BookStack Code Mirror - bookstack/blob - app/Entities/Controllers/PageApiController.php

   1 <?php
   2
   3 namespace BookStack\Entities\Controllers;
   4
   5 use BookStack\Entities\Queries\EntityQueries;
   6 use BookStack\Entities\Queries\PageQueries;
   7 use BookStack\Entities\Repos\PageRepo;
   8 use BookStack\Exceptions\PermissionsException;
   9 use BookStack\Http\ApiController;
  10 use BookStack\Permissions\Permission;
  11 use Exception;
  12 use Illuminate\Http\Request;
  13
  14 class PageApiController extends ApiController
  15 {
  16     protected array $rules = [
  17         'create' => [
  18             'book_id'    => ['required_without:chapter_id', 'integer'],
  19             'chapter_id' => ['required_without:book_id', 'integer'],
  20             'name'       => ['required', 'string', 'max:255'],
  21             'html'       => ['required_without:markdown', 'string'],
  22             'markdown'   => ['required_without:html', 'string'],
  23             'tags'       => ['array'],
  24             'priority'   => ['integer'],
  25         ],
  26         'update' => [
  27             'book_id'    => ['integer'],
  28             'chapter_id' => ['integer'],
  29             'name'       => ['string', 'min:1', 'max:255'],
  30             'html'       => ['string'],
  31             'markdown'   => ['string'],
  32             'tags'       => ['array'],
  33             'priority'   => ['integer'],
  34         ],
  35     ];
  36
  37     public function __construct(
  38         protected PageRepo $pageRepo,
  39         protected PageQueries $queries,
  40         protected EntityQueries $entityQueries,
  41     ) {
  42     }
  43
  44     /**
  45      * Get a listing of pages visible to the user.
  46      */
  47     public function list()
  48     {
  49         $pages = $this->queries->visibleForList()
  50             ->addSelect(['created_by', 'updated_by', 'revision_count', 'editor']);
  51
  52         return $this->apiListingResponse($pages, [
  53             'id', 'book_id', 'chapter_id', 'name', 'slug', 'priority',
  54             'draft', 'template',
  55             'created_at', 'updated_at',
  56             'created_by', 'updated_by', 'owned_by',
  57         ]);
  58     }
  59
  60     /**
  61      * Create a new page in the system.
  62      *
  63      * The ID of a parent book or chapter is required to indicate
  64      * where this page should be located.
  65      *
  66      * Any HTML content provided should be kept to a single-block depth of plain HTML
  67      * elements to remain compatible with the BookStack front-end and editors.
  68      * Any images included via base64 data URIs will be extracted and saved as gallery
  69      * images against the page during upload.
  70      */
  71     public function create(Request $request)
  72     {
  73         $this->validate($request, $this->rules['create']);
  74
  75         if ($request->has('chapter_id')) {
  76             $parent = $this->entityQueries->chapters->findVisibleByIdOrFail(intval($request->get('chapter_id')));
  77         } else {
  78             $parent = $this->entityQueries->books->findVisibleByIdOrFail(intval($request->get('book_id')));
  79         }
  80         $this->checkOwnablePermission(Permission::PageCreate, $parent);
  81
  82         $draft = $this->pageRepo->getNewDraftPage($parent);
  83         $this->pageRepo->publishDraft($draft, $request->only(array_keys($this->rules['create'])));
  84
  85         return response()->json($draft->forJsonDisplay());
  86     }
  87
  88     /**
  89      * View the details of a single page.
  90      * Pages will always have HTML content. They may have markdown content
  91      * if the markdown editor was used to last update the page.
  92      *
  93      * The 'html' property is the fully rendered & escaped HTML content that BookStack
  94      * would show on page view, with page includes handled.
  95      * The 'raw_html' property is the direct database stored HTML content, which would be
  96      * what BookStack shows on page edit.
  97      *
  98      * See the "Content Security" section of these docs for security considerations when using
  99      * the page content returned from this endpoint.
 100      */
 101     public function read(string $id)
 102     {
 103         $page = $this->queries->findVisibleByIdOrFail($id);
 104
 105         return response()->json($page->forJsonDisplay());
 106     }
 107
 108     /**
 109      * Update the details of a single page.
 110      *
 111      * See the 'create' action for details on the provided HTML/Markdown.
 112      * Providing a 'book_id' or 'chapter_id' property will essentially move
 113      * the page into that parent element if you have permissions to do so.
 114      */
 115     public function update(Request $request, string $id)
 116     {
 117         $requestData = $this->validate($request, $this->rules['update']);
 118
 119         $page = $this->queries->findVisibleByIdOrFail($id);
 120         $this->checkOwnablePermission(Permission::PageUpdate, $page);
 121
 122         $parent = null;
 123         if ($request->has('chapter_id')) {
 124             $parent = $this->entityQueries->chapters->findVisibleByIdOrFail(intval($request->get('chapter_id')));
 125         } elseif ($request->has('book_id')) {
 126             $parent = $this->entityQueries->books->findVisibleByIdOrFail(intval($request->get('book_id')));
 127         }
 128
 129         if ($parent && !$parent->matches($page->getParent())) {
 130             $this->checkOwnablePermission(Permission::PageDelete, $page);
 131
 132             try {
 133                 $this->pageRepo->move($page, $parent->getType() . ':' . $parent->id);
 134             } catch (Exception $exception) {
 135                 if ($exception instanceof  PermissionsException) {
 136                     $this->showPermissionError();
 137                 }
 138
 139                 return $this->jsonError(trans('errors.selected_book_chapter_not_found'));
 140             }
 141         }
 142
 143         $updatedPage = $this->pageRepo->update($page, $requestData);
 144
 145         return response()->json($updatedPage->forJsonDisplay());
 146     }
 147
 148     /**
 149      * Delete a page.
 150      * This will typically send the page to the recycle bin.
 151      */
 152     public function delete(string $id)
 153     {
 154         $page = $this->queries->findVisibleByIdOrFail($id);
 155         $this->checkOwnablePermission(Permission::PageDelete, $page);
 156
 157         $this->pageRepo->destroy($page);
 158
 159         return response('', 204);
 160     }
 161 }