NodeBB/src/socket.io/posts/tools.js

'use strict';

const nconf = require('nconf');

const db = require('../../database');
const posts = require('../../posts');
const flags = require('../../flags');
const events = require('../../events');
const privileges = require('../../privileges');
const plugins = require('../../plugins');
const social = require('../../social');
const user = require('../../user');
const utils = require('../../utils');

module.exports = function (SocketPosts) {
	SocketPosts.loadPostTools = async function (socket, data) {
		if (!data || !data.pid) {
			throw new Error('[[error:invalid-data]]');
		}
		const cid = await posts.getCidByPid(data.pid);
		const results = await utils.promiseParallel({
			posts: posts.getPostFields(data.pid, ['deleted', 'bookmarks', 'uid', 'ip', 'flagId']),
			isAdmin: user.isAdministrator(socket.uid),
			isGlobalMod: user.isGlobalModerator(socket.uid),
			isModerator: user.isModerator(socket.uid, cid),
			canEdit: privileges.posts.canEdit(data.pid, socket.uid),
			canDelete: privileges.posts.canDelete(data.pid, socket.uid),
			canPurge: privileges.posts.canPurge(data.pid, socket.uid),
			canFlag: privileges.posts.canFlag(data.pid, socket.uid),
			canViewHistory: privileges.posts.can('posts:history', data.pid, socket.uid),
			flagged: flags.exists('post', data.pid, socket.uid), // specifically, whether THIS calling user flagged
			bookmarked: posts.hasBookmarked(data.pid, socket.uid),
			postSharing: social.getActivePostSharing(),
			history: posts.diffs.exists(data.pid),
			canViewInfo: privileges.global.can('view:users:info', socket.uid),
		});

		const postData = results.posts;
		postData.absolute_url = `${nconf.get('url')}/post/${data.pid}`;
		postData.bookmarked = results.bookmarked;
		postData.selfPost = socket.uid && socket.uid === postData.uid;
		postData.display_edit_tools = results.canEdit.flag;
		postData.display_delete_tools = results.canDelete.flag;
		postData.display_purge_tools = results.canPurge;
		postData.display_flag_tools = socket.uid && results.canFlag.flag;
		postData.display_moderator_tools = postData.display_edit_tools || postData.display_delete_tools;
		postData.display_move_tools = results.isAdmin || results.isModerator;
		postData.display_change_owner_tools = results.isAdmin || results.isModerator;
		postData.display_manage_editors_tools = results.isAdmin || results.isModerator || postData.selfPost;
		postData.display_ip_ban = (results.isAdmin || results.isGlobalMod) && !postData.selfPost;
		postData.display_history = results.history && results.canViewHistory;
		postData.flags = {
			flagId: parseInt(results.posts.flagId, 10) || null,
			can: results.canFlag.flag,
			exists: !!results.posts.flagId,
			flagged: results.flagged,
			state: await db.getObjectField(`flag:${postData.flagId}`, 'state'),
		};

		if (!results.isAdmin && !results.canViewInfo) {
			postData.ip = undefined;
		}
		const { tools } = await plugins.hooks.fire('filter:post.tools', {
			pid: data.pid,
			post: postData,
			uid: socket.uid,
			tools: [],
		});
		postData.tools = tools;

		return results;
	};

	SocketPosts.changeOwner = async function (socket, data) {
		if (!data || !Array.isArray(data.pids) || !data.toUid) {
			throw new Error('[[error:invalid-data]]');
		}
		const isAdminOrGlobalMod = await user.isAdminOrGlobalMod(socket.uid);
		if (!isAdminOrGlobalMod) {
			throw new Error('[[error:no-privileges]]');
		}

		const postData = await posts.changeOwner(data.pids, data.toUid);
		const logs = postData.map(({ pid, uid, cid }) => (events.log({
			type: 'post-change-owner',
			uid: socket.uid,
			ip: socket.ip,
			targetUid: data.toUid,
			pid: pid,
			originalUid: uid,
			cid: cid,
		})));

		await Promise.all(logs);
	};

	SocketPosts.getEditors = async function (socket, data) {
		if (!data || !data.pid) {
			throw new Error('[[error:invalid-data]]');
		}
		await checkEditorPrivilege(socket.uid, data.pid);
		const editorUids = await db.getSetMembers(`pid:${data.pid}:editors`);
		const userData = await user.getUsersFields(editorUids, ['username', 'userslug', 'picture']);
		return userData;
	};

	SocketPosts.saveEditors = async function (socket, data) {
		if (!data || !data.pid || !Array.isArray(data.uids)) {
			throw new Error('[[error:invalid-data]]');
		}
		await checkEditorPrivilege(socket.uid, data.pid);
		await db.delete(`pid:${data.pid}:editors`);
		await db.setAdd(`pid:${data.pid}:editors`, data.uids);
	};

	async function checkEditorPrivilege(uid, pid) {
		const cid = await posts.getCidByPid(pid);
		const [isAdminOrMod, owner] = await Promise.all([
			privileges.categories.isAdminOrMod(cid, uid),
			posts.getPostField(pid, 'uid'),
		]);
		const isSelfPost = String(uid) === String(owner);
		if (!isAdminOrMod && !isSelfPost) {
			throw new Error('[[error:no-privileges]]');
		}
	}
};