BookStack Code Mirror - bookstack/blob - routes/web.php

   1 <?php
   2
   3 use BookStack\Http\Controllers\Api;
   4 use BookStack\Http\Controllers\AttachmentController;
   5 use BookStack\Http\Controllers\AuditLogController;
   6 use BookStack\Http\Controllers\Auth;
   7 use BookStack\Http\Controllers\BookController;
   8 use BookStack\Http\Controllers\BookExportController;
   9 use BookStack\Http\Controllers\BookshelfController;
  10 use BookStack\Http\Controllers\BookSortController;
  11 use BookStack\Http\Controllers\ChapterController;
  12 use BookStack\Http\Controllers\ChapterExportController;
  13 use BookStack\Http\Controllers\CommentController;
  14 use BookStack\Http\Controllers\FavouriteController;
  15 use BookStack\Http\Controllers\HomeController;
  16 use BookStack\Http\Controllers\Images;
  17 use BookStack\Http\Controllers\MaintenanceController;
  18 use BookStack\Http\Controllers\PageController;
  19 use BookStack\Http\Controllers\PageExportController;
  20 use BookStack\Http\Controllers\PageRevisionController;
  21 use BookStack\Http\Controllers\PageTemplateController;
  22 use BookStack\Http\Controllers\RecycleBinController;
  23 use BookStack\Http\Controllers\RoleController;
  24 use BookStack\Http\Controllers\SearchController;
  25 use BookStack\Http\Controllers\SettingController;
  26 use BookStack\Http\Controllers\StatusController;
  27 use BookStack\Http\Controllers\TagController;
  28 use BookStack\Http\Controllers\UserApiTokenController;
  29 use BookStack\Http\Controllers\UserController;
  30 use BookStack\Http\Controllers\UserProfileController;
  31 use BookStack\Http\Controllers\UserSearchController;
  32 use BookStack\Http\Controllers\WebhookController;
  33 use BookStack\Http\Middleware\VerifyCsrfToken;
  34 use Illuminate\Session\Middleware\StartSession;
  35 use Illuminate\Support\Facades\Route;
  36 use Illuminate\View\Middleware\ShareErrorsFromSession;
  37
  38 Route::get('/status', [StatusController::class, 'show']);
  39 Route::get('/robots.txt', [HomeController::class, 'robots']);
  40
  41 Route::get('/test', function() {
  42     $book = \BookStack\Entities\Models\Book::query()->where('slug', '=', 'k5TrhXxaNb')->firstOrFail();
  43     $builder= app()->make(\BookStack\Auth\Permissions\JointPermissionBuilder::class);
  44     $builder->rebuildForEntity($book);
  45     return 'finished';
  46 })->withoutMiddleware('web');
  47
  48 // Authenticated routes...
  49 Route::middleware('auth')->group(function () {
  50
  51     // Secure images routing
  52     Route::get('/uploads/images/{path}', [Images\ImageController::class, 'showImage'])
  53         ->where('path', '.*$');
  54
  55     // API docs routes
  56     Route::redirect('/api', '/api/docs');
  57     Route::get('/api/docs', [Api\ApiDocsController::class, 'display']);
  58
  59     Route::get('/pages/recently-updated', [PageController::class, 'showRecentlyUpdated']);
  60
  61     // Shelves
  62     Route::get('/create-shelf', [BookshelfController::class, 'create']);
  63     Route::get('/shelves/', [BookshelfController::class, 'index']);
  64     Route::post('/shelves/', [BookshelfController::class, 'store']);
  65     Route::get('/shelves/{slug}/edit', [BookshelfController::class, 'edit']);
  66     Route::get('/shelves/{slug}/delete', [BookshelfController::class, 'showDelete']);
  67     Route::get('/shelves/{slug}', [BookshelfController::class, 'show']);
  68     Route::put('/shelves/{slug}', [BookshelfController::class, 'update']);
  69     Route::delete('/shelves/{slug}', [BookshelfController::class, 'destroy']);
  70     Route::get('/shelves/{slug}/permissions', [BookshelfController::class, 'showPermissions']);
  71     Route::put('/shelves/{slug}/permissions', [BookshelfController::class, 'permissions']);
  72     Route::post('/shelves/{slug}/copy-permissions', [BookshelfController::class, 'copyPermissions']);
