1
0
mirror of https://github.com/Jermolene/TiddlyWiki5 synced 2024-12-27 10:30:28 +00:00
TiddlyWiki5/plugins/tiddlywiki/tiddlyweb/tiddlywebadaptor.js

334 lines
8.8 KiB
JavaScript
Raw Normal View History

/*\
title: $:/plugins/tiddlywiki/tiddlyweb/tiddlywebadaptor.js
type: application/javascript
module-type: syncadaptor
A sync adaptor module for synchronising with TiddlyWeb compatible servers
\*/
(function(){
/*jslint node: true, browser: true */
/*global $tw: false */
"use strict";
var CONFIG_HOST_TIDDLER = "$:/config/tiddlyweb/host",
DEFAULT_HOST_TIDDLER = "$protocol$//$host$/";
function TiddlyWebAdaptor(options) {
this.wiki = options.wiki;
this.host = this.getHost();
this.recipe = undefined;
this.hasStatus = false;
this.logger = new $tw.utils.Logger("TiddlyWebAdaptor");
Module-ize server routes, add static file support and other enhancements(#2679) * Module-ize server routes and add static file support (#2510) * Refactor server routes to modules New module type: serverroute Caveats: Loading order is not deterministic but this would only matter if two route modules attempted to use the same path regexp (that would be silly). * Add static assets plugin This plugin allows the node server to fetch static assets in the /assets directory. I felt that this was a feature that goes above the core functionality. That is why I added it as a plugin. with the modular route extensions this was a breeze. * Add serverroute description to ModuleTypes * Coding standards tweaks * Fix filename typo * Move support for attachments from a plugin into the core * Missing "else" * Refactor server handling * Introduce a new named parameter scheme for commands * Move the SimpleServer class into it's own module * Deprecate the --server command because of the unwieldy syntax * Add a new --listen command using the new syntax For example: tiddlywiki mywiki --listen host:0.0.0.0 port:8090 * Add check for unknown parameters * Add support for multiple basic authentication credentials in a CSV file Beware: Passwords are stored in plain text. If that's a problem, use an authenticating proxy and the trusted header authentication approach. * Refactor module locations * Rename "serverroute" module type to "route" * Remove support for verifying optional named command parameters The idea was to be able to flag unknown parameter names, but requiring a command to pre-specify all the parameter names makes it harder for (say) the listen command to be extensible so that plugins can add new optional parameters that they handle. (This is particularly in the context of work in progress to encapsulate authenticators into their own modules). * Refactor the two authenticators into separate modules and add support for authorization * Correct mistaken path.join vs. path.resolve See https://stackoverflow.com/a/39836259 * Docs for the named command parameters I'd be grateful if anyone with sufficient Windows experience could confirm that the note about double quotes in "NamedCommandParameters" is correct. * Be consistent about lower case parameter names * Do the right thing when we have a username but no password With a username parameter but no password parameter we'll attribute edits to that username, but not require authentication. * Remove obsolete code * Add support for requiring authentication without restricting the username * Refactor authorization checks * Return read_only status in /status response * Fix two code typos * Add basic support for detecting readonly status and avoiding write errors We now have syncadaptors returning readonly status and avoid attempting to write to the server if it's going to fail * Add readonly-styles We hide editing-related buttons in read only mode I've made this part of the tiddlyweb plugin but I think a case could be made for putting it into the core. * Add custom request header as CSRF mitigation By default we require the header X-Requested-With to be set to TiddlyWiki. Can be overriden by setting csrfdisable to "yes" See https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Protecting_REST_Services:_Use_of_Custom_Request_Headers * Add support for HTTPS * First pass at a route for serving rendered tiddlers cc @Drakor * Tweaks to the single tiddler static view Adding a simple sidebar * Switch to "dash" separated parameter names * Typo * Docs: Update ServerCommand and ListenCommand * First pass at docs for the new web server stuff Writing the docs is turning out to be quite an undertaking, much harder than writing the code! * Get rid of extraneous paragraphs in static renderings * Rejig anonymous user handling Now we can support wikis that are read-only for anonymous access, but allow a user to login for read/write access. * More docs Slowly getting there... * Static tiddler rendering: Fix HTML content in page title * Docs updates * Fix server command parameter names Missed off 30ce7ea * Docs: Missing quotes * Avoid inadvertent dependency on Node.js > v9.6.0 The listenOptions parameter of the plain HTTP version of CreateServer was only introduced in v9.6.0 cc @Drakor @pmario * Typo
