From dc470fd131fa4d9200c6e37c9d1158f0824de36c Mon Sep 17 00:00:00 2001 From: Jack Date: Sat, 21 Oct 2017 15:10:24 -0400 Subject: [PATCH 1/4] Finish keyInfo modal and API routes --- app/public/css/panel.css | 139 ++++++++++++++++++++++++++++---- app/public/panel/controllers/ApiCtrl.js | 25 ++++++ app/public/services/ApiSvc.js | 17 ++++ app/routes/keys.js | 6 ++ public/views/panel/api.html | 65 ++++++++++----- 5 files changed, 217 insertions(+), 35 deletions(-) diff --git a/app/public/css/panel.css b/app/public/css/panel.css index 7930aab..0010830 100644 --- a/app/public/css/panel.css +++ b/app/public/css/panel.css @@ -200,35 +200,140 @@ body { user-select: none; } -.modal { +.key-name { + color: #2a9fd6; + font-family: 'Roboto Mono', monospace; +} + +pre { + overflow: auto; + line-height: 1.7em; + font-family: 'Roboto Mono', monospace; + border: 1px solid #666; + border-radius: 4px; display: block; + padding: 10px; + font-size: 14px; + margin: 10px 0; + background: #222; + color: #2a9fd6; +} + +.modal, +.modal-box { + z-index: 900; +} + +.modal-sandbox { position: fixed; - z-index: 1; - left: 0; - top: 0; width: 100%; height: 100%; + top: 0; + left: 0; + background: transparent; +} + +.modal { + display: none; + position: fixed; + width: 100%; + height: 100%; + left: 0; + top: 0; + background: rgb(0,0,0); + background: rgba(0,0,0,.8); overflow: auto; - background-color: rgba(0, 0, 0, 0.4); +} + +.modal-box { + position: relative; + width: 80%; + max-width: 700px; + margin: 100px auto; + animation-name: modalbox; + animation-duration: .3s; + animation-timing-function: ease; } .modal-header { - margin: 15% auto; - padding: 20px; - border: 1px solid #888; - width: 80%; + border: 2px solid #2a9fd6; + border-radius: 8px 8px 0 0; + display: flex; + flex-direction: row; + justify-content: space-between; + padding: 20px 40px; + background: #000; + color: #ffffff; } .modal-body { - margin: auto; - padding: 20px; - border: 1px solid #888; - width: 80%; + border: 2px solid #2a9fd6; + border-top: none; + background: #000; + padding: 30px; } .modal-footer { - margin: auto; + display: flex; + justify-content: flex-end; + border: 2px solid #2a9fd6; + border-radius: 0 0 8px 8px; + border-top: none; + background: #000; padding: 20px; - border: 1px solid #888; - width: 80%; -} \ No newline at end of file +} + +.close-modal { + text-align: right; + font-size: 24px; + cursor: pointer; +} + +@keyframes modalbox { + 0% { + top: -250px; + opacity: 0; + } + 100% { + top: 0; + opacity: 1; + } +} + +button { + margin-left: 20px; + color: #d3d3d3; + background: #000; + border: 2px solid #2a9fd6; + border-radius: 5px; + padding: 10px; + cursor: pointer; + transition: background-color 0.25s; +} + +button:hover { + color: #fff; + background-color: #2a9fd6; + text-decoration: none; + outline: none; +} + +::-moz-focus-inner { + outline: none; +} + +.btn-del { + text-transform: uppercase; + border: 2px solid #ff6666; + color: #ccc; +} + +.btn-del:hover { + background-color: #ff6666; +} + +em { + text-transform: uppercase; + font-weight: bold; +} + diff --git a/app/public/panel/controllers/ApiCtrl.js b/app/public/panel/controllers/ApiCtrl.js index 45fc2da..b05a108 100644 --- a/app/public/panel/controllers/ApiCtrl.js +++ b/app/public/panel/controllers/ApiCtrl.js @@ -7,4 +7,29 @@ angular.module('ApiCtrl', ['ApiSvc', 'AuthSvc']).controller('ApiController', ['$ }); console.log($scope.keys); }; + + $scope.hideNewKey = function() { + $scope.nModalShow = false; + }; + $scope.showNewKey = function() { + $scope.nModalShow = true; + }; + + $scope.hideKeyInfo = function() { + $scope.kModalShow = false; + }; + $scope.showKeyInfo = function(key) { + $scope.kModalShow = true; + $scope.currKey = key; + }; + + $scope.deleteKey = function(key) { + ApiService.deleteKey(key, function() { + var index = $scope.keys.indexOf(key); + console.log('removing index' + index); + $scope.keys.splice(index, 1); + $scope.hideKeyInfo(); + $scope.currKey = {}; + }); + }; }]); \ No newline at end of file diff --git a/app/public/services/ApiSvc.js b/app/public/services/ApiSvc.js index 4135a26..a844621 100644 --- a/app/public/services/ApiSvc.js +++ b/app/public/services/ApiSvc.js @@ -19,4 +19,21 @@ angular.module('ApiSvc', []).service('ApiService', ['$http', '$window', function cb(res.data); }); }; + + this.deleteKey = function(key, cb) { + $http({ + method: 'POST', + url: '/api/keys/delete', + headers: {'Content-Type': 'application/x-www-form-urlencoded'}, + transformRequest: function(obj) { + var str = []; + for (var p in obj) + str.push(encodeURIComponent(p) + "=" + encodeURIComponent(obj[p])); + return str.join("&"); + }, + data: {key: key.key} + }).then(function(res) { + cb(res.data); + }); + } }]); diff --git a/app/routes/keys.js b/app/routes/keys.js index 36e868e..dbecf23 100644 --- a/app/routes/keys.js +++ b/app/routes/keys.js @@ -64,4 +64,10 @@ router.get('/get', function (req, res, next) { }) }); +router.post('/delete', function(req, res, next) { + console.log('Tried to delete ' + req.body.key); + res.status(200).json({'message': 'Successfully deleted.'}); + //Key.deleteOne({key: req.body.key}) +}); + module.exports = router; diff --git a/public/views/panel/api.html b/public/views/panel/api.html index b2591e3..ab4a42e 100644 --- a/public/views/panel/api.html +++ b/public/views/panel/api.html @@ -1,30 +1,59 @@ -
+
-
+
{{key.identifier}}
-
+
Create
-
-
- -

