* Module-ize server routes and add static file support (#2510)
* Refactor server routes to modules
New module type: serverroute
Caveats: Loading order is not deterministic but this would only matter
if two route modules attempted to use the same path regexp (that would
be silly).
* Add static assets plugin
This plugin allows the node server to fetch static assets in the /assets
directory. I felt that this was a feature that goes above the core
functionality. That is why I added it as a plugin. with the modular
route extensions this was a breeze.
* Add serverroute description to ModuleTypes
* Coding standards tweaks
* Fix filename typo
* Move support for attachments from a plugin into the core
* Missing "else"
* Refactor server handling
* Introduce a new named parameter scheme for commands
* Move the SimpleServer class into it's own module
* Deprecate the --server command because of the unwieldy syntax
* Add a new --listen command using the new syntax
For example:
tiddlywiki mywiki --listen host:0.0.0.0 port:8090
* Add check for unknown parameters
* Add support for multiple basic authentication credentials in a CSV file
Beware: Passwords are stored in plain text. If that's a problem, use an authenticating proxy and the trusted header authentication approach.
* Refactor module locations
* Rename "serverroute" module type to "route"
* Remove support for verifying optional named command parameters
The idea was to be able to flag unknown parameter names, but requiring a command to pre-specify all the parameter names makes it harder for (say) the listen command to be extensible so that plugins can add new optional parameters that they handle. (This is particularly in the context of work in progress to encapsulate authenticators into their own modules).
* Refactor the two authenticators into separate modules and add support for authorization
* Correct mistaken path.join vs. path.resolve
See https://stackoverflow.com/a/39836259
* Docs for the named command parameters
I'd be grateful if anyone with sufficient Windows experience could confirm that the note about double quotes in "NamedCommandParameters" is correct.
* Be consistent about lower case parameter names
* Do the right thing when we have a username but no password
With a username parameter but no password parameter we'll attribute edits to that username, but not require authentication.
* Remove obsolete code
* Add support for requiring authentication without restricting the username
* Refactor authorization checks
* Return read_only status in /status response
* Fix two code typos
* Add basic support for detecting readonly status and avoiding write errors
We now have syncadaptors returning readonly status and avoid attempting to write to the server if it's going to fail
* Add readonly-styles
We hide editing-related buttons in read only mode
I've made this part of the tiddlyweb plugin but I think a case could be made for putting it into the core.
* Add custom request header as CSRF mitigation
By default we require the header X-Requested-With to be set to TiddlyWiki. Can be overriden by setting csrfdisable to "yes"
See https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Protecting_REST_Services:_Use_of_Custom_Request_Headers
* Add support for HTTPS
* First pass at a route for serving rendered tiddlers
cc @Drakor
* Tweaks to the single tiddler static view
Adding a simple sidebar
* Switch to "dash" separated parameter names
* Typo
* Docs: Update ServerCommand and ListenCommand
* First pass at docs for the new web server stuff
Writing the docs is turning out to be quite an undertaking, much harder than writing the code!
* Get rid of extraneous paragraphs in static renderings
* Rejig anonymous user handling
Now we can support wikis that are read-only for anonymous access, but allow a user to login for read/write access.
* More docs
Slowly getting there...
* Static tiddler rendering: Fix HTML content in page title
* Docs updates
* Fix server command parameter names
Missed off 30ce7ea
* Docs: Missing quotes
* Avoid inadvertent dependency on Node.js > v9.6.0
The listenOptions parameter of the plain HTTP version of CreateServer was only introduced in v9.6.0
cc @Drakor @pmario
* Typo
* add option to configure new tiddler title
there may be users that don't like to see the word tiddler everywhere
this makes changing titles easier to access
* controlpanel - basics - new tiddler title prompt
* controlpanel-basics- newtiddler title prompt
* controlpanel - basics - new tiddler prompt
* fr-FR translation of additional error strings
* include SaveTrail
* Amendments to the warnings upon loading content via _canonical_uri
* Typo: add a missing THE
* Clarification on why the browser might refuse to load external content
A first pass at fixing #2973 - comments are welcome. If everybody is
happy, the next step is to deprecate the existing
rendertiddler(s)/savetiddler(s) commands and replace them in all
examples and tiddlywiki.info files with the new equivalents.
* provides a "close plugin library" button
* starting from #1718 by @inmysocks
* possibly fixes all of #1718, #1597, and #2067
* corrected code comment
* add back title
No idea why I overlooked this beforehand.
Next time I will not suggest such changes that have little to do with
the PR, but rather just comment the code.
* ah, sorry, "fixed" wrong spot
now
```
<$action-sendmessage $message="tm-load-plugin-from-library"
url={{!!url}} title={{$(assetInfo)$!!original-title}}/>
```
...should be back at the right spot.
* mhhh... still fixing the mess
load, unload, puh... let's see if I got it now
* added unloadIFrame and minor syntax fixes
Like the load command except retrieves the file over HTTP/HTTPS.
Allows experimentation with server-side twederation
This is a cleaned up version of code that I wrote last year at TWEUM
2016 @inmysocks @pmario @twMat @xcazin
* putSaver: detect edit conflicts to prevent clobbering, if possible
if the server supplies an ETag, we send it back when saving, allowing
the server to detect edit conflicts and respond with 412 (cf.
https://www.w3.org/1999/04/Editing/)
caveats:
* this only kicks in after the first save, as we don't have access to
the ETag when first loading the document
* there's no recovery mechanism (e.g. resetting `this.etag` in order to
force clobbering), other than manually reloading the document
* putSaver: retrieve ETag upon initialization for clobbering protection
this addresses one of the caveats from the previous commit
(2d75cb83af) - while theoretically prone
to a race condition, it seems unlikely that saving will be triggered
before the server responds
* putSaver: simplify URI extraction
this simplifies the approach introduced in
f51f6bf774, with the purpose of removing
the fragment identifier
* putSaver: localize error message
* putSaver: switch to built-in HTTP helper
in the process, fixed ETag assignment in `#save` method (was
`this.etag`, now `self.etag`) as well as a syntax error due to a missing
closing brace
* putSaver: consolidate URI handling
When renaming an existing tiddler, the edit template now shows a
checkbox that determines whether or not to relink references to the
tiddler in the list or tags fields of other tiddlers.
