.errors.NotFoundError({
|
|
message: common.i18n.t('errors.errors.resourceNotFound')
|
|
}));
|
|
}
|
|
|
|
return canEditAllSettings(object.settings, options).then(() => {
|
|
return localUtils.checkObject(object, docName).then((checkedData) => {
|
|
return models.Settings.edit(checkedData.settings, options);
|
|
}).then((settingsModelsArray) => {
|
|
// Instead of a standard bookshelf collection, Settings.edit returns an array of Settings Models.
|
|
// We convert this to JSON, by calling toJSON on each Model (using invokeMap for ease)
|
|
// We use keyBy to create an object that uses the 'key' as a key for each setting.
|
|
let settingsKeyedJSON = _.keyBy(_.invokeMap(settingsModelsArray, 'toJSON'), 'key');
|
|
return settingsResult(settingsKeyedJSON, type);
|
|
});
|
|
});
|
|
},
|
|
|
|
/**
|
|
* The `routes.yaml` file offers a way to configure your Ghost blog. It's currently a setting feature
|
|
* we have added. That's why the `routes.yaml` file is treated as a "setting" right now.
|
|
* If we want to add single permissions for this file (e.g. upload/download routes.yaml), we can add later.
|
|
*
|
|
* How does it work?
|
|
*
|
|
* - we first reset all url generators (each url generator belongs to one express router)
|
|
* - we don't destroy the resources, we only release them (this avoids reloading all resources from the db again)
|
|
* - then we reload the whole site app, which will reset all routers and re-create the url generators
|
|
*/
|
|
upload(options) {
|
|
const backupRoutesPath = path.join(config.getContentPath('settings'), `routes-${moment().format('YYYY-MM-DD-HH-mm-ss')}.yaml`);
|
|
|
|
return localUtils.handlePermissions('settings', 'edit')(options)
|
|
.then(() => {
|
|
return fs.copy(`${config.getContentPath('settings')}/routes.yaml`, backupRoutesPath);
|
|
})
|
|
.then(() => {
|
|
return fs.copy(options.path, `${config.getContentPath('settings')}/routes.yaml`);
|
|
})
|
|
.then(() => {
|
|
urlService.resetGenerators({releaseResourcesOnly: true});
|
|
})
|
|
.then(() => {
|
|
const siteApp = require('../../web/site/app');
|
|
|
|
try {
|
|
return siteApp.reload();
|
|
} catch (err) {
|
|
// bring back backup, otherwise your Ghost blog is broken
|
|
return fs.copy(backupRoutesPath, `${config.getContentPath('settings')}/routes.yaml`)
|
|
.then(() => {
|
|
return siteApp.reload();
|
|
})
|
|
.then(() => {
|
|
throw err;
|
|
});
|
|
}
|
|
});
|
|
},
|
|
|
|
download(options) {
|
|
const routesPath = path.join(config.getContentPath('settings'), 'routes.yaml');
|
|
|
|
return localUtils.handlePermissions('settings', 'browse')(options)
|
|
.then(() => {
|
|
return fs.readFile(routesPath, 'utf-8');
|
|
})
|
|
.catch((err) => {
|
|
if (err.code === 'ENOENT') {
|
|
return Promise.resolve([]);
|
|
}
|
|
|
|
if (common.errors.utils.isIgnitionError(err)) {
|
|
throw err;
|
|
}
|
|
|
|
throw new common.errors.NotFoundError({
|
|
err: err
|
|
});
|
|
});
|
|
}
|
|
};
|
|
|
|
module.exports = settings;
|