API Key

+
+
+
+
+

Key Info: {{currKey.identifier}}

+
+
+
+

API Key:

+ 
{{currKey.key}}
+
+

This key can be used with any 3rd party program or service to upload to and manage your account + with Shimapan.

+

For example, it can be used in a bash script to upload from the command line:

+ 
APIKEY=[Your API Key Here]
URL=$(curl -s -F "apikey=$APIKEY" -F "file=@$1" https://shimapan.rocks/api/upload | grep url | awk '{print $2}')
echo $URL | tr -d '[\\\,"\n]'
+
+

If your key is compromised, it can be used to upload and modify your account without your knowledge. + If it is lost or compromised, you can delete the key below, but be warned that this cannot + be undone.

+
+
+ + +
-
-

API Key:

- 
{{currKey.code}}
-

Use this key with your preferred method of utilizing the Shimapan API.

-

Example with cURL:

- 

-            

-        

-        

-            
-            
+    

+    

+        

+        

+            

+                
Create a Key

+                

+            

+            

+                
Lorem ipsum dolor sit amet, consectetur adipisicing elit. Hic soluta saepe, atque, iure quidem
+                    maiores non dolores, fuga eaque voluptatibus corporis accusantium quas. Eligendi velit eum fugiat
+                    eius? Distinctio reiciendis sint error, repellat ut soluta doloremque, accusamus vitae placeat?

+                
Laboriosam voluptas, iure rem provident laborum culpa atque fugit inventore sit. Corrupti dolore
+                    architecto inventore officia, odit totam voluptatem laboriosam tempore reiciendis, et neque,
+                    consequuntur. Non, tenetur? Tempore reprehenderit tenetur nemo asperiores alias commodi assumenda
+                    architecto minima numquam repellendus debitis nulla, rerum officia itaque, sunt nihil sequi quod
+                    perspiciatis, animi quas voluptates velit aperiam voluptatem.