2018-07-18 15:54:43 +00:00
this.isLoggedIn = false;
this.isReadOnly = false;
}
TiddlyWebAdaptor.prototype.name = "tiddlyweb";
TiddlyWebAdaptor.prototype.isReady = function() {
return this.hasStatus;
};
TiddlyWebAdaptor.prototype.getHost = function() {
var text = this.wiki.getTiddlerText(CONFIG_HOST_TIDDLER,DEFAULT_HOST_TIDDLER),
substitutions = [
{name: "protocol", value: document.location.protocol},
{name: "host", value: document.location.host}
];
for(var t=0; t<substitutions.length; t++) {
var s = substitutions[t];
text = $tw.utils.replaceString(text,new RegExp("\\$" + s.name + "\\$","mg"),s.value);
}
return text;
};
TiddlyWebAdaptor.prototype.getTiddlerInfo = function(tiddler) {
return {
bag: tiddler.fields.bag
};
};
/*
Get the current status of the TiddlyWeb connection
*/
TiddlyWebAdaptor.prototype.getStatus = function(callback) {
// Get status
var self = this;
this.logger.log("Getting status");
$tw.utils.httpRequest({
url: this.host + "status",
callback: function(err,data) {
self.hasStatus = true;
if(err) {
return callback(err);
}
// Decode the status JSON
Module-ize server routes, add static file support and other enhancements(#2679) * Module-ize server routes and add static file support (#2510) * Refactor server routes to modules New module type: serverroute Caveats: Loading order is not deterministic but this would only matter if two route modules attempted to use the same path regexp (that would be silly). * Add static assets plugin This plugin allows the node server to fetch static assets in the /assets directory. I felt that this was a feature that goes above the core functionality. That is why I added it as a plugin. with the modular route extensions this was a breeze. * Add serverroute description to ModuleTypes * Coding standards tweaks * Fix filename typo * Move support for attachments from a plugin into the core * Missing "else" * Refactor server handling * Introduce a new named parameter scheme for commands * Move the SimpleServer class into it's own module * Deprecate the --server command because of the unwieldy syntax * Add a new --listen command using the new syntax For example: tiddlywiki mywiki --listen host:0.0.0.0 port:8090 * Add check for unknown parameters * Add support for multiple basic authentication credentials in a CSV file Beware: Passwords are stored in plain text. If that's a problem, use an authenticating proxy and the trusted header authentication approach. * Refactor module locations * Rename "serverroute" module type to "route" * Remove support for verifying optional named command parameters The idea was to be able to flag unknown parameter names, but requiring a command to pre-specify all the parameter names makes it harder for (say) the listen command to be extensible so that plugins can add new optional parameters that they handle. (This is particularly in the context of work in progress to encapsulate authenticators into their own modules). * Refactor the two authenticators into separate modules and add support for authorization * Correct mistaken path.join vs. path.resolve See https://stackoverflow.com/a/39836259 * Docs for the named command parameters I'd be grateful if anyone with sufficient Windows experience could confirm that the note about double quotes in "NamedCommandParameters" is correct. * Be consistent about lower case parameter names * Do the right thing when we have a username but no password With a username parameter but no password parameter we'll attribute edits to that username, but not require authentication. * Remove obsolete code * Add support for requiring authentication without restricting the username * Refactor authorization checks * Return read_only status in /status response * Fix two code typos * Add basic support for detecting readonly status and avoiding write errors We now have syncadaptors returning readonly status and avoid attempting to write to the server if it's going to fail * Add readonly-styles We hide editing-related buttons in read only mode I've made this part of the tiddlyweb plugin but I think a case could be made for putting it into the core. * Add custom request header as CSRF mitigation By default we require the header X-Requested-With to be set to TiddlyWiki. Can be overriden by setting csrfdisable to "yes" See https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Protecting_REST_Services:_Use_of_Custom_Request_Headers * Add support for HTTPS * First pass at a route for serving rendered tiddlers cc @Drakor * Tweaks to the single tiddler static view Adding a simple sidebar * Switch to "dash" separated parameter names * Typo * Docs: Update ServerCommand and ListenCommand * First pass at docs for the new web server stuff Writing the docs is turning out to be quite an undertaking, much harder than writing the code! * Get rid of extraneous paragraphs in static renderings * Rejig anonymous user handling Now we can support wikis that are read-only for anonymous access, but allow a user to login for read/write access. * More docs Slowly getting there... * Static tiddler rendering: Fix HTML content in page title * Docs updates * Fix server command parameter names Missed off 30ce7ea * Docs: Missing quotes * Avoid inadvertent dependency on Node.js > v9.6.0 The listenOptions parameter of the plain HTTP version of CreateServer was only introduced in v9.6.0 cc @Drakor @pmario * Typo
