Merge branch 'master' into notifications

2013-03-01 20:48:13 +00:00
parent 4597cba813 7e78e8cd12
commit 4db3216e1d
11 changed files with 490 additions and 109 deletions
@@ -3,56 +3,116 @@ router = new express.Router()

 scoring = require '../app/scoring'
 _ = require 'underscore'
-icalendar = require('icalendar')
+validator = require 'derby-auth/node_modules/validator'
+check = validator.check
+sanitize = validator.sanitize
+icalendar = require 'icalendar'

-# ---------- /v1 API ------------
-# Every url added beneath router is prefaced by /v1
+NO_TOKEN_OR_UID = err: "You must include a token and uid (user id) in your request"
+NO_USER_FOUND = err: "No user found."
+
+# ---------- /api/v1 API ------------
+# Every url added beneath router is prefaced by /api/v1

 ###
-  v1 API. Requires user-id and apiToken, task-id, direction. Test with:
-  curl -X POST -H "Content-Type:application/json" -d '{"apiToken":"{TOKEN}"}' localhost:3000/v1/users/{UID}/tasks/productivity/up
+  v1 API. Requires api-v1-user (user id) and api-v1-key (api key) headers, Test with:
+  $ cd node_modules/racer && npm install && cd ../..
+  $ mocha test/api.mocha.coffee
 ###

-router.post '/users/:uid/tasks/:taskId/:direction', (req, res) ->
-  {uid, taskId, direction} = req.params
-  {apiToken, title, service, icon} = req.body
-  console.log {params:req.params, body:req.body} if process.env.NODE_ENV == 'development'
+router.get '/status', (req, res) ->
+  res.json status: 'up'

-  # Send error responses for improper API call
-  return res.send(500, 'request body "apiToken" required') unless apiToken
-  return res.send(500, ':uid required') unless uid
-  return res.send(500, ':taskId required') unless taskId
-  return res.send(500, ":direction must be 'up' or 'down'") unless direction in ['up','down']
+auth = (req, res, next) ->
+  uid = req.headers['x-api-user']
+  token = req.headers['x-api-key']
+  return res.json 401, NO_TOKEN_OR_UID unless uid || token

-  req._isServer = true
  model = req.getModel()
-  model.fetch model.query('users').withIdAndToken(uid, apiToken), (err, result) ->
-    return res.send(500, err) if err
-    user = result
-    userObj = user.get()
-    if _.isEmpty(userObj)
-      return res.send(500, "User with uid=#{uid}, token=#{apiToken} not found. Make sure you're not using your username, but your User Id")
+  query = model.query('users').withIdAndToken(uid, token)

-    model.ref('_user', user)
+  query.fetch (err, user) ->
+    return res.json err: err if err
+    req.user = user
+    req.userObj = user.get()
+    return res.json 401, NO_USER_FOUND if !req.userObj || _.isEmpty(req.userObj)
+    req._isServer = true
+    next()

-    # Create task if doesn't exist
-    # TODO add service & icon to task
-    unless model.get("_user.tasks.#{taskId}")
-      model.refList "_habitList", "_user.tasks", "_user.habitIds"
-      model.at('_habitList').push
-        id: taskId
-        type: 'habit'
-        text: (title || taskId)
-        value: 0
-        up: true
-        down: true
-        notes: "This task was created by a third-party service. Feel free to edit, it won't harm the connection to that service. Additionally, multiple services may piggy-back off this task."
+router.get '/user', auth, (req, res) ->
+  user = req.userObj