  73
  74     // Book Creation
  75     Route::get('/shelves/{shelfSlug}/create-book', [BookController::class, 'create']);
  76     Route::post('/shelves/{shelfSlug}/create-book', [BookController::class, 'store']);
  77     Route::get('/create-book', [BookController::class, 'create']);
  78
  79     // Books
  80     Route::get('/books/', [BookController::class, 'index']);
  81     Route::post('/books/', [BookController::class, 'store']);
  82     Route::get('/books/{slug}/edit', [BookController::class, 'edit']);
  83     Route::put('/books/{slug}', [BookController::class, 'update']);
  84     Route::delete('/books/{id}', [BookController::class, 'destroy']);
  85     Route::get('/books/{slug}/sort-item', [BookSortController::class, 'showItem']);
  86     Route::get('/books/{slug}', [BookController::class, 'show']);
  87     Route::get('/books/{bookSlug}/permissions', [BookController::class, 'showPermissions']);
  88     Route::put('/books/{bookSlug}/permissions', [BookController::class, 'permissions']);
  89     Route::get('/books/{slug}/delete', [BookController::class, 'showDelete']);
  90     Route::get('/books/{bookSlug}/copy', [BookController::class, 'showCopy']);
  91     Route::post('/books/{bookSlug}/copy', [BookController::class, 'copy']);
  92     Route::post('/books/{bookSlug}/convert-to-shelf', [BookController::class, 'convertToShelf']);
  93     Route::get('/books/{bookSlug}/sort', [BookSortController::class, 'show']);
  94     Route::put('/books/{bookSlug}/sort', [BookSortController::class, 'update']);
  95     Route::get('/books/{bookSlug}/export/html', [BookExportController::class, 'html']);
  96     Route::get('/books/{bookSlug}/export/pdf', [BookExportController::class, 'pdf']);
  97     Route::get('/books/{bookSlug}/export/markdown', [BookExportController::class, 'markdown']);
  98     Route::get('/books/{bookSlug}/export/zip', [BookExportController::class, 'zip']);
  99     Route::get('/books/{bookSlug}/export/plaintext', [BookExportController::class, 'plainText']);
 100
 101     // Pages
 102     Route::get('/books/{bookSlug}/create-page', [PageController::class, 'create']);
 103     Route::post('/books/{bookSlug}/create-guest-page', [PageController::class, 'createAsGuest']);
 104     Route::get('/books/{bookSlug}/draft/{pageId}', [PageController::class, 'editDraft']);
 105     Route::post('/books/{bookSlug}/draft/{pageId}', [PageController::class, 'store']);
 106     Route::get('/books/{bookSlug}/page/{pageSlug}', [PageController::class, 'show']);
 107     Route::get('/books/{bookSlug}/page/{pageSlug}/export/pdf', [PageExportController::class, 'pdf']);
 108     Route::get('/books/{bookSlug}/page/{pageSlug}/export/html', [PageExportController::class, 'html']);
 109     Route::get('/books/{bookSlug}/page/{pageSlug}/export/markdown', [PageExportController::class, 'markdown']);
 110     Route::get('/books/{bookSlug}/page/{pageSlug}/export/plaintext', [PageExportController::class, 'plainText']);
 111     Route::get('/books/{bookSlug}/page/{pageSlug}/edit', [PageController::class, 'edit']);
 112     Route::get('/books/{bookSlug}/page/{pageSlug}/move', [PageController::class, 'showMove']);
 113     Route::put('/books/{bookSlug}/page/{pageSlug}/move', [PageController::class, 'move']);
 114     Route::get('/books/{bookSlug}/page/{pageSlug}/copy', [PageController::class, 'showCopy']);
 115     Route::post('/books/{bookSlug}/page/{pageSlug}/copy', [PageController::class, 'copy']);
 116     Route::get('/books/{bookSlug}/page/{pageSlug}/delete', [PageController::class, 'showDelete']);
 117     Route::get('/books/{bookSlug}/draft/{pageId}/delete', [PageController::class, 'showDeleteDraft']);
 118     Route::get('/books/{bookSlug}/page/{pageSlug}/permissions', [PageController::class, 'showPermissions']);
 119     Route::put('/books/{bookSlug}/page/{pageSlug}/permissions', [PageController::class, 'permissions']);