2018-07-18 15:54:43 +00:00
var json = null;
try {
json = JSON.parse(data);
} catch (e) {
}
if(json) {
self.logger.log("Status:",data);
// Record the recipe
if(json.space) {
self.recipe = json.space.recipe;
}
// Check if we're logged in
Module-ize server routes, add static file support and other enhancements(#2679) * Module-ize server routes and add static file support (#2510) * Refactor server routes to modules New module type: serverroute Caveats: Loading order is not deterministic but this would only matter if two route modules attempted to use the same path regexp (that would be silly). * Add static assets plugin This plugin allows the node server to fetch static assets in the /assets directory. I felt that this was a feature that goes above the core functionality. That is why I added it as a plugin. with the modular route extensions this was a breeze. * Add serverroute description to ModuleTypes * Coding standards tweaks * Fix filename typo * Move support for attachments from a plugin into the core * Missing "else" * Refactor server handling * Introduce a new named parameter scheme for commands * Move the SimpleServer class into it's own module * Deprecate the --server command because of the unwieldy syntax * Add a new --listen command using the new syntax For example: tiddlywiki mywiki --listen host:0.0.0.0 port:8090 * Add check for unknown parameters * Add support for multiple basic authentication credentials in a CSV file Beware: Passwords are stored in plain text. If that's a problem, use an authenticating proxy and the trusted header authentication approach. * Refactor module locations * Rename "serverroute" module type to "route" * Remove support for verifying optional named command parameters The idea was to be able to flag unknown parameter names, but requiring a command to pre-specify all the parameter names makes it harder for (say) the listen command to be extensible so that plugins can add new optional parameters that they handle. (This is particularly in the context of work in progress to encapsulate authenticators into their own modules). * Refactor the two authenticators into separate modules and add support for authorization * Correct mistaken path.join vs. path.resolve See https://stackoverflow.com/a/39836259 * Docs for the named command parameters I'd be grateful if anyone with sufficient Windows experience could confirm that the note about double quotes in "NamedCommandParameters" is correct. * Be consistent about lower case parameter names * Do the right thing when we have a username but no password With a username parameter but no password parameter we'll attribute edits to that username, but not require authentication. * Remove obsolete code * Add support for requiring authentication without restricting the username * Refactor authorization checks * Return read_only status in /status response * Fix two code typos * Add basic support for detecting readonly status and avoiding write errors We now have syncadaptors returning readonly status and avoid attempting to write to the server if it's going to fail * Add readonly-styles We hide editing-related buttons in read only mode I've made this part of the tiddlyweb plugin but I think a case could be made for putting it into the core. * Add custom request header as CSRF mitigation By default we require the header X-Requested-With to be set to TiddlyWiki. Can be overriden by setting csrfdisable to "yes" See https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Protecting_REST_Services:_Use_of_Custom_Request_Headers * Add support for HTTPS * First pass at a route for serving rendered tiddlers cc @Drakor * Tweaks to the single tiddler static view Adding a simple sidebar * Switch to "dash" separated parameter names * Typo * Docs: Update ServerCommand and ListenCommand * First pass at docs for the new web server stuff Writing the docs is turning out to be quite an undertaking, much harder than writing the code! * Get rid of extraneous paragraphs in static renderings * Rejig anonymous user handling Now we can support wikis that are read-only for anonymous access, but allow a user to login for read/write access. * More docs Slowly getting there... * Static tiddler rendering: Fix HTML content in page title * Docs updates * Fix server command parameter names Missed off 30ce7ea * Docs: Missing quotes * Avoid inadvertent dependency on Node.js > v9.6.0 The listenOptions parameter of the plain HTTP version of CreateServer was only introduced in v9.6.0 cc @Drakor @pmario * Typo