-    score = scoring.Scoring(model)
-    delta = score.score(taskId, direction)
-    result = model.get ('_user.stats')
-    result.delta = delta
-    res.send(result)
+  delete user.apiToken
+
+  res.json user
+
+router.get '/user/task/:id', auth, (req, res) ->
+  task = req.userObj.tasks[req.params.id]
+  return res.json 400, err: "No task found." if !task || _.isEmpty(task)
+
+  res.json 200, task
+
+validateTask = (req, res, next) ->
+  task = {}
+  newTask = { type, text, notes, value, up, down, completed } = req.body
+
+  # If we're updating, get the task from the user
+  if req.method is 'PUT'
+    task = req.userObj?.tasks[req.params.id]
+    return res.json 400, err: "No task found." if !task || _.isEmpty(task)
+    # Strip for now
+    type = undefined
+    delete newTask.type
+  else if req.method is 'POST'
+    unless /^(habit|todo|daily|reward)$/.test type
+      return res.json 400, err: 'type must be habit, todo, daily, or reward'
+
+  text = sanitize(text).xss()
+  notes = sanitize(notes).xss()
+  value = sanitize(value).toInt()
+
+  switch type
+    when 'habit'
+      newTask.up = true unless typeof up is 'boolean'
+      newTask.down = true unless typeof down is 'boolean'
+    when 'daily', 'todo'
+      newTask.completed = false unless typeof completed is 'boolean'
+
+  _.extend task, newTask
+  req.task = task
+  next()
+
+router.put '/user/task/:id', auth, validateTask, (req, res) ->
+  req.user.set "tasks.#{req.task.id}", req.task
+
+  res.json 200, req.task
+
+router.post '/user/task', auth, validateTask, (req, res) ->
+  task = req.task
+  type = task.type
+
+  model = req.getModel()
+  model.ref '_user', req.user
+  model.refList "_#{type}List", "_user.tasks", "_user.#{type}Ids"
+  model.at("_#{type}List").push task
+
+  res.json 201, task
+
+router.get '/user/tasks', auth, (req, res) ->
+  user = req.userObj
+  return res.json 400, NO_USER_FOUND if !user || _.isEmpty(user)
+
+  model = req.getModel()
+  model.ref '_user', req.user
+  tasks = []
+  types = ['habit','todo','daily','reward']
+  if /^(habit|todo|daily|reward)$/.test req.query.type
+    types = [req.query.type]
+  for type in types
+    model.refList "_#{type}List", "_user.tasks", "_user.#{type}Ids"
+    tasks = tasks.concat model.get("_#{type}List")
+
+  res.json 200, tasks

 router.get '/users/:uid/calendar.ics', (req, res) ->
  #return next() #disable for now
@@ -62,11 +122,11 @@ router.get '/users/:uid/calendar.ics', (req, res) ->
  model = req.getModel()
  query = model.query('users').withIdAndToken(uid, apiToken)
  query.fetch (err, result) ->
-    return res.send(500, err) if err
+    return res.send(400, err) if err
    tasks = result.get('tasks')
    #      tasks = result[0].tasks
    tasksWithDates = _.filter tasks, (task) -> !!task.date
-    return res.send(500, "No events found") if _.isEmpty(tasksWithDates)
+    return res.send(400, "No events found") if _.isEmpty(tasksWithDates)

    ical = new icalendar.iCalendar()
    ical.addProperty('NAME', 'HabitRPG')
@@ -1,6 +1,10 @@
 express = require 'express'
 router = new express.Router()

+scoring = require '../app/scoring'
+_ = require 'underscore'
+icalendar = require('icalendar')
+
 # ---------- Deprecated Paths ------------

 deprecatedMessage = 'This API is no longer supported, see https://github.com/lefnire/habitrpg/wiki/API for new protocol'
@@ -9,4 +13,72 @@ router.get '/:uid/up/:score?', (req, res) -> res.send(500, deprecatedMessage)
 router.get '/:uid/down/:score?', (req, res) -> res.send(500, deprecatedMessage)
 router.post '/users/:uid/tasks/:taskId/:direction', (req, res) -> res.send(500, deprecatedMessage)

