BookStack Code Mirror - bookstack/blob - app/Entities/Controllers/PageApiController.php

   1 <?php
   2
   3 namespace BookStack\Entities\Controllers;
   4
   5 use BookStack\Entities\Queries\EntityQueries;
   6 use BookStack\Entities\Queries\PageQueries;
   7 use BookStack\Entities\Repos\PageRepo;
   8 use BookStack\Exceptions\PermissionsException;
   9 use BookStack\Http\ApiController;
  10 use Exception;
  11 use Illuminate\Http\Request;
  12
  13 class PageApiController extends ApiController
  14 {
  15     protected $rules = [
  16         'create' => [
  17             'book_id'    => ['required_without:chapter_id', 'integer'],
  18             'chapter_id' => ['required_without:book_id', 'integer'],
  19             'name'       => ['required', 'string', 'max:255'],
  20             'html'       => ['required_without:markdown', 'string'],
  21             'markdown'   => ['required_without:html', 'string'],
  22             'tags'       => ['array'],
  23             'priority'   => ['integer'],
  24         ],
  25         'update' => [
  26             'book_id'    => ['integer'],
  27             'chapter_id' => ['integer'],
  28             'name'       => ['string', 'min:1', 'max:255'],
  29             'html'       => ['string'],
  30             'markdown'   => ['string'],
  31             'tags'       => ['array'],
  32             'priority'   => ['integer'],
  33         ],
  34     ];
  35
  36     public function __construct(
  37         protected PageRepo $pageRepo,
  38         protected PageQueries $queries,
  39         protected EntityQueries $entityQueries,
  40     ) {
  41     }
  42
  43     /**
  44      * Get a listing of pages visible to the user.
  45      */
  46     public function list()
  47     {
  48         $pages = $this->queries->visibleForList()
  49             ->addSelect(['created_by', 'updated_by', 'revision_count', 'editor']);
  50
  51         return $this->apiListingResponse($pages, [
  52             'id', 'book_id', 'chapter_id', 'name', 'slug', 'priority',
  53             'draft', 'template',
  54             'created_at', 'updated_at',
  55             'created_by', 'updated_by', 'owned_by',
  56         ]);
  57     }
  58
  59     /**
  60      * Create a new page in the system.
  61      *
  62      * The ID of a parent book or chapter is required to indicate
  63      * where this page should be located.
  64      *
  65      * Any HTML content provided should be kept to a single-block depth of plain HTML
  66      * elements to remain compatible with the BookStack front-end and editors.
  67      * Any images included via base64 data URIs will be extracted and saved as gallery
  68      * images against the page during upload.
  69      */
  70     public function create(Request $request)
  71     {
  72         $this->validate($request, $this->rules['create']);
  73
  74         if ($request->has('chapter_id')) {
  75             $parent = $this->entityQueries->chapters->findVisibleByIdOrFail(intval($request->get('chapter_id')));
  76         } else {
  77             $parent = $this->entityQueries->books->findVisibleByIdOrFail(intval($request->get('book_id')));
  78         }
  79         $this->checkOwnablePermission('page-create', $parent);
  80
  81         $draft = $this->pageRepo->getNewDraftPage($parent);
  82         $this->pageRepo->publishDraft($draft, $request->only(array_keys($this->rules['create'])));
  83
  84         return response()->json($draft->forJsonDisplay());
  85     }
  86
  87     /**
  88      * View the details of a single page.
  89      * Pages will always have HTML content. They may have markdown content
  90      * if the markdown editor was used to last update the page.
  91      *
  92      * The 'html' property is the fully rendered & escaped HTML content that BookStack
  93      * would show on page view, with page includes handled.
  94      * The 'raw_html' property is the direct database stored HTML content, which would be
  95      * what BookStack shows on page edit.
  96      *
  97      * See the "Content Security" section of these docs for security considerations when using
  98      * the page content returned from this endpoint.
  99      */
 100     public function read(string $id)
 101     {
 102         $page = $this->queries->findVisibleByIdOrFail($id);
 103
 104         return response()->json($page->forJsonDisplay());
 105     }
 106
 107     /**
 108      * Update the details of a single page.
 109      *
 110      * See the 'create' action for details on the provided HTML/Markdown.
 111      * Providing a 'book_id' or 'chapter_id' property will essentially move
 112      * the page into that parent element if you have permissions to do so.
 113      */
 114     public function update(Request $request, string $id)
 115     {
 116         $requestData = $this->validate($request, $this->rules['update']);
 117
 118         $page = $this->queries->findVisibleByIdOrFail($id);
 119         $this->checkOwnablePermission('page-update', $page);
 120
 121         $parent = null;
 122         if ($request->has('chapter_id')) {
 123             $parent = $this->entityQueries->chapters->findVisibleByIdOrFail(intval($request->get('chapter_id')));
 124         } elseif ($request->has('book_id')) {
 125             $parent = $this->entityQueries->books->findVisibleByIdOrFail(intval($request->get('book_id')));
 126         }
 127
 128         if ($parent && !$parent->matches($page->getParent())) {
 129             $this->checkOwnablePermission('page-delete', $page);
 130
 131             try {
 132                 $this->pageRepo->move($page, $parent->getType() . ':' . $parent->id);
 133             } catch (Exception $exception) {
 134                 if ($exception instanceof  PermissionsException) {
 135                     $this->showPermissionError();
 136                 }
 137
 138                 return $this->jsonError(trans('errors.selected_book_chapter_not_found'));
 139             }
 140         }
 141
 142         $updatedPage = $this->pageRepo->update($page, $requestData);
 143
 144         return response()->json($updatedPage->forJsonDisplay());
 145     }
 146
 147     /**
 148      * Delete a page.
 149      * This will typically send the page to the recycle bin.
 150      */
 151     public function delete(string $id)
 152     {
 153         $page = $this->queries->findVisibleByIdOrFail($id);
 154         $this->checkOwnablePermission('page-delete', $page);
 155
 156         $this->pageRepo->destroy($page);
 157
 158         return response('', 204);
 159     }
 160 }