2018-07-18 15:54:43 +00:00
self.isLoggedIn = json.username !== "GUEST";
self.isReadOnly = !!json["read_only"];
self.isAnonymous = !!json.anonymous;
}
// Invoke the callback if present
if(callback) {
Module-ize server routes, add static file support and other enhancements(#2679) * Module-ize server routes and add static file support (#2510) * Refactor server routes to modules New module type: serverroute Caveats: Loading order is not deterministic but this would only matter if two route modules attempted to use the same path regexp (that would be silly). * Add static assets plugin This plugin allows the node server to fetch static assets in the /assets directory. I felt that this was a feature that goes above the core functionality. That is why I added it as a plugin. with the modular route extensions this was a breeze. * Add serverroute description to ModuleTypes * Coding standards tweaks * Fix filename typo * Move support for attachments from a plugin into the core * Missing "else" * Refactor server handling * Introduce a new named parameter scheme for commands * Move the SimpleServer class into it's own module * Deprecate the --server command because of the unwieldy syntax * Add a new --listen command using the new syntax For example: tiddlywiki mywiki --listen host:0.0.0.0 port:8090 * Add check for unknown parameters * Add support for multiple basic authentication credentials in a CSV file Beware: Passwords are stored in plain text. If that's a problem, use an authenticating proxy and the trusted header authentication approach. * Refactor module locations * Rename "serverroute" module type to "route" * Remove support for verifying optional named command parameters The idea was to be able to flag unknown parameter names, but requiring a command to pre-specify all the parameter names makes it harder for (say) the listen command to be extensible so that plugins can add new optional parameters that they handle. (This is particularly in the context of work in progress to encapsulate authenticators into their own modules). * Refactor the two authenticators into separate modules and add support for authorization * Correct mistaken path.join vs. path.resolve See https://stackoverflow.com/a/39836259 * Docs for the named command parameters I'd be grateful if anyone with sufficient Windows experience could confirm that the note about double quotes in "NamedCommandParameters" is correct. * Be consistent about lower case parameter names * Do the right thing when we have a username but no password With a username parameter but no password parameter we'll attribute edits to that username, but not require authentication. * Remove obsolete code * Add support for requiring authentication without restricting the username * Refactor authorization checks * Return read_only status in /status response * Fix two code typos * Add basic support for detecting readonly status and avoiding write errors We now have syncadaptors returning readonly status and avoid attempting to write to the server if it's going to fail * Add readonly-styles We hide editing-related buttons in read only mode I've made this part of the tiddlyweb plugin but I think a case could be made for putting it into the core. * Add custom request header as CSRF mitigation By default we require the header X-Requested-With to be set to TiddlyWiki. Can be overriden by setting csrfdisable to "yes" See https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Protecting_REST_Services:_Use_of_Custom_Request_Headers * Add support for HTTPS * First pass at a route for serving rendered tiddlers cc @Drakor * Tweaks to the single tiddler static view Adding a simple sidebar * Switch to "dash" separated parameter names * Typo * Docs: Update ServerCommand and ListenCommand * First pass at docs for the new web server stuff Writing the docs is turning out to be quite an undertaking, much harder than writing the code! * Get rid of extraneous paragraphs in static renderings * Rejig anonymous user handling Now we can support wikis that are read-only for anonymous access, but allow a user to login for read/write access. * More docs Slowly getting there... * Static tiddler rendering: Fix HTML content in page title * Docs updates * Fix server command parameter names Missed off 30ce7ea * Docs: Missing quotes * Avoid inadvertent dependency on Node.js > v9.6.0 The listenOptions parameter of the plain HTTP version of CreateServer was only introduced in v9.6.0 cc @Drakor @pmario * Typo
2018-07-18 15:54:43 +00:00
callback(null,self.isLoggedIn,json.username,self.isReadOnly,self.isAnonymous);
}
}
});
};
/*
Attempt to login and invoke the callback(err)
