decap-server 1.4.0-beta.0

package/src/middlewares/joi/index.ts

@@ -0,0 +1,246 @@
+import Joi from '@hapi/joi';
+
+import type express from 'express';
+
+const allowedActions = [
+  'info',
+  'entriesByFolder',
+  'entriesByFiles',
+  'getEntry',
+  'unpublishedEntries',
+  'unpublishedEntry',
+  'unpublishedEntryDataFile',
+  'unpublishedEntryMediaFile',
+  'deleteUnpublishedEntry',
+  'persistEntry',
+  'updateUnpublishedEntryStatus',
+  'publishUnpublishedEntry',
+  'getMedia',
+  'getMediaFile',
+  'persistMedia',
+  'deleteFile',
+  'deleteFiles',
+  'getDeployPreview',
+];
+
+const requiredString = Joi.string().required();
+const requiredNumber = Joi.number().required();
+const requiredBool = Joi.bool().required();
+
+const collection = requiredString;
+const slug = requiredString;
+
+export function defaultSchema({ path = requiredString } = {}) {
+  const defaultParams = Joi.object({
+    branch: requiredString,
+  });
+
+  const asset = Joi.object({
+    path,
+    content: requiredString,
+    encoding: requiredString.valid('base64'),
+  });
+
+  const dataFile = Joi.object({
+    slug: requiredString,
+    path,
+    raw: requiredString,
+    newPath: path.optional(),
+  });
+
+  const params = Joi.when('action', {
+    switch: [
+      {
+        is: 'info',
+        then: Joi.allow(),
+      },
+      {
+        is: 'entriesByFolder',
+        then: defaultParams
+          .keys({
+            folder: path,
+            extension: requiredString,
+            depth: requiredNumber,
+          })
+          .required(),
+      },
+      {
+        is: 'entriesByFiles',
+        then: defaultParams.keys({
+          files: Joi.array()
+            .items(Joi.object({ path, label: Joi.string() }))
+            .required(),
+        }),
+      },
+      {
+        is: 'getEntry',
+        then: defaultParams
+          .keys({
+            path,
+          })
+          .required(),
+      },
+      {
+        is: 'unpublishedEntries',
+        then: defaultParams.keys({ branch: requiredString }).required(),
+      },
+      {
+        is: 'unpublishedEntry',
+        then: defaultParams
+          .keys({
+            id: Joi.string().optional(),
+            collection: Joi.string().optional(),
+            slug: Joi.string().optional(),
+            cmsLabelPrefix: Joi.string().optional(),
+          })
+          .required(),
+      },
+      {
+        is: 'unpublishedEntryDataFile',
+        then: defaultParams
+          .keys({
+            collection,
+            slug,
+            id: requiredString,
+            path: requiredString,
+          })
+          .required(),
+      },
+      {
+        is: 'unpublishedEntryMediaFile',
+        then: defaultParams
+          .keys({
+            collection,
+            slug,
+            id: requiredString,
+            path: requiredString,
+          })
+          .required(),
+      },
+      {
+        is: 'deleteUnpublishedEntry',
+        then: defaultParams
+          .keys({
+            collection,
+            slug,
+          })
+          .required(),
+      },
+      {
+        is: 'persistEntry',
+        then: defaultParams
+          .keys({
+            cmsLabelPrefix: Joi.string().optional(),
+            entry: dataFile, // entry is kept for backwards compatibility
+            dataFiles: Joi.array().items(dataFile),
+            assets: Joi.array().items(asset).required(),
+            options: Joi.object({
+              collectionName: Joi.string(),
+              commitMessage: requiredString,
+              useWorkflow: requiredBool,
+              status: requiredString,
+            }).required(),
+          })
+          .xor('entry', 'dataFiles')
+          .required(),
+      },
+      {
+        is: 'updateUnpublishedEntryStatus',
+        then: defaultParams
+          .keys({
+            collection,
+            slug,
+            newStatus: requiredString,
+            cmsLabelPrefix: Joi.string().optional(),
+          })
+          .required(),
+      },
+      {
+        is: 'publishUnpublishedEntry',
+        then: defaultParams
+          .keys({
+            collection,
+            slug,
+          })
+          .required(),
+      },
+      {
+        is: 'getMedia',
+        then: defaultParams
+          .keys({
+            mediaFolder: path,
+          })
+          .required(),
+      },
+      {
+        is: 'getMediaFile',
+        then: defaultParams
+          .keys({
+            path,
+          })
+          .required(),
+      },
+      {
+        is: 'persistMedia',
+        then: defaultParams
+          .keys({
+            asset: asset.required(),
+            options: Joi.object({
+              commitMessage: requiredString,
+            }).required(),
+          })
+          .required(),
+      },
+      {
+        is: 'deleteFile',
+        then: defaultParams
+          .keys({
+            path,
+            options: Joi.object({
+              commitMessage: requiredString,
+            }).required(),
+          })
+          .required(),
+      },
+      {
+        is: 'deleteFiles',
+        then: defaultParams
+          .keys({
+            paths: Joi.array().items(path).min(1).required(),
+            options: Joi.object({
+              commitMessage: requiredString,
+            }).required(),
+          })
+          .required(),
+      },
+      {
+        is: 'getDeployPreview',
+        then: defaultParams
+          .keys({
+            collection,
+            slug,
+          })
+          .required(),
+      },
+    ],
+    otherwise: Joi.forbidden(),
+  });
+
+  return Joi.object({
+    action: Joi.valid(...allowedActions).required(),
+    params,
+  });
+}
+
+export function joi(schema: Joi.Schema) {
+  return (req: express.Request, res: express.Response, next: express.NextFunction) => {
+    const { error } = schema.validate(req.body, { allowUnknown: true });
+    if (error) {
+      const { details } = error;
+      const message = details.map(i => i.message).join(',');
+      res.status(422).json({ error: message });
+    } else {
+      next();
+    }
+  };
+}

