codecombat/server/routes/index.coffee

137 lines
8.8 KiB
CoffeeScript
Raw Normal View History

2015-12-16 20:09:22 -05:00
mw = require '../middleware'
2015-12-14 14:10:37 -05:00
module.exports.setup = (app) ->
2016-06-01 12:53:16 -04:00
passport = require('passport')
app.post('/auth/login', passport.authenticate('local'), mw.auth.afterLogin)
app.post('/auth/login-facebook', mw.auth.loginByFacebook, mw.auth.afterLogin)
app.post('/auth/login-gplus', mw.auth.loginByGPlus, mw.auth.afterLogin)
app.post('/auth/logout', mw.auth.logout)
app.get('/auth/name/?(:name)?', mw.auth.name)
2016-06-30 18:32:58 -04:00
app.get('/auth/email/?(:email)?', mw.auth.email)
app.post('/auth/reset', mw.auth.reset)
app.post('/auth/spy', mw.auth.spy)
app.post('/auth/stop-spying', mw.auth.stopSpying)
app.get('/auth/unsubscribe', mw.auth.unsubscribe)
app.get('/auth/whoami', mw.auth.whoAmI)
2016-06-30 18:32:58 -04:00
app.post('/contact/send-parent-signup-instructions', mw.contact.sendParentSignupInstructions)
app.delete('/db/*', mw.auth.checkHasUser())
app.patch('/db/*', mw.auth.checkHasUser())
app.post('/db/*', mw.auth.checkHasUser())
app.put('/db/*', mw.auth.checkHasUser())
2016-06-01 12:53:16 -04:00
2016-04-11 14:59:51 -04:00
Achievement = require '../models/Achievement'
app.get('/db/achievement', mw.achievements.fetchByRelated, mw.rest.get(Achievement))
app.post('/db/achievement', mw.auth.checkHasPermission(['admin', 'artisan']), mw.rest.post(Achievement))
app.get('/db/achievement/:handle', mw.rest.getByHandle(Achievement))
app.put('/db/achievement/:handle', mw.auth.checkLoggedIn(), mw.achievements.put)
app.delete('/db/achievement/:handle', mw.auth.checkHasPermission(['admin', 'artisan']), mw.rest.delete(Achievement))
app.get('/db/achievement/names', mw.named.names(Achievement))
app.post('/db/achievement/names', mw.named.names(Achievement))
2016-04-11 14:59:51 -04:00
app.get('/db/achievement/:handle/patches', mw.patchable.patches(Achievement))
app.post('/db/achievement/:handle/watchers', mw.patchable.joinWatchers(Achievement))
app.delete('/db/achievement/:handle/watchers', mw.patchable.leaveWatchers(Achievement))
2015-12-16 20:09:22 -05:00
Article = require '../models/Article'
app.get('/db/article', mw.rest.get(Article))
2016-06-01 12:53:16 -04:00
app.post('/db/article', mw.auth.checkLoggedIn(), mw.auth.checkHasPermission(['admin', 'artisan']), mw.rest.post(Article))
2015-12-16 20:09:22 -05:00
app.get('/db/article/names', mw.named.names(Article))
app.post('/db/article/names', mw.named.names(Article))
app.get('/db/article/:handle', mw.rest.getByHandle(Article))
app.put('/db/article/:handle', mw.auth.checkHasPermission(['admin']), mw.rest.put(Article))
app.patch('/db/article/:handle', mw.auth.checkHasPermission(['admin']), mw.rest.put(Article))
app.post('/db/article/:handle/new-version', mw.auth.checkLoggedIn(), mw.versions.postNewVersion(Article, { hasPermissionsOrTranslations: 'artisan' }))
app.get('/db/article/:handle/versions', mw.versions.versions(Article))
app.get('/db/article/:handle/version/?(:version)?', mw.versions.getLatestVersion(Article))
app.get('/db/article/:handle/files', mw.files.files(Article, {module: 'article'}))
app.get('/db/article/:handle/patches', mw.patchable.patches(Article))
app.post('/db/article/:handle/watchers', mw.patchable.joinWatchers(Article))
app.delete('/db/article/:handle/watchers', mw.patchable.leaveWatchers(Article))
Campaign = require '../models/Campaign'
app.post('/db/campaign', mw.auth.checkHasPermission(['admin']), mw.rest.post(Campaign))
app.get('/db/campaign', mw.campaigns.fetchByType, mw.rest.get(Campaign))
app.get('/db/campaign/names', mw.named.names(Campaign))
app.post('/db/campaign/names', mw.named.names(Campaign))
app.get('/db/campaign/:handle', mw.rest.getByHandle(Campaign))
app.put('/db/campaign/:handle', mw.campaigns.put)
app.get('/db/campaign/:handle/achievements', mw.campaigns.fetchRelatedAchievements)
app.get('/db/campaign/:handle/levels', mw.campaigns.fetchRelatedLevels)
app.get('/db/campaign/:handle/patches', mw.patchable.patches(Campaign))
app.get('/db/campaign/-/overworld', mw.campaigns.fetchOverworld)
app.post('/db/classroom', mw.classrooms.post)