*/
TiddlyWebAdaptor.prototype.login = function(username,password,callback) {
2014-01-26 20:59:30 +00:00
var options = {
url: this.host + "challenge/tiddlywebplugins.tiddlyspace.cookie_form",
type: "POST",
data: {
user: username,
password: password,
tiddlyweb_redirect: "/status" // workaround to marginalize automatic subsequent GET
},
callback: function(err) {
callback(err);
}
2014-01-26 20:59:30 +00:00
};
this.logger.log("Logging in:",options);
2014-01-26 20:59:30 +00:00
$tw.utils.httpRequest(options);
};
/*
*/
TiddlyWebAdaptor.prototype.logout = function(callback) {
2014-01-26 20:59:30 +00:00
var options = {
url: this.host + "logout",
type: "POST",
data: {
csrf_token: this.getCsrfToken(),
tiddlyweb_redirect: "/status" // workaround to marginalize automatic subsequent GET
},
callback: function(err,data) {
callback(err);
}
2014-01-26 20:59:30 +00:00
};
this.logger.log("Logging out:",options);
2014-01-26 20:59:30 +00:00
$tw.utils.httpRequest(options);
};
/*
Retrieve the CSRF token from its cookie
*/
TiddlyWebAdaptor.prototype.getCsrfToken = function() {
var regex = /^(?:.*; )?csrf_token=([^(;|$)]*)(?:;|$)/,
match = regex.exec(document.cookie),
csrf = null;
if (match && (match.length === 2)) {
csrf = match[1];
}
return csrf;
};
/*
Get an array of skinny tiddler fields from the server
*/
TiddlyWebAdaptor.prototype.getSkinnyTiddlers = function(callback) {
2013-11-08 20:18:26 +00:00
var self = this;
$tw.utils.httpRequest({
url: this.host + "recipes/" + this.recipe + "/tiddlers.json",
callback: function(err,data) {
// Check for errors
if(err) {
return callback(err);
}
// Process the tiddlers to make sure the revision is a string
var tiddlers = JSON.parse(data);
for(var t=0; t<tiddlers.length; t++) {
tiddlers[t] = self.convertTiddlerFromTiddlyWebFormat(tiddlers[t]);
}
// Invoke the callback with the skinny tiddlers
callback(null,tiddlers);
}
});
};
/*
Save a tiddler and invoke the callback with (err,adaptorInfo,revision)
*/
TiddlyWebAdaptor.prototype.saveTiddler = function(tiddler,callback) {
var self = this;
Module-ize server routes, add static file support and other enhancements(#2679) * Module-ize server routes and add static file support (#2510) * Refactor server routes to modules New module type: serverroute Caveats: Loading order is not deterministic but this would only matter if two route modules attempted to use the same path regexp (that would be silly). * Add static assets plugin This plugin allows the node server to fetch static assets in the /assets directory. I felt that this was a feature that goes above the core functionality. That is why I added it as a plugin. with the modular route extensions this was a breeze. * Add serverroute description to ModuleTypes * Coding standards tweaks * Fix filename typo * Move support for attachments from a plugin into the core * Missing "else" * Refactor server handling * Introduce a new named parameter scheme for commands * Move the SimpleServer class into it's own module * Deprecate the --server command because of the unwieldy syntax * Add a new --listen command using the new syntax For example: tiddlywiki mywiki --listen host:0.0.0.0 port:8090 * Add check for unknown parameters * Add support for multiple basic authentication credentials in a CSV file Beware: Passwords are stored in plain text. If that's a problem, use an authenticating proxy and the trusted header authentication approach. * Refactor module locations * Rename "serverroute" module type to "route" * Remove support for verifying optional named command parameters The idea was to be able to flag unknown parameter names, but requiring a command to pre-specify all the parameter names makes it harder for (say) the listen command to be extensible so that plugins can add new optional parameters that they handle. (This is particularly in the context of work in progress to encapsulate authenticators into their own modules). * Refactor the two authenticators into separate modules and add support for authorization * Correct mistaken path.join vs. path.resolve See https://stackoverflow.com/a/39836259 * Docs for the named command parameters I'd be grateful if anyone with sufficient Windows experience could confirm that the note about double quotes in "NamedCommandParameters" is correct. * Be consistent about lower case parameter names * Do the right thing when we have a username but no password With a username parameter but no password parameter we'll attribute edits to that username, but not require authentication. * Remove obsolete code * Add support for requiring authentication without restricting the username * Refactor authorization checks * Return read_only status in /status response * Fix two code typos * Add basic support for detecting readonly status and avoiding write errors We now have syncadaptors returning readonly status and avoid attempting to write to the server if it's going to fail * Add readonly-styles We hide editing-related buttons in read only mode I've made this part of the tiddlyweb plugin but I think a case could be made for putting it into the core. * Add custom request header as CSRF mitigation By default we require the header X-Requested-With to be set to TiddlyWiki. Can be overriden by setting csrfdisable to "yes" See https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Protecting_REST_Services:_Use_of_Custom_Request_Headers * Add support for HTTPS * First pass at a route for serving rendered tiddlers cc @Drakor * Tweaks to the single tiddler static view Adding a simple sidebar * Switch to "dash" separated parameter names * Typo * Docs: Update ServerCommand and ListenCommand * First pass at docs for the new web server stuff Writing the docs is turning out to be quite an undertaking, much harder than writing the code! * Get rid of extraneous paragraphs in static renderings * Rejig anonymous user handling Now we can support wikis that are read-only for anonymous access, but allow a user to login for read/write access. * More docs Slowly getting there... * Static tiddler rendering: Fix HTML content in page title * Docs updates * Fix server command parameter names Missed off 30ce7ea * Docs: Missing quotes * Avoid inadvertent dependency on Node.js > v9.6.0 The listenOptions parameter of the plain HTTP version of CreateServer was only introduced in v9.6.0 cc @Drakor @pmario * Typo
2018-07-18 15:54:43 +00:00
if(this.isReadOnly) {
return callback(null);
}
$tw.utils.httpRequest({
url: this.host + "recipes/" + encodeURIComponent(this.recipe) + "/tiddlers/" + encodeURIComponent(tiddler.fields.title),
type: "PUT",
headers: {
"Content-type": "application/json"
},
data: this.convertTiddlerToTiddlyWebFormat(tiddler),
callback: function(err,data,request) {
if(err) {
return callback(err);
}
// Save the details of the new revision of the tiddler
var etagInfo = self.parseEtag(request.getResponseHeader("Etag"));
// Invoke the callback
callback(null,{
bag: etagInfo.bag
}, etagInfo.revision);
}
});
};
/*
Load a tiddler and invoke the callback with (err,tiddlerFields)
*/
TiddlyWebAdaptor.prototype.loadTiddler = function(title,callback) {
var self = this;
$tw.utils.httpRequest({
url: this.host + "recipes/" + encodeURIComponent(this.recipe) + "/tiddlers/" + encodeURIComponent(title),
callback: function(err,data,request) {
if(err) {
return callback(err);
}
// Invoke the callback
2013-11-08 20:18:26 +00:00
callback(null,self.convertTiddlerFromTiddlyWebFormat(JSON.parse(data)));
}
});
};
/*
Delete a tiddler and invoke the callback with (err)
options include:
tiddlerInfo: the syncer's tiddlerInfo for this tiddler
*/
TiddlyWebAdaptor.prototype.deleteTiddler = function(title,callback,options) {
Module-ize server routes, add static file support and other enhancements(#2679) * Module-ize server routes and add static file support (#2510) * Refactor server routes to modules New module type: serverroute Caveats: Loading order is not deterministic but this would only matter if two route modules attempted to use the same path regexp (that would be silly). * Add static assets plugin This plugin allows the node server to fetch static assets in the /assets directory. I felt that this was a feature that goes above the core functionality. That is why I added it as a plugin. with the modular route extensions this was a breeze. * Add serverroute description to ModuleTypes * Coding standards tweaks * Fix filename typo * Move support for attachments from a plugin into the core * Missing "else" * Refactor server handling * Introduce a new named parameter scheme for commands * Move the SimpleServer class into it's own module * Deprecate the --server command because of the unwieldy syntax * Add a new --listen command using the new syntax For example: tiddlywiki mywiki --listen host:0.0.0.0 port:8090 * Add check for unknown parameters * Add support for multiple basic authentication credentials in a CSV file Beware: Passwords are stored in plain text. If that's a problem, use an authenticating proxy and the trusted header authentication approach. * Refactor module locations * Rename "serverroute" module type to "route" * Remove support for verifying optional named command parameters The idea was to be able to flag unknown parameter names, but requiring a command to pre-specify all the parameter names makes it harder for (say) the listen command to be extensible so that plugins can add new optional parameters that they handle. (This is particularly in the context of work in progress to encapsulate authenticators into their own modules). * Refactor the two authenticators into separate modules and add support for authorization * Correct mistaken path.join vs. path.resolve See https://stackoverflow.com/a/39836259 * Docs for the named command parameters I'd be grateful if anyone with sufficient Windows experience could confirm