+router.post '/v1/users/:uid/tasks/:taskId/:direction', (req, res) ->
+  {uid, taskId, direction} = req.params
+  {apiToken, title, service, icon} = req.body
+  console.log {params:req.params, body:req.body} if process.env.NODE_ENV == 'development'
+
+  # Send error responses for improper API call
+  return res.send(500, 'request body "apiToken" required') unless apiToken
+  return res.send(500, ':uid required') unless uid
+  return res.send(500, ':taskId required') unless taskId
+  return res.send(500, ":direction must be 'up' or 'down'") unless direction in ['up','down']
+
+  model = req.getModel()
+  model.fetch model.query('users').withIdAndToken(uid, apiToken), (err, result) ->
+    return res.send(500, err) if err
+    user = result
+    userObj = user.get()
+    if _.isEmpty(userObj)
+      return res.send(500, "User with uid=#{uid}, token=#{apiToken} not found. Make sure you're not using your username, but your User Id")
+
+    model.ref('_user', user)
+    req._isServer = true
+
+    # Create task if doesn't exist
+    # TODO add service & icon to task
+    unless model.get("_user.tasks.#{taskId}")
+      model.refList "_habitList", "_user.tasks", "_user.habitIds"
+      model.at('_habitList').push
+        id: taskId
+        type: 'habit'
+        text: (title || taskId)
+        value: 0
+        up: true
+        down: true
+        notes: "This task was created by a third-party service. Feel free to edit, it won't harm the connection to that service. Additionally, multiple services may piggy-back off this task."
+
+    score = new scoring.Scoring(model)
+    delta = score.score(taskId, direction)
+    result = model.get ('_user.stats')
+    result.delta = delta
+    res.send(result)
+
+router.get '/v1/users/:uid/calendar.ics', (req, res) ->
+  #return next() #disable for now
+  {uid} = req.params
+  {apiToken} = req.query
+
+  model = req.getModel()
+  query = model.query('users').withIdAndToken(uid, apiToken)
+  query.fetch (err, result) ->
+    return res.send(500, err) if err
+    tasks = result.get('tasks')
+    #      tasks = result[0].tasks
+    tasksWithDates = _.filter tasks, (task) -> !!task.date
+    return res.send(500, "No events found") if _.isEmpty(tasksWithDates)
+
+    ical = new icalendar.iCalendar()
+    ical.addProperty('NAME', 'HabitRPG')
+    _.each tasksWithDates, (task) ->
+      event = new icalendar.VEvent(task.id);
+      event.setSummary(task.text);
+      d = new Date(task.date)
+      d.date_only = true
+      event.setDate d
+      ical.addComponent event
+    res.type('text/calendar')
+    formattedIcal = ical.toString().replace(/DTSTART\:/g, 'DTSTART;VALUE=DATE:')
+    res.send(200, formattedIcal)
+
 module.exports = router
@@ -31,7 +31,7 @@ server = http.createServer expressApp
 module.exports = server

 derby.use require('racer-db-mongo')
-store = derby.createStore
+module.exports.habitStore = store = derby.createStore
  db: {type: 'Mongo', uri: process.env.NODE_DB_URI, safe:true}
  listen: server

@@ -74,6 +74,9 @@ mongo_store = new MongoStore {url: process.env.NODE_DB_URI}, ->
    )
    # Adds req.getModel method
    .use(store.modelMiddleware())
+    # API should be hit before all other routes
+    .use('/api/v1', require('./api').middleware)
+    .use(require('./deprecated').middleware)
    # Show splash page for newcomers
    .use(middleware.splash)
    .use(priv.middleware)
@@ -81,9 +84,7 @@ mongo_store = new MongoStore {url: process.env.NODE_DB_URI}, ->
    .use(auth.middleware(strategies, options))
    # Creates an express middleware from the app's routes
    .use(app.router())
-    .use('/v1', require('./api').middleware)
    .use(require('./static').middleware)
-    .use(require('./deprecated').middleware)
    .use(expressApp.router)
    .use(serverError(root))

@@ -1,17 +1,14 @@
 module.exports.splash = (req, res, next) ->
-  # This was an API call, not a page load
-  return next() if req.is('json')
-
  unless req.query?.play? or req.getModel().get('_userId')
    res.redirect('/splash.html')
  else
    next()

 module.exports.view = (req, res, next) ->
-    model = req.getModel()
-    _view = model.get('_view') || {}
-    ## Set _mobileDevice to true or false so view can exclude portions from mobile device
-    _view.mobileDevice = /Android|webOS|iPhone|iPad|iPod|BlackBerry/i.test(req.header 'User-Agent')
-    _view.nodeEnv = process.env.NODE_ENV
-    model.set '_view', _view
-    next()
+  model = req.getModel()
+  _view = model.get('_view') || {}
+  ## Set _mobileDevice to true or false so view can exclude portions from mobile device
+  _view.mobileDevice = /Android|webOS|iPhone|iPad|iPod|BlackBerry/i.test(req.header 'User-Agent')
+  _view.nodeEnv = process.env.NODE_ENV
+  model.set '_view', _view
+  next()
@@ -28,7 +28,10 @@ userAccess = (store) ->
  store.writeAccess "*", "users.*", -> # captures, value, accept, err ->
    accept = arguments[arguments.length-2]
    err = arguments[arguments.length - 1]
-#    return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.bustedSession(@)
+    # return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.bustedSession(@)
+
+    return accept(true) if derbyAuth.isServer(@)
+
    return accept(false) if derbyAuth.bustedSession(@)

    captures = arguments[0].split('.')
@@ -40,8 +43,7 @@ userAccess = (store) ->
      return accept(true)

    # Same session (user.id = this.session.userId)
-    if (uid is @session.userId) or derbyAuth.isServer(@)
-      return accept(true)
+    return accept(true) if uid is @session.userId

    accept(false)