 120     Route::put('/books/{bookSlug}/page/{pageSlug}', [PageController::class, 'update']);
 121     Route::delete('/books/{bookSlug}/page/{pageSlug}', [PageController::class, 'destroy']);
 122     Route::delete('/books/{bookSlug}/draft/{pageId}', [PageController::class, 'destroyDraft']);
 123
 124     // Revisions
 125     Route::get('/books/{bookSlug}/page/{pageSlug}/revisions', [PageRevisionController::class, 'index']);
 126     Route::get('/books/{bookSlug}/page/{pageSlug}/revisions/{revId}', [PageRevisionController::class, 'show']);
 127     Route::get('/books/{bookSlug}/page/{pageSlug}/revisions/{revId}/changes', [PageRevisionController::class, 'changes']);
 128     Route::put('/books/{bookSlug}/page/{pageSlug}/revisions/{revId}/restore', [PageRevisionController::class, 'restore']);
 129     Route::delete('/books/{bookSlug}/page/{pageSlug}/revisions/{revId}/delete', [PageRevisionController::class, 'destroy']);
 130
 131     // Chapters
 132     Route::get('/books/{bookSlug}/chapter/{chapterSlug}/create-page', [PageController::class, 'create']);
 133     Route::post('/books/{bookSlug}/chapter/{chapterSlug}/create-guest-page', [PageController::class, 'createAsGuest']);
 134     Route::get('/books/{bookSlug}/create-chapter', [ChapterController::class, 'create']);
 135     Route::post('/books/{bookSlug}/create-chapter', [ChapterController::class, 'store']);
 136     Route::get('/books/{bookSlug}/chapter/{chapterSlug}', [ChapterController::class, 'show']);
 137     Route::put('/books/{bookSlug}/chapter/{chapterSlug}', [ChapterController::class, 'update']);
 138     Route::get('/books/{bookSlug}/chapter/{chapterSlug}/move', [ChapterController::class, 'showMove']);
 139     Route::put('/books/{bookSlug}/chapter/{chapterSlug}/move', [ChapterController::class, 'move']);
 140     Route::get('/books/{bookSlug}/chapter/{chapterSlug}/copy', [ChapterController::class, 'showCopy']);
 141     Route::post('/books/{bookSlug}/chapter/{chapterSlug}/copy', [ChapterController::class, 'copy']);
 142     Route::get('/books/{bookSlug}/chapter/{chapterSlug}/edit', [ChapterController::class, 'edit']);
 143     Route::post('/books/{bookSlug}/chapter/{chapterSlug}/convert-to-book', [ChapterController::class, 'convertToBook']);
 144     Route::get('/books/{bookSlug}/chapter/{chapterSlug}/permissions', [ChapterController::class, 'showPermissions']);
 145     Route::get('/books/{bookSlug}/chapter/{chapterSlug}/export/pdf', [ChapterExportController::class, 'pdf']);
 146     Route::get('/books/{bookSlug}/chapter/{chapterSlug}/export/html', [ChapterExportController::class, 'html']);
 147     Route::get('/books/{bookSlug}/chapter/{chapterSlug}/export/markdown', [ChapterExportController::class, 'markdown']);
 148     Route::get('/books/{bookSlug}/chapter/{chapterSlug}/export/plaintext', [ChapterExportController::class, 'plainText']);
 149     Route::put('/books/{bookSlug}/chapter/{chapterSlug}/permissions', [ChapterController::class, 'permissions']);
 150     Route::get('/books/{bookSlug}/chapter/{chapterSlug}/delete', [ChapterController::class, 'showDelete']);
 151     Route::delete('/books/{bookSlug}/chapter/{chapterSlug}', [ChapterController::class, 'destroy']);
 152
 153     // User Profile routes
 154     Route::get('/user/{slug}', [UserProfileController::class, 'show']);
 155
 156     // Image routes
 157     Route::get('/images/gallery', [Images\GalleryImageController::class, 'list']);
 158     Route::post('/images/gallery', [Images\GalleryImageController::class, 'create']);
 159     Route::get('/images/drawio', [Images\DrawioImageController::class, 'list']);
 160     Route::get('/images/drawio/base64/{id}', [Images\DrawioImageController::class, 'getAsBase64']);
 161     Route::post('/images/drawio', [Images\DrawioImageController::class, 'create']);