that the note about double quotes in "NamedCommandParameters" is correct. * Be consistent about lower case parameter names * Do the right thing when we have a username but no password With a username parameter but no password parameter we'll attribute edits to that username, but not require authentication. * Remove obsolete code * Add support for requiring authentication without restricting the username * Refactor authorization checks * Return read_only status in /status response * Fix two code typos * Add basic support for detecting readonly status and avoiding write errors We now have syncadaptors returning readonly status and avoid attempting to write to the server if it's going to fail * Add readonly-styles We hide editing-related buttons in read only mode I've made this part of the tiddlyweb plugin but I think a case could be made for putting it into the core. * Add custom request header as CSRF mitigation By default we require the header X-Requested-With to be set to TiddlyWiki. Can be overriden by setting csrfdisable to "yes" See https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Protecting_REST_Services:_Use_of_Custom_Request_Headers * Add support for HTTPS * First pass at a route for serving rendered tiddlers cc @Drakor * Tweaks to the single tiddler static view Adding a simple sidebar * Switch to "dash" separated parameter names * Typo * Docs: Update ServerCommand and ListenCommand * First pass at docs for the new web server stuff Writing the docs is turning out to be quite an undertaking, much harder than writing the code! * Get rid of extraneous paragraphs in static renderings * Rejig anonymous user handling Now we can support wikis that are read-only for anonymous access, but allow a user to login for read/write access. * More docs Slowly getting there... * Static tiddler rendering: Fix HTML content in page title * Docs updates * Fix server command parameter names Missed off 30ce7ea * Docs: Missing quotes * Avoid inadvertent dependency on Node.js > v9.6.0 The listenOptions parameter of the plain HTTP version of CreateServer was only introduced in v9.6.0 cc @Drakor @pmario * Typo
2018-07-18 15:54:43 +00:00
var self = this;
if(this.isReadOnly) {
return callback(null);
}
2014-01-26 20:59:30 +00:00
// If we don't have a bag it means that the tiddler hasn't been seen by the server, so we don't need to delete it
Module-ize server routes, add static file support and other enhancements(#2679) * Module-ize server routes and add static file support (#2510) * Refactor server routes to modules New module type: serverroute Caveats: Loading order is not deterministic but this would only matter if two route modules attempted to use the same path regexp (that would be silly). * Add static assets plugin This plugin allows the node server to fetch static assets in the /assets directory. I felt that this was a feature that goes above the core functionality. That is why I added it as a plugin. with the modular route extensions this was a breeze. * Add serverroute description to ModuleTypes * Coding standards tweaks * Fix filename typo * Move support for attachments from a plugin into the core * Missing "else" * Refactor server handling * Introduce a new named parameter scheme for commands * Move the SimpleServer class into it's own module * Deprecate the --server command because of the unwieldy syntax * Add a new --listen command using the new syntax For example: tiddlywiki mywiki --listen host:0.0.0.0 port:8090 * Add check for unknown parameters * Add support for multiple basic authentication credentials in a CSV file Beware: Passwords are stored in plain text. If that's a problem, use an authenticating proxy and the trusted header authentication approach. * Refactor module locations * Rename "serverroute" module type to "route" * Remove support for verifying optional named command parameters The idea was to be able to flag unknown parameter names, but requiring a command to pre-specify all the parameter names makes it harder for (say) the listen command to be extensible so that plugins can add new optional parameters that they handle. (This is particularly in the context of work in progress to encapsulate authenticators into their own modules). * Refactor the two authenticators into separate modules and add support for authorization * Correct mistaken path.join vs. path.resolve See https://stackoverflow.com/a/39836259 * Docs for the named command parameters I'd be grateful if anyone with sufficient Windows experience could confirm that the note about double quotes in "NamedCommandParameters" is correct. * Be consistent about lower case parameter names * Do the right thing when we have a username but no password With a username parameter but no password parameter we'll attribute edits to that username, but not require authentication. * Remove obsolete code * Add support for requiring authentication without