+                

+                
+            

         

     

 

\ No newline at end of file

From aac5caf6a76a01ae896726db22dc0a1ebacbc0fd Mon Sep 17 00:00:00 2001
From: Jack 
Date: Sat, 21 Oct 2017 15:10:38 -0400
Subject: [PATCH 2/4] Remove cookie-parser

---
 package-lock.json | 9 ---------
 package.json      | 1 -
 server.js         | 2 --
 3 files changed, 12 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0fb8409..8baf871 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -942,15 +942,6 @@
       "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.3.1.tgz",
       "integrity": "sha1-5+Ch+e9DtMi6klxcWpboBtFoc7s="
     },
-    "cookie-parser": {
-      "version": "1.4.3",
-      "resolved": "https://registry.npmjs.org/cookie-parser/-/cookie-parser-1.4.3.tgz",
-      "integrity": "sha1-D+MfoZ0AC5X0qt8fU/3CuKIDuqU=",
-      "requires": {
-        "cookie": "0.3.1",
-        "cookie-signature": "1.0.6"
-      }
-    },
     "cookie-signature": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
diff --git a/package.json b/package.json
index 8f093a0..a66984b 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,6 @@
     "body-parser": "^1.18.2",
     "config": "^1.26.2",
     "connect-mongo": "^2.0.0",
-    "cookie-parser": "^1.4.3",
     "event-stream": "^3.3.4",
     "express": "^4.16.2",
     "express-sanitizer": "^1.0.2",
diff --git a/server.js b/server.js
index b195869..dff6036 100644
--- a/server.js
+++ b/server.js
@@ -4,7 +4,6 @@ var methodOverride = require('method-override');
 var mongoose = require('mongoose');
 var morgan = require('morgan');
 var passport = require('passport');
-var cookieParser = require('cookie-parser');
 var session = require('express-session');
 var sanitizer = require('express-sanitizer');
 var helmet = require('helmet');
@@ -45,7 +44,6 @@ app.use(session({
 }));
 app.use(passport.initialize());
 app.use(passport.session());
-app.use(cookieParser());
 app.use(bodyParser.json());
 app.use(bodyParser.json({ type: 'application/*+json' }))
 app.use(bodyParser.urlencoded({ extended: true }));

From 5917e75dda17cf447020b59cf3cb0b67fe68950b Mon Sep 17 00:00:00 2001
From: Jack 
Date: Sat, 21 Oct 2017 15:10:55 -0400
Subject: [PATCH 3/4] Small auth fixes

---
 app/routes/auth.js   | 2 ++
 app/routes/routes.js | 6 +++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/app/routes/auth.js b/app/routes/auth.js
index 33ef6bc..99b46b1 100644
--- a/app/routes/auth.js
+++ b/app/routes/auth.js
@@ -38,6 +38,7 @@ router.post('/register', function (req, res, next) {
                         req.session.save(function(err) {
                             if (err) return next(err);
                             useInvite(req.body.invite, req.body.username);
+                            req.session.username = req.body.username;
                             res.status(200).json({'message': 'Registered.'});
                         });
                     });
@@ -55,6 +56,7 @@ router.post('/login', function (req, res, next) {
         if (!user) return res.status(401).json({'message': info});
         req.logIn(user, function(err) {
             if (err) return next(err);
+            req.session.username = user;
             res.status(200).json({'message': 'Logged in.'});
         });
     })(req, res, next);
diff --git a/app/routes/routes.js b/app/routes/routes.js
index 1e0a6ed..5ff6175 100644
--- a/app/routes/routes.js
+++ b/app/routes/routes.js
@@ -12,10 +12,10 @@ var fs = require('fs');
 var path = require('path');
 
 var requireLogin = function(req, res, next) {
-    if (!req.session.passport.user)
-        res.redirect('/login');
+    if (!req.session || !req.session.passport)
+        return res.redirect('/login');
     else
-        next();
+        return next();
 };
 
 module.exports = function(app) {

From ae4687c1c1dbbad4647b34040ae18d478e3fb1f9 Mon Sep 17 00:00:00 2001
From: Jack 
Date: Sat, 21 Oct 2017 17:47:55 -0400
Subject: [PATCH 4/4] Finish key creation/deletion

