Use DocApiKey as valid ApiKeys

app/common/ShareOptions.ts

@@ -19,4 +19,6 @@ export interface ShareOptions {
   // Half-baked, just here to exercise an aspect of homedb
   // syncing.
   access?: 'editors' | 'viewers';
+
+  apikey?: true;
 }

app/gen-server/ApiServer.ts

@@ -21,6 +21,7 @@ import {addPermit, clearSessionCacheIfNeeded, getDocScope, getScope, integerPara
         isParameterOn, optStringParam, sendOkReply, sendReply, stringParam} from 'app/server/lib/requestUtils';
 import {IWidgetRepository} from 'app/server/lib/WidgetRepository';
 import {getCookieDomain} from 'app/server/lib/gristSessions';
+import { ShareOptions } from 'app/common/ShareOptions';
 
 // exposed for testing purposes
 export const Deps = {
@@ -324,6 +325,118 @@ export class ApiServer {
       return sendOkReply(req, res);
     }));
 
+    // POST /api/docs/:did/apiKey
+    this._app.post('/api/docs/:did/apiKey', expressWrap(async (req, res) => {
+      const did = req.params.did;
+      const doc = await this._dbManager.getDoc(req);
+      if (!doc){
+        throw new ApiError(`No such doc: ${did}`, 404);
+      }
+
+      const linkId = req.body.linkId;
+      const query = await this._dbManager.getDocApiKeyByLinkId(did, linkId);
+      if (query){
+        throw new ApiError("LinkId must be unique", 400);
+      }
+      const options = sanitizeDocApiKeyOptions(req.body.options);
+      req.body.options = JSON.stringify(options);
+
+      const key = await this._dbManager.createDocApiKey(did, req.body);
+
+      return sendOkReply(req, res, key);
+    }));
+
+    // GET /api/docs/:did/apiKey/:linkId
+    this._app.get('/api/docs/:did/apiKey/:linkId', expressWrap(async (req, res) => {
+      const did = req.params.did;
+
+      const doc = await this._dbManager.getDoc(req);
+      if (!doc){
+        throw new ApiError(`No such doc: ${did}`, 404);
+      }
+      const linkId = req.params.linkId;
+      const query = await this._dbManager.getDocApiKeyByLinkId(did, linkId);
+      return query ? sendOkReply(req, res, query) : res.status(404).send();
+    }));
+
+    // PATCH /api/docs/:did/apiKey/:linkId
+    this._app.patch('/api/docs/:did/apiKey/:linkId', expressWrap(async (req, res) => {
+      const did = req.params.did;
+      const linkId = req.params.linkId;
+
+      const doc = await this._dbManager.getDoc(req);
+      if (!doc){
+        throw new ApiError(`No such doc: ${did}`, 404);
+      }
+
+      if (req.body.docId){
+        throw new ApiError("Can't update DocId", 400);
+      }
+
+      if (req.body.key){
+        throw new ApiError("Can't update key", 400);
+      }
+
+      const queryLinkId = await this._dbManager.getDocApiKeyByLinkId(did, req.body.linkId);
+      if (queryLinkId){
+        throw new ApiError("LinkId must be unique", 400);
+      }
+
+      // In order to catch {options: ""} case
+      if (Object.keys(req.body).includes("options")){
+        const options = sanitizeDocApiKeyOptions(req.body.options);
+        req.body.options = JSON.stringify(options);
+      }
+
+      const query = await this._dbManager.updateDocApiKeyByLinkId(did, linkId, req.body);
+      return sendOkReply(req, res, query);
+    }));
+
+    // DELETE /api/docs/:did/apiKey/:linkId
+    this._app.delete('/api/docs/:did/apiKey/:linkId', expressWrap(async (req, res) => {
+      const did = req.params.did;
+      const linkId = req.params.linkId;
+
+      const doc = await this._dbManager.getDoc(req);
+      if (!doc){
+        throw new ApiError(`No such doc: ${did}`, 404);
+      }
+
+      const linkId4Did = await this._dbManager.getDocApiKeyByLinkId(did, linkId);
+      if (!linkId4Did){
+        throw new ApiError(`Invalid LinkId: ${linkId}`, 404);
+      }
+
+      const query = await this._dbManager.deleteDocApiKeyByLinkId(did, linkId);
+      return sendOkReply(req, res, query);
+    }));
+
+    // GET /api/docs/:did/apiKeys
+    this._app.get('/api/docs/:did/apiKeys', expressWrap(async (req, res) => {
+      const did = req.params.did;
+
+      const doc = await this._dbManager.getDoc(req);
+      if (!doc){
+        throw new ApiError(`No such doc: ${did}`, 404);
+      }
+
+      const query = await this._dbManager.getDocApiKeys(did);
+      return sendOkReply(req, res, query);
+    }));
+
+    // DELETE /api/docs/:did/apiKeys
+    this._app.delete('/api/docs/:did/apiKeys', expressWrap(async (req, res) => {
+      const did = req.params.did;
+
+      const doc = await this._dbManager.getDoc(req);
+      if (!doc){
+        throw new ApiError(`No such doc: ${did}`, 404);
+      }
+
+      const query = await this._dbManager.deleteDocApiKeys(did);
+      return sendOkReply(req, res, query);
+    }));
+
     // PATCH /api/orgs/:oid/access
     // Update the specified org acl rules.
     this._app.patch('/api/orgs/:oid/access', expressWrap(async (req, res) => {
@@ -699,3 +812,28 @@ async function updateApiKeyWithRetry(manager: EntityManager, user: User): Promis
   }
   throw new Error('Could not generate a valid api key.');
 }
+
+function sanitizeDocApiKeyOptions(rawOptions: string): ShareOptions {
+  const legalOptions: (keyof ShareOptions)[] = ["access"];
+  const legalAccessValues: ShareOptions["access"][] = ["editors", "viewers"];
+
+  if (!rawOptions){
+    throw new ApiError("Missing body params: options", 400);
+  }
+
+  const options = JSON.parse(rawOptions);
+  if (!options.access){
+    throw new ApiError("Missing options: access", 400);
+  }
+
+  Object.keys(options).forEach(element => {
+    if (!(legalOptions as string[]).includes(element)){
+      throw new ApiError(`Invalid option: ${element}`, 400);
+    }
+  });
+
+  if (!legalAccessValues.includes(options.access)){
+    throw new ApiError(`Invalid access value: ${options.access}`, 400);
+  }
+  return {...options, "apikey": true};
+}