 162     Route::get('/images/edit/{id}', [Images\ImageController::class, 'edit']);
 163     Route::put('/images/{id}', [Images\ImageController::class, 'update']);
 164     Route::delete('/images/{id}', [Images\ImageController::class, 'destroy']);
 165
 166     // Attachments routes
 167     Route::get('/attachments/{id}', [AttachmentController::class, 'get']);
 168     Route::post('/attachments/upload', [AttachmentController::class, 'upload']);
 169     Route::post('/attachments/upload/{id}', [AttachmentController::class, 'uploadUpdate']);
 170     Route::post('/attachments/link', [AttachmentController::class, 'attachLink']);
 171     Route::put('/attachments/{id}', [AttachmentController::class, 'update']);
 172     Route::get('/attachments/edit/{id}', [AttachmentController::class, 'getUpdateForm']);
 173     Route::get('/attachments/get/page/{pageId}', [AttachmentController::class, 'listForPage']);
 174     Route::put('/attachments/sort/page/{pageId}', [AttachmentController::class, 'sortForPage']);
 175     Route::delete('/attachments/{id}', [AttachmentController::class, 'delete']);
 176
 177     // AJAX routes
 178     Route::put('/ajax/page/{id}/save-draft', [PageController::class, 'saveDraft']);
 179     Route::get('/ajax/page/{id}', [PageController::class, 'getPageAjax']);
 180     Route::delete('/ajax/page/{id}', [PageController::class, 'ajaxDestroy']);
 181
 182     // Tag routes
 183     Route::get('/tags', [TagController::class, 'index']);
 184     Route::get('/ajax/tags/suggest/names', [TagController::class, 'getNameSuggestions']);
 185     Route::get('/ajax/tags/suggest/values', [TagController::class, 'getValueSuggestions']);
 186
 187     Route::get('/ajax/search/entities', [SearchController::class, 'searchEntitiesAjax']);
 188
 189     // Comments
 190     Route::post('/comment/{pageId}', [CommentController::class, 'savePageComment']);
 191     Route::put('/comment/{id}', [CommentController::class, 'update']);
 192     Route::delete('/comment/{id}', [CommentController::class, 'destroy']);
 193
 194     // Links
 195     Route::get('/link/{id}', [PageController::class, 'redirectFromLink']);
 196
 197     // Search
 198     Route::get('/search', [SearchController::class, 'search']);
 199     Route::get('/search/book/{bookId}', [SearchController::class, 'searchBook']);
 200     Route::get('/search/chapter/{bookId}', [SearchController::class, 'searchChapter']);
 201     Route::get('/search/entity/siblings', [SearchController::class, 'searchSiblings']);
 202
 203     // User Search
 204     Route::get('/search/users/select', [UserSearchController::class, 'forSelect']);
 205
 206     // Template System
 207     Route::get('/templates', [PageTemplateController::class, 'list']);
 208     Route::get('/templates/{templateId}', [PageTemplateController::class, 'get']);
 209
 210     // Favourites
 211     Route::get('/favourites', [FavouriteController::class, 'index']);
 212     Route::post('/favourites/add', [FavouriteController::class, 'add']);
 213     Route::post('/favourites/remove', [FavouriteController::class, 'remove']);
 214
 215     // Other Pages
 216     Route::get('/', [HomeController::class, 'index']);
 217     Route::get('/home', [HomeController::class, 'index']);
 218
 219     // Maintenance
 220     Route::get('/settings/maintenance', [MaintenanceController::class, 'index']);
 221     Route::delete('/settings/maintenance/cleanup-images', [MaintenanceController::class, 'cleanupImages']);
 222     Route::post('/settings/maintenance/send-test-email', [MaintenanceController::class, 'sendTestEmail']);
 223
 224     // Recycle Bin
 225     Route::get('/settings/recycle-bin', [RecycleBinController::class, 'index']);
 226     Route::post('/settings/recycle-bin/empty', [RecycleBinController::class, 'empty']);
 227     Route::get('/settings/recycle-bin/{id}/destroy', [RecycleBinController::class, 'showDestroy']);