package/src/middlewares/localFs/index.spec.ts

@@ -0,0 +1,92 @@
+/* eslint-disable @typescript-eslint/no-var-requires */
+import { getSchema } from '.';
+
+import type Joi from '@hapi/joi';
+
+function assetFailure(result: Joi.ValidationResult, expectedMessage: string) {
+  const { error } = result;
+  expect(error).not.toBeNull();
+  expect(error!.details).toHaveLength(1);
+  const message = error!.details.map(({ message }) => message)[0];
+  expect(message).toBe(expectedMessage);
+}
+
+const defaultParams = {
+  branch: 'master',
+};
+
+describe('localFsMiddleware', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('getSchema', () => {
+    it('should throw on path traversal', () => {
+      const schema = getSchema({ repoPath: '/Users/user/documents/code/repo' });
+
+      assetFailure(
+        schema.validate({
+          action: 'getEntry',
+          params: { ...defaultParams, path: '../' },
+        }),
+        '"params.path" must resolve to a path under the configured repository',
+      );
+    });
+
+    it('should not throw on valid path', () => {
+      const schema = getSchema({ repoPath: '/Users/user/documents/code/repo' });
+
+      const { error } = schema.validate({
+        action: 'getEntry',
+        params: { ...defaultParams, path: 'src/content/posts/title.md' },
+      });
+
+      expect(error).toBeUndefined();
+    });
+
+    it('should throw on folder traversal', () => {
+      const schema = getSchema({ repoPath: '/Users/user/documents/code/repo' });
+
+      assetFailure(
+        schema.validate({
+          action: 'entriesByFolder',
+          params: { ...defaultParams, folder: '../', extension: 'md', depth: 1 },
+        }),
+        '"params.folder" must resolve to a path under the configured repository',
+      );
+    });
+
+    it('should not throw on valid folder', () => {
+      const schema = getSchema({ repoPath: '/Users/user/documents/code/repo' });
+
+      const { error } = schema.validate({
+        action: 'entriesByFolder',
+        params: { ...defaultParams, folder: 'src/posts', extension: 'md', depth: 1 },
+      });
+
+      expect(error).toBeUndefined();
+    });
+
+    it('should throw on media folder traversal', () => {
+      const schema = getSchema({ repoPath: '/Users/user/documents/code/repo' });
+
+      assetFailure(
+        schema.validate({
+          action: 'getMedia',
+          params: { ...defaultParams, mediaFolder: '../' },
+        }),
+        '"params.mediaFolder" must resolve to a path under the configured repository',
+      );
+    });
+
+    it('should not throw on valid folder', () => {
+      const schema = getSchema({ repoPath: '/Users/user/documents/code/repo' });
+      const { error } = schema.validate({
+        action: 'getMedia',
+        params: { ...defaultParams, mediaFolder: 'static/images' },
+      });
+
+      expect(error).toBeUndefined();
+    });
+  });
+});