app/gen-server/lib/homedb/HomeDBManager.ts

@@ -44,6 +44,7 @@ import {
   AvailableUsers, GetUserOptions, NonGuestGroup, Resource, UserProfileChange
 } from 'app/gen-server/lib/homedb/Interfaces';
 import {SUPPORT_EMAIL, UsersManager} from 'app/gen-server/lib/homedb/UsersManager';
+import {SharesManager} from 'app/gen-server/lib/homedb/SharesManager';
 import {Permissions} from 'app/gen-server/lib/Permissions';
 import {scrubUserFromOrg} from "app/gen-server/lib/scrubUserFromOrg";
 import {applyPatch} from 'app/gen-server/lib/TypeORMPatches';
@@ -247,6 +248,7 @@ export type BillingOptions = Partial<Pick<BillingAccount,
  */
 export class HomeDBManager extends EventEmitter {
   private _usersManager = new UsersManager(this, this._runInTransaction.bind(this));
+  private _sharesManager = new SharesManager(this);
   private _connection: Connection;
   private _dbType: DatabaseType;
   private _exampleWorkspaceId: number;
@@ -968,6 +970,17 @@ export class HomeDBManager extends EventEmitter {
     return doc;
   }
 
+  public async getOrgOwnerFromDocApiKey(docApiKey: Share) {
+    return this._connection.createQueryBuilder()
+      .select('orgs')
+      .from(Organization, 'orgs')
+      .leftJoin(Workspace, 'workspaces', 'orgs.id = workspaces.org_id')
+      .leftJoin(Document, 'docs', 'workspaces.id = docs.workspace_id')
+      .leftJoin(Share, 'shares', 'docs.id = shares.doc_id')
+      .where('shares.key = :key', {key: docApiKey.key})
+      .getOne();
+  }
+
   // Calls getDocImpl() and returns the Document from that, caching a fresh DocAuthResult along
   // the way. Note that we only cache the access level, not Document itself.
   public async getDoc(reqOrScope: Request | Scope, transaction?: EntityManager): Promise<Document> {
@@ -2497,6 +2510,44 @@ export class HomeDBManager extends EventEmitter {
       .getOne() || undefined;
   }
 