 228     Route::delete('/settings/recycle-bin/{id}', [RecycleBinController::class, 'destroy']);
 229     Route::get('/settings/recycle-bin/{id}/restore', [RecycleBinController::class, 'showRestore']);
 230     Route::post('/settings/recycle-bin/{id}/restore', [RecycleBinController::class, 'restore']);
 231
 232     // Audit Log
 233     Route::get('/settings/audit', [AuditLogController::class, 'index']);
 234
 235     // Users
 236     Route::get('/settings/users', [UserController::class, 'index']);
 237     Route::get('/settings/users/create', [UserController::class, 'create']);
 238     Route::get('/settings/users/{id}/delete', [UserController::class, 'delete']);
 239     Route::patch('/settings/users/{id}/switch-books-view', [UserController::class, 'switchBooksView']);
 240     Route::patch('/settings/users/{id}/switch-shelves-view', [UserController::class, 'switchShelvesView']);
 241     Route::patch('/settings/users/{id}/switch-shelf-view', [UserController::class, 'switchShelfView']);
 242     Route::patch('/settings/users/{id}/change-sort/{type}', [UserController::class, 'changeSort']);
 243     Route::patch('/settings/users/{id}/update-expansion-preference/{key}', [UserController::class, 'updateExpansionPreference']);
 244     Route::patch('/settings/users/toggle-dark-mode', [UserController::class, 'toggleDarkMode']);
 245     Route::post('/settings/users/create', [UserController::class, 'store']);
 246     Route::get('/settings/users/{id}', [UserController::class, 'edit']);
 247     Route::put('/settings/users/{id}', [UserController::class, 'update']);
 248     Route::delete('/settings/users/{id}', [UserController::class, 'destroy']);
 249
 250     // User API Tokens
 251     Route::get('/settings/users/{userId}/create-api-token', [UserApiTokenController::class, 'create']);
 252     Route::post('/settings/users/{userId}/create-api-token', [UserApiTokenController::class, 'store']);
 253     Route::get('/settings/users/{userId}/api-tokens/{tokenId}', [UserApiTokenController::class, 'edit']);
 254     Route::put('/settings/users/{userId}/api-tokens/{tokenId}', [UserApiTokenController::class, 'update']);
 255     Route::get('/settings/users/{userId}/api-tokens/{tokenId}/delete', [UserApiTokenController::class, 'delete']);
 256     Route::delete('/settings/users/{userId}/api-tokens/{tokenId}', [UserApiTokenController::class, 'destroy']);
 257
 258     // Roles
 259     Route::get('/settings/roles', [RoleController::class, 'index']);
 260     Route::get('/settings/roles/new', [RoleController::class, 'create']);
 261     Route::post('/settings/roles/new', [RoleController::class, 'store']);
 262     Route::get('/settings/roles/delete/{id}', [RoleController::class, 'showDelete']);
 263     Route::delete('/settings/roles/delete/{id}', [RoleController::class, 'delete']);
 264     Route::get('/settings/roles/{id}', [RoleController::class, 'edit']);
 265     Route::put('/settings/roles/{id}', [RoleController::class, 'update']);
 266
 267     // Webhooks
 268     Route::get('/settings/webhooks', [WebhookController::class, 'index']);
 269     Route::get('/settings/webhooks/create', [WebhookController::class, 'create']);
 270     Route::post('/settings/webhooks/create', [WebhookController::class, 'store']);
 271     Route::get('/settings/webhooks/{id}', [WebhookController::class, 'edit']);
 272     Route::put('/settings/webhooks/{id}', [WebhookController::class, 'update']);
 273     Route::get('/settings/webhooks/{id}/delete', [WebhookController::class, 'delete']);
 274     Route::delete('/settings/webhooks/{id}', [WebhookController::class, 'destroy']);
 275
 276     // Settings
 277     Route::get('/settings', [SettingController::class, 'index'])->name('settings');
 278     Route::get('/settings/{category}', [SettingController::class, 'category'])->name('settings.category');
 279     Route::post('/settings/{category}', [SettingController::class, 'update']);