restricting the username * Refactor authorization checks * Return read_only status in /status response * Fix two code typos * Add basic support for detecting readonly status and avoiding write errors We now have syncadaptors returning readonly status and avoid attempting to write to the server if it's going to fail * Add readonly-styles We hide editing-related buttons in read only mode I've made this part of the tiddlyweb plugin but I think a case could be made for putting it into the core. * Add custom request header as CSRF mitigation By default we require the header X-Requested-With to be set to TiddlyWiki. Can be overriden by setting csrfdisable to "yes" See https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Protecting_REST_Services:_Use_of_Custom_Request_Headers * Add support for HTTPS * First pass at a route for serving rendered tiddlers cc @Drakor * Tweaks to the single tiddler static view Adding a simple sidebar * Switch to "dash" separated parameter names * Typo * Docs: Update ServerCommand and ListenCommand * First pass at docs for the new web server stuff Writing the docs is turning out to be quite an undertaking, much harder than writing the code! * Get rid of extraneous paragraphs in static renderings * Rejig anonymous user handling Now we can support wikis that are read-only for anonymous access, but allow a user to login for read/write access. * More docs Slowly getting there... * Static tiddler rendering: Fix HTML content in page title * Docs updates * Fix server command parameter names Missed off 30ce7ea * Docs: Missing quotes * Avoid inadvertent dependency on Node.js > v9.6.0 The listenOptions parameter of the plain HTTP version of CreateServer was only introduced in v9.6.0 cc @Drakor @pmario * Typo
2018-07-18 15:54:43 +00:00
var bag = options.tiddlerInfo.adaptorInfo.bag;
2014-01-26 20:59:30 +00:00
if(!bag) {
return callback(null);
}
// Issue HTTP request to delete the tiddler
$tw.utils.httpRequest({
url: this.host + "bags/" + encodeURIComponent(bag) + "/tiddlers/" + encodeURIComponent(title),
type: "DELETE",
callback: function(err,data,request) {
if(err) {
return callback(err);
}
// Invoke the callback
callback(null);
}
});
};
/*
Convert a tiddler to a field set suitable for PUTting to TiddlyWeb
*/
TiddlyWebAdaptor.prototype.convertTiddlerToTiddlyWebFormat = function(tiddler) {
var result = {},
knownFields = [
"bag", "created", "creator", "modified", "modifier", "permissions", "recipe", "revision", "tags", "text", "title", "type", "uri"
];
if(tiddler) {
$tw.utils.each(tiddler.fields,function(fieldValue,fieldName) {
var fieldString = fieldName === "tags" ?
tiddler.fields.tags :
tiddler.getFieldString(fieldName); // Tags must be passed as an array, not a string
if(knownFields.indexOf(fieldName) !== -1) {
// If it's a known field, just copy it across
result[fieldName] = fieldString;
} else {
// If it's unknown, put it in the "fields" field
result.fields = result.fields || {};
result.fields[fieldName] = fieldString;
}
});
}
// Default the content type
2013-11-08 20:18:26 +00:00
result.type = result.type || "text/vnd.tiddlywiki";
return JSON.stringify(result,null,$tw.config.preferences.jsonSpaces);
};
/*
Convert a field set in TiddlyWeb format into ordinary TiddlyWiki5 format
*/
2013-11-08 20:18:26 +00:00
TiddlyWebAdaptor.prototype.convertTiddlerFromTiddlyWebFormat = function(tiddlerFields) {
var self = this,
result = {};
// Transfer the fields, pulling down the `fields` hashmap
$tw.utils.each(tiddlerFields,function(element,title,object) {
if(title === "fields") {
$tw.utils.each(element,function(element,subTitle,object) {
result[subTitle] = element;
});
} else {
result[title] = tiddlerFields[title];
}
});
// Make sure the revision is expressed as a string
if(typeof result.revision === "number") {
result.revision = result.revision.toString();
}
// Some unholy freaking of content types
if(result.type === "text/javascript") {
result.type = "application/javascript";
} else if(!result.type || result.type === "None") {
result.type = "text/x-tiddlywiki";
}
return result;
};
/*
Split a TiddlyWeb Etag into its constituent parts. For example:
```
"system-images_public/unsyncedIcon/946151:9f11c278ccde3a3149f339f4a1db80dd4369fc04"
```
Note that the value includes the opening and closing double quotes.
The parts are:
```
<bag>/<title>/<revision>:<hash>
```
*/
TiddlyWebAdaptor.prototype.parseEtag = function(etag) {
var firstSlash = etag.indexOf("/"),
lastSlash = etag.lastIndexOf("/"),
colon = etag.lastIndexOf(":");
if(firstSlash === -1 || lastSlash === -1 || colon === -1) {
return null;
} else {
return {
bag: decodeURIComponent(etag.substring(1,firstSlash)),
title: decodeURIComponent(etag.substring(firstSlash + 1,lastSlash)),
revision: etag.substring(lastSlash + 1,colon)
};
}
};
if($tw.browser && document.location.protocol.substr(0,4) === "http" ) {
exports.adaptorClass = TiddlyWebAdaptor;
}
})();