+  public getDocApiKeyByLinkId(docId: string, linkId: string): Promise<Share | null> {
+    return this._sharesManager.getShareByLinkId(docId, linkId);
+  }
+
+  public getDocApiKeyByKey(key: string): Promise<Share | null> {
+    return this._sharesManager.getShareByKey(key);
+  }
+
+  public async createDocApiKey(docId: string, share: ShareInfo) {
+    return this._sharesManager.createDocApiKey(docId, share);
+  }
+
+  // nb. The linkId parameter corresponds to the one currently stored in the db.
+  // If we want to update it the new value must be passed through the share parameter
+  public async updateDocApiKeyByLinkId(docId: string, linkId: string, share: ShareInfo) {
+    return this._sharesManager.updateDocApiKeyByLinkId(docId, linkId, share);
+  }
+
+  public async updateDocApiKeyByKey(docId: string, apiKey: string, share: ShareInfo) {
+    return this._sharesManager.updateDocApiKeyByKey(docId, apiKey, share);
+  }
+
+  public async deleteDocApiKeyByKey(docId: string, apiKey: string) {
+    return this._sharesManager.deleteDocApiKeyByKey(docId, apiKey);
+  }
+
+  public async deleteDocApiKeyByLinkId(docId: string, linkId: string) {
+    return this._sharesManager.deleteDocApiKeyByLinkId(docId, linkId);
+  }
+
+  public async getDocApiKeys(docId: string): Promise<Share[] | undefined> {
+    return this._sharesManager.getDocApiKeys(docId);
+  }
+
+  public async deleteDocApiKeys(docId: string) {
+    return this._sharesManager.deleteDocApiKeys(docId);
+  }
+
   public getAnonymousUser() {
     return this._usersManager.getAnonymousUser();
   }
@@ -2717,54 +2768,15 @@ export class HomeDBManager extends EventEmitter {
   }
 
   public async syncShares(docId: string, shares: ShareInfo[]) {
-    return this._connection.transaction(async manager => {
-      for (const share of shares) {
-        const key = makeId();
-        await manager.createQueryBuilder()
-          .insert()
-        // if urlId has been used before, update it
-          .onConflict(`(doc_id, link_id) DO UPDATE SET options = :options`)
-          .setParameter('options', share.options)
-          .into(Share)
-          .values({
-            linkId: share.linkId,
-            docId,
-            options: JSON.parse(share.options),
-            key,
-          })
-          .execute();
-      }
-      const dbShares = await manager.createQueryBuilder()
-        .select('shares')
-        .from(Share, 'shares')
-        .where('doc_id = :docId', {docId})
-        .getMany();
-      const activeLinkIds = new Set(shares.map(share => share.linkId));
-      const oldShares = dbShares.filter(share => !activeLinkIds.has(share.linkId));
-      if (oldShares.length > 0) {
-        await manager.createQueryBuilder()
-          .delete()
-          .from('shares')
-          .whereInIds(oldShares.map(share => share.id))
-          .execute();
-      }
-    });
+    return this._sharesManager.syncShares(docId, shares);
   }
 
   public async getShareByKey(key: string) {
-    return this._connection.createQueryBuilder()
-      .select('shares')
-      .from(Share, 'shares')
-      .where('shares.key = :key', {key})
-      .getOne();
+    return this._sharesManager.getShareByKey(key);
   }
 
   public async getShareByLinkId(docId: string, linkId: string) {
-    return this._connection.createQueryBuilder()
-      .select('shares')
-      .from(Share, 'shares')
-      .where('shares.doc_id = :docId and shares.link_id = :linkId', {docId, linkId})
-      .getOne();
+    return this._sharesManager.getShareByLinkId(docId, linkId);
   }
 
   private async _getOrgMembers(org: string|number|Organization) {