package/src/middlewares/localFs/index.ts

@@ -0,0 +1,163 @@
+import path from 'path';
+
+import { defaultSchema, joi } from '../joi';
+import { pathTraversal } from '../joi/customValidators';
+import { listRepoFiles, deleteFile, writeFile, move } from '../utils/fs';
+import { entriesFromFiles, readMediaFile } from '../utils/entries';
+
+import type {
+  EntriesByFolderParams,
+  EntriesByFilesParams,
+  GetEntryParams,
+  PersistEntryParams,
+  GetMediaParams,
+  GetMediaFileParams,
+  PersistMediaParams,
+  DeleteFileParams,
+  DeleteFilesParams,
+  DataFile,
+} from '../types';
+import type express from 'express';
+import type winston from 'winston';
+
+type FsOptions = {
+  repoPath: string;
+  logger: winston.Logger;
+};
+
+export function localFsMiddleware({ repoPath, logger }: FsOptions) {
+  return async function (req: express.Request, res: express.Response) {
+    try {
+      const { body } = req;
+
+      switch (body.action) {
+        case 'info': {
+          res.json({
+            repo: path.basename(repoPath),
+            publish_modes: ['simple'],
+            type: 'local_fs',
+          });
+          break;
+        }
+        case 'entriesByFolder': {
+          const payload = body.params as EntriesByFolderParams;
+          const { folder, extension, depth } = payload;
+          const entries = await listRepoFiles(repoPath, folder, extension, depth).then(files =>
+            entriesFromFiles(
+              repoPath,
+              files.map(file => ({ path: file })),
+            ),
+          );
+          res.json(entries);
+          break;
+        }
+        case 'entriesByFiles': {
+          const payload = body.params as EntriesByFilesParams;
+          const entries = await entriesFromFiles(repoPath, payload.files);
+          res.json(entries);
+          break;
+        }
+        case 'getEntry': {
+          const payload = body.params as GetEntryParams;
+          const [entry] = await entriesFromFiles(repoPath, [{ path: payload.path }]);
+          res.json(entry);
+          break;
+        }
+        case 'persistEntry': {
+          const {
+            entry,
+            dataFiles = [entry as DataFile],
+            assets,
+          } = body.params as PersistEntryParams;
+          await Promise.all(
+            dataFiles.map(dataFile => writeFile(path.join(repoPath, dataFile.path), dataFile.raw)),
+          );
+          // save assets
+          await Promise.all(
+            assets.map(a =>
+              writeFile(path.join(repoPath, a.path), Buffer.from(a.content, a.encoding)),
+            ),
+          );
+          if (dataFiles.every(dataFile => dataFile.newPath)) {
+            dataFiles.forEach(async dataFile => {
+              await move(
+                path.join(repoPath, dataFile.path),
+                path.join(repoPath, dataFile.newPath!),
+              );
+            });
+          }
+          res.json({ message: 'entry persisted' });
+          break;
+        }
+        case 'getMedia': {
+          const { mediaFolder } = body.params as GetMediaParams;
+          const files = await listRepoFiles(repoPath, mediaFolder, '', 1);
+          const mediaFiles = await Promise.all(files.map(file => readMediaFile(repoPath, file)));
+          res.json(mediaFiles);
+          break;
+        }
+        case 'getMediaFile': {
+          const { path } = body.params as GetMediaFileParams;
+          const mediaFile = await readMediaFile(repoPath, path);
+          res.json(mediaFile);
+          break;
+        }
+        case 'persistMedia': {
+          const { asset } = body.params as PersistMediaParams;
+          await writeFile(
+            path.join(repoPath, asset.path),
+            Buffer.from(asset.content, asset.encoding),
+          );
+          const file = await readMediaFile(repoPath, asset.path);
+          res.json(file);
+          break;
+        }
+        case 'deleteFile': {
+          const { path: filePath } = body.params as DeleteFileParams;
+          await deleteFile(repoPath, filePath);
+          res.json({ message: `deleted file ${filePath}` });
+          break;
+        }
+        case 'deleteFiles': {
+          const { paths } = body.params as DeleteFilesParams;
+          await Promise.all(paths.map(filePath => deleteFile(repoPath, filePath)));
+          res.json({ message: `deleted files ${paths.join(', ')}` });
+          break;
+        }
+        case 'getDeployPreview': {
+          res.json(null);
+          break;
+        }
+        default: {
+          const message = `Unknown action ${body.action}`;
+          res.status(422).json({ error: message });
+          break;
+        }
+      }
+    } catch (e) {
+      logger.error(
+        `Error handling ${JSON.stringify(req.body)}: ${
+          e instanceof Error ? e.message : 'Unknown error'
+        }`,
+      );
+      res.status(500).json({ error: 'Unknown error' });
+    }
+  };
+}
+
+export function getSchema({ repoPath }: { repoPath: string }) {
+  const schema = defaultSchema({ path: pathTraversal(repoPath) });
+  return schema;
+}
+
+type Options = {
+  logger: winston.Logger;
+};
+
+export async function registerMiddleware(app: express.Express, options: Options) {
+  const { logger } = options;
+  const repoPath = path.resolve(process.env.GIT_REPO_DIRECTORY || process.cwd());
+  app.post('/api/v1', joi(getSchema({ repoPath })));
+  app.post('/api/v1', localFsMiddleware({ repoPath, logger }));
+  logger.info(`Decap CMS File System Proxy Server configured with ${repoPath}`);
+}