---
 app/public/css/panel.css                | 35 ++++++++++++++++-
 app/public/panel/controllers/ApiCtrl.js | 69 ++++++++++++++++++++++++++-------
 app/public/services/ApiSvc.js           | 23 +++++++++--
 app/routes/keys.js                      |  7 ++--
 public/views/panel/api.html             | 39 +++++++++++++------
 5 files changed, 142 insertions(+), 31 deletions(-)

diff --git a/app/public/css/panel.css b/app/public/css/panel.css
index 0010830..9bb2cc8 100644
--- a/app/public/css/panel.css
+++ b/app/public/css/panel.css
@@ -249,12 +249,16 @@ pre {
     position: relative;
     width: 80%;
     max-width: 700px;
-    margin: 100px auto;
+    margin: 60px auto;
     animation-name: modalbox;
     animation-duration: .3s;
     animation-timing-function: ease;
 }
 
+#createKey {
+    max-width: 920px;
+}
+
 .modal-header {
     border: 2px solid #2a9fd6;
     border-radius: 8px 8px 0 0;
@@ -337,3 +341,32 @@ em {
     font-weight: bold;
 }
 
+#identifier {
+    font-size: 14px;
+    background: #222;
+    color: #d3d3d3;
+    border: 1px solid #666;
+    border-radius: 4px;
+    padding: 10px;
+    margin: 10px 0;
+}
+
+th {
+    text-transform: uppercase;
+    font-weight: bold;
+    padding: 10px;
+}
+
+td {
+    padding: 10px;
+}
+
+td input {
+    vertical-align: middle;
+}
+
+td label {
+    margin-bottom: 2px;
+    padding-left: 3px;
+}
+
diff --git a/app/public/panel/controllers/ApiCtrl.js b/app/public/panel/controllers/ApiCtrl.js
index b05a108..b728361 100644
--- a/app/public/panel/controllers/ApiCtrl.js
+++ b/app/public/panel/controllers/ApiCtrl.js
@@ -1,35 +1,78 @@
 var angular = require('angular');
 
-angular.module('ApiCtrl', ['ApiSvc', 'AuthSvc']).controller('ApiController', ['$scope', 'ApiService', 'AuthService', function($scope, ApiService, AuthService) {
-    $scope.getKeys = function() {
-        ApiService.getAll(function(keys) {
-            $scope.keys = keys;
-        });
-        console.log($scope.keys);
+angular.module('ApiCtrl', ['ApiSvc', 'AuthSvc']).controller('ApiController', ['$scope', 'ApiService', 'AuthService', function ($scope, ApiService, AuthService) {
+    function splitScope(scope) {
+        var res = {};
+        for (var i in scope) {
+            var perm = scope[i];
+            var prefix = perm.substr(0, perm.indexOf('.'));
+            var postfix = perm.substr(perm.indexOf('.') + 1);
+            if (!res[prefix]) res[prefix] = [];
+            res[prefix].push({name: postfix});
+        }
+        return res;
+    }
+
+    $scope.checkCkPerm = function(prefix, perm) {
+        var index = $scope.scopeObj[prefix].indexOf(perm);
+        if ($scope.scopeObj[prefix][index].isChecked) {
+            $scope.ckScope.push(prefix + '.' + perm.name);
+        } else {
+            var index = $scope.ckScope.indexOf(prefix + '.' + perm.name);
+            $scope.ckScope.splice(index, 1);
+        }
     };
 
-    $scope.hideNewKey = function() {
+    $scope.parseScope = function () {
+        AuthService.currentUser(function (res) {
+            $scope.scopeObj = splitScope(res.scope);
+            $scope.ckScope = [];
+        })
+    };
+
+    $scope.getKeys = function () {
+        ApiService.getAll(function (keys) {
+            $scope.keys = keys;
+        });
+    };
+
+    $scope.hideNewKey = function () {
         $scope.nModalShow = false;
     };
-    $scope.showNewKey = function() {
+    $scope.showNewKey = function () {
         $scope.nModalShow = true;
     };
 
-    $scope.hideKeyInfo = function() {
+    $scope.hideKeyInfo = function () {
         $scope.kModalShow = false;
     };
-    $scope.showKeyInfo = function(key) {
+    $scope.showKeyInfo = function (key) {
         $scope.kModalShow = true;
         $scope.currKey = key;
+        $scope.currKey.scopeObj = splitScope($scope.currKey.scope);
     };
 