Improve student account recovery This adds the ability to verify email addresses of a user, so we know they have access to the email address on their account. Until a user has verified their email address, any teacher of a class they're in can reset their password for them via the Teacher Dashboard. When a user's email address is verified, a teacher may trigger a password recovery email to be sent to the student. Verification links are valid forever, until the user changes the email address they have on file. They are created using a timestamp, with a sha256 of timestamp+salt+userID+email. Currently the hash value is rather long, could be shorter. Squashed commit messages: Add server endpoints for verifying email address Add server endpoints for verifying email address (pt 2) Add Server+Client endpoint for sending verification email Add client view for verification links Add Edit Student Modal for resetting passwords Add specs for EditStudentModal Tweak method name in EditStudentModal Add edit student button to TeacherClassView Fix up frontend for teacher password resetting Add middleware for teacher password resetting Improve button UX in EditStudentModal Add JoinClassModal Add welcome emails, use broad name Use email without domain as fallback instead of full email Fetch user on edit student modal open Don't allow password reset if student email is verified Set role to student on user signup with classCode Tweak interface for joinClassModal Add button to request verification email for yourself Fix verify email template ID Move text to en.coffee Minor tweaks Fix code review comments Fix some tests, disable a broken one Fix misc tests Fix more tests Refactor recovery email sending to auth Fix overbroad sass Add options to refactored recovery email function Rename getByCode to fetchByCode Fix error message Fix up error handling in users middleware Use .get instead of .toObject Use findById Fix more code review comments Disable still-broken test
2016-05-11 17:39:26 -04:00
app.get('/db/classroom', mw.classrooms.fetchByCode, mw.classrooms.getByOwner)
2016-04-13 12:54:24 -04:00
app.get('/db/classroom/:handle/levels', mw.classrooms.fetchAllLevels)
app.get('/db/classroom/:handle/courses/:courseID/levels', mw.classrooms.fetchLevelsForCourse)
app.post('/db/classroom/:handle/invite-members', mw.classrooms.inviteMembers)
2016-03-30 16:57:19 -04:00
app.get('/db/classroom/:handle/member-sessions', mw.classrooms.fetchMemberSessions)
app.get('/db/classroom/:handle/members', mw.classrooms.fetchMembers) # TODO: Use mw.auth?
app.post('/db/classroom/:classroomID/members/:memberID/reset-password', mw.classrooms.setStudentPassword)
app.post('/db/classroom/:anything/members', mw.auth.checkLoggedIn(), mw.classrooms.join)
app.post('/db/classroom/:handle/update-courses', mw.classrooms.updateCourses)
app.get('/db/classroom/:handle', mw.auth.checkLoggedIn()) # TODO: Finish migrating route, adding now so 401 is returned
2016-06-21 12:29:41 -04:00
app.get('/db/classroom/-/users', mw.auth.checkHasPermission(['admin']), mw.classrooms.getUsers)
CodeLog = require ('../models/CodeLog')
2016-06-01 12:53:16 -04:00
app.post('/db/codelogs', mw.codelogs.post)
app.get('/db/codelogs', mw.auth.checkHasPermission(['admin']), mw.rest.get(CodeLog))
2016-03-30 16:57:19 -04:00
Course = require '../models/Course'
app.get('/db/course', mw.courses.get(Course))
app.get('/db/course/names', mw.named.names(Course))
app.post('/db/course/names', mw.named.names(Course))
app.put('/db/course/:handle', mw.auth.checkHasPermission(['admin', 'artisan']), mw.rest.put(Course))
2016-03-30 16:57:19 -04:00
app.get('/db/course/:handle', mw.rest.getByHandle(Course))
app.get('/db/course/:handle/level-solutions', mw.courses.fetchLevelSolutions)
app.get('/db/course/:handle/levels/:levelOriginal/next', mw.courses.fetchNextLevel)
app.post('/db/course/:handle/patch', mw.auth.checkLoggedIn(), mw.courses.postPatch)
app.get('/db/course/:handle/patches', mw.patchable.patches(Course))
app.get('/db/course_instance/-/non-hoc', mw.auth.checkHasPermission(['admin']), mw.courseInstances.fetchNonHoc)
app.post('/db/course_instance/-/recent', mw.auth.checkHasPermission(['admin']), mw.courseInstances.fetchRecent)
app.get('/db/course_instance/:handle/levels/:levelOriginal/sessions/:sessionID/next', mw.courseInstances.fetchNextLevel)
2016-03-30 16:57:19 -04:00
app.post('/db/course_instance/:handle/members', mw.auth.checkLoggedIn(), mw.courseInstances.addMembers)
2016-04-13 12:54:24 -04:00
app.get('/db/course_instance/:handle/classroom', mw.auth.checkLoggedIn(), mw.courseInstances.fetchClassroom)
app.get('/db/course_instance/:handle/course', mw.auth.checkLoggedIn(), mw.courseInstances.fetchCourse)
2016-08-25 18:24:27 -04:00
EarnedAchievement = require '../models/EarnedAchievement'
app.post('/db/earned_achievement', mw.earnedAchievements.post)
Level = require '../models/Level'
app.post('/db/level/:handle', mw.auth.checkLoggedIn(), mw.versions.postNewVersion(Level, { hasPermissionsOrTranslations: 'artisan' })) # TODO: add /new-version to route like Article has
app.get('/db/level/:handle/session', mw.auth.checkHasUser(), mw.levels.upsertSession)
app.put('/db/user/:handle', mw.users.resetEmailVerifiedFlag)