package/src/middlewares/localGit/index.spec.ts

@@ -0,0 +1,154 @@
+/* eslint-disable @typescript-eslint/no-var-requires */
+import winston from 'winston';
+
+import { validateRepo, getSchema, localGitMiddleware } from '.';
+
+import type Joi from '@hapi/joi';
+import type express from 'express';
+
+jest.mock('decap-cms-lib-util', () => jest.fn());
+jest.mock('simple-git');
+
+function assetFailure(result: Joi.ValidationResult, expectedMessage: string) {
+  const { error } = result;
+  expect(error).not.toBeNull();
+  expect(error!.details).toHaveLength(1);
+  const message = error!.details.map(({ message }) => message)[0];
+  expect(message).toBe(expectedMessage);
+}
+
+const defaultParams = {
+  branch: 'master',
+};
+
+describe('localGitMiddleware', () => {
+  const simpleGit = require('simple-git');
+
+  const git = {
+    checkIsRepo: jest.fn(),
+    silent: jest.fn(),
+    branchLocal: jest.fn(),
+    checkout: jest.fn(),
+  };
+  git.silent.mockReturnValue(git);
+
+  simpleGit.mockReturnValue(git);
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('validateRepo', () => {
+    it('should throw on non valid git repo', async () => {
+      git.checkIsRepo.mockResolvedValue(false);
+      await expect(validateRepo({ repoPath: '/Users/user/code/repo' })).rejects.toEqual(
+        new Error('/Users/user/code/repo is not a valid git repository'),
+      );
+    });
+
+    it('should not throw on valid git repo', async () => {
+      git.checkIsRepo.mockResolvedValue(true);
+      await expect(validateRepo({ repoPath: '/Users/user/code/repo' })).resolves.toBeUndefined();
+    });
+  });
+
+  describe('getSchema', () => {
+    it('should throw on path traversal', () => {
+      const schema = getSchema({ repoPath: '/Users/user/documents/code/repo' });
+
+      assetFailure(
+        schema.validate({
+          action: 'getEntry',
+          params: { ...defaultParams, path: '../' },
+        }),
+        '"params.path" must resolve to a path under the configured repository',
+      );
+    });
+
+    it('should not throw on valid path', () => {
+      const schema = getSchema({ repoPath: '/Users/user/documents/code/repo' });
+
+      const { error } = schema.validate({
+        action: 'getEntry',
+        params: { ...defaultParams, path: 'src/content/posts/title.md' },
+      });
+
+      expect(error).toBeUndefined();
+    });
+
+    it('should throw on folder traversal', () => {
+      const schema = getSchema({ repoPath: '/Users/user/documents/code/repo' });
+
+      assetFailure(
+        schema.validate({
+          action: 'entriesByFolder',
+          params: { ...defaultParams, folder: '../', extension: 'md', depth: 1 },
+        }),
+        '"params.folder" must resolve to a path under the configured repository',
+      );
+    });
+
+    it('should not throw on valid folder', () => {
+      const schema = getSchema({ repoPath: '/Users/user/documents/code/repo' });
+
+      const { error } = schema.validate({
+        action: 'entriesByFolder',
+        params: { ...defaultParams, folder: 'src/posts', extension: 'md', depth: 1 },
+      });
+
+      expect(error).toBeUndefined();
+    });
+
+    it('should throw on media folder traversal', () => {
+      const schema = getSchema({ repoPath: '/Users/user/documents/code/repo' });
+
+      assetFailure(
+        schema.validate({
+          action: 'getMedia',
+          params: { ...defaultParams, mediaFolder: '../' },
+        }),
+        '"params.mediaFolder" must resolve to a path under the configured repository',
+      );
+    });
+
+    it('should not throw on valid folder', () => {
+      const schema = getSchema({ repoPath: '/Users/user/documents/code/repo' });
+      const { error } = schema.validate({
+        action: 'getMedia',
+        params: { ...defaultParams, mediaFolder: 'static/images' },
+      });
+
+      expect(error).toBeUndefined();
+    });
+  });
+
+  describe('localGitMiddleware', () => {
+    const json = jest.fn();
+    const status = jest.fn(() => ({ json }));
+    const res: express.Response = { status } as unknown as express.Response;
+
+    const repoPath = '.';
+
+    it("should return error when default branch doesn't exist", async () => {
+      git.branchLocal.mockResolvedValue({ all: ['master'] });
+
+      const req = {
+        body: {
+          action: 'getMedia',
+          params: {
+            mediaFolder: 'mediaFolder',
+            branch: 'develop',
+          },
+        },
+      } as express.Request;
+
+      await localGitMiddleware({ repoPath, logger: winston.createLogger() })(req, res);
+
+      expect(status).toHaveBeenCalledTimes(1);
+      expect(status).toHaveBeenCalledWith(422);
+
+      expect(json).toHaveBeenCalledTimes(1);
+      expect(json).toHaveBeenCalledWith({ error: "Default branch 'develop' doesn't exist" });
+    });
+  });
+});