-    $scope.deleteKey = function(key) {
-        ApiService.deleteKey(key, function() {
+    $scope.deleteKey = function (key) {
+        ApiService.deleteKey(key, function () {
             var index = $scope.keys.indexOf(key);
-            console.log('removing index' + index);
             $scope.keys.splice(index, 1);
             $scope.hideKeyInfo();
             $scope.currKey = {};
         });
     };
+
+    $scope.createKey = function () {
+        if ($scope.ckScope.length === 0 || !$scope.ckIdentifier)
+            return;
+
+        ApiService.createKey({
+            identifier: $scope.ckIdentifier,
+            scope: JSON.stringify($scope.ckScope)
+        }, function (res) {
+            if (res.key) {
+                $scope.hideNewKey();
+                $scope.getKeys();
+            }
+        });
+    }
 }]);
\ No newline at end of file
diff --git a/app/public/services/ApiSvc.js b/app/public/services/ApiSvc.js
index a844621..e70028a 100644
--- a/app/public/services/ApiSvc.js
+++ b/app/public/services/ApiSvc.js
@@ -20,20 +20,37 @@ angular.module('ApiSvc', []).service('ApiService', ['$http', '$window', function
         });
     };
 
-    this.deleteKey = function(key, cb) {
+    this.deleteKey = function (key, cb) {
         $http({
             method: 'POST',
             url: '/api/keys/delete',
             headers: {'Content-Type': 'application/x-www-form-urlencoded'},
-            transformRequest: function(obj) {
+            transformRequest: function (obj) {
                 var str = [];
                 for (var p in obj)
                     str.push(encodeURIComponent(p) + "=" + encodeURIComponent(obj[p]));
                 return str.join("&");
             },
             data: {key: key.key}
+        }).then(function (res) {
+            cb(res.data);
+        });
+    };
+
+    this.createKey = function (key, cb) {
+        $http({
+            method: 'POST',
+            url: '/api/keys/create',
+            headers: {'Content-Type': 'application/x-www-form-urlencoded'},
+            transformRequest: function (obj) {
+                var str = [];
+                for (var p in obj)
+                    str.push(encodeURIComponent(p) + "=" + encodeURIComponent(obj[p]));
+                return str.join("&");
+            },
+            data: key
         }).then(function(res) {
             cb(res.data);
         });
-    }
+    };
 }]);
diff --git a/app/routes/keys.js b/app/routes/keys.js
index dbecf23..f2414b7 100644
--- a/app/routes/keys.js
+++ b/app/routes/keys.js
@@ -65,9 +65,10 @@ router.get('/get', function (req, res, next) {
 });
 
 router.post('/delete', function(req, res, next) {
-    console.log('Tried to delete ' + req.body.key);
-    res.status(200).json({'message': 'Successfully deleted.'});
-    //Key.deleteOne({key: req.body.key})
+    Key.deleteOne({key: req.body.key}, function(err) {
+        if (err) next(err);
+        else res.status(200).json({'message': 'Successfully deleted.'});
+    });
 });
 
 module.exports = router;
diff --git a/public/views/panel/api.html b/public/views/panel/api.html
index ab4a42e..d8dcfa9 100644
--- a/public/views/panel/api.html
+++ b/public/views/panel/api.html
@@ -1,4 +1,4 @@
-

+

     

         

             
@@ -25,6 +25,16 @@
                 
For example, it can be used in a bash script to upload from the command line:

                 
APIKEY=[Your API Key Here]
URL=$(curl -s -F "apikey=$APIKEY" -F "file=@$1" https://shimapan.rocks/api/upload | grep url | awk '{print $2}')
echo $URL | tr -d '[\\\,"\n]'

                 

+                
Key Permissions:

+                
+                    
+                        
+                        
+                    
+                
{{prefix}}:
+                            
+                        

+                

                 
If your key is compromised, it can be used to upload and modify your account without your knowledge.
                     If it is lost or compromised, you can delete the key below, but be warned that this cannot
                     be undone.

@@ -37,22 +47,29 @@
     

     

         

-        

+