 280 });
 281
 282 // MFA routes
 283 Route::middleware('mfa-setup')->group(function () {
 284     Route::get('/mfa/setup', [Auth\MfaController::class, 'setup']);
 285     Route::get('/mfa/totp/generate', [Auth\MfaTotpController::class, 'generate']);
 286     Route::post('/mfa/totp/confirm', [Auth\MfaTotpController::class, 'confirm']);
 287     Route::get('/mfa/backup_codes/generate', [Auth\MfaBackupCodesController::class, 'generate']);
 288     Route::post('/mfa/backup_codes/confirm', [Auth\MfaBackupCodesController::class, 'confirm']);
 289 });
 290 Route::middleware('guest')->group(function () {
 291     Route::get('/mfa/verify', [Auth\MfaController::class, 'verify']);
 292     Route::post('/mfa/totp/verify', [Auth\MfaTotpController::class, 'verify']);
 293     Route::post('/mfa/backup_codes/verify', [Auth\MfaBackupCodesController::class, 'verify']);
 294 });
 295 Route::delete('/mfa/{method}/remove', [Auth\MfaController::class, 'remove'])->middleware('auth');
 296
 297 // Social auth routes
 298 Route::get('/login/service/{socialDriver}', [Auth\SocialController::class, 'login']);
 299 Route::get('/login/service/{socialDriver}/callback', [Auth\SocialController::class, 'callback']);
 300 Route::post('/login/service/{socialDriver}/detach', [Auth\SocialController::class, 'detach'])->middleware('auth');
 301 Route::get('/register/service/{socialDriver}', [Auth\SocialController::class, 'register']);
 302
 303 // Login/Logout routes
 304 Route::get('/login', [Auth\LoginController::class, 'getLogin']);
 305 Route::post('/login', [Auth\LoginController::class, 'login']);
 306 Route::post('/logout', [Auth\LoginController::class, 'logout']);
 307 Route::get('/register', [Auth\RegisterController::class, 'getRegister']);
 308 Route::get('/register/confirm', [Auth\ConfirmEmailController::class, 'show']);
 309 Route::get('/register/confirm/awaiting', [Auth\ConfirmEmailController::class, 'showAwaiting']);
 310 Route::post('/register/confirm/resend', [Auth\ConfirmEmailController::class, 'resend']);
 311 Route::get('/register/confirm/{token}', [Auth\ConfirmEmailController::class, 'confirm']);
 312 Route::post('/register', [Auth\RegisterController::class, 'postRegister']);
 313
 314 // SAML routes
 315 Route::post('/saml2/login', [Auth\Saml2Controller::class, 'login']);
 316 Route::post('/saml2/logout', [Auth\Saml2Controller::class, 'logout']);
 317 Route::get('/saml2/metadata', [Auth\Saml2Controller::class, 'metadata']);
 318 Route::get('/saml2/sls', [Auth\Saml2Controller::class, 'sls']);
 319 Route::post('/saml2/acs', [Auth\Saml2Controller::class, 'startAcs'])->withoutMiddleware([
 320     StartSession::class,
 321     ShareErrorsFromSession::class,
 322     VerifyCsrfToken::class,
 323 ]);
 324 Route::get('/saml2/acs', [Auth\Saml2Controller::class, 'processAcs']);
 325
 326 // OIDC routes
 327 Route::post('/oidc/login', [Auth\OidcController::class, 'login']);
 328 Route::get('/oidc/callback', [Auth\OidcController::class, 'callback']);
 329
 330 // User invitation routes
 331 Route::get('/register/invite/{token}', [Auth\UserInviteController::class, 'showSetPassword']);
 332 Route::post('/register/invite/{token}', [Auth\UserInviteController::class, 'setPassword']);
 333
 334 // Password reset link request routes
 335 Route::get('/password/email', [Auth\ForgotPasswordController::class, 'showLinkRequestForm']);
 336 Route::post('/password/email', [Auth\ForgotPasswordController::class, 'sendResetLinkEmail']);
 337
 338 // Password reset routes
 339 Route::get('/password/reset/{token}', [Auth\ResetPasswordController::class, 'showResetForm']);
 340 Route::post('/password/reset', [Auth\ResetPasswordController::class, 'reset']);
 341
 342 // Metadata routes
 343 Route::view('/help/wysiwyg', 'help.wysiwyg');
 344
 345 Route::fallback([HomeController::class, 'notFound'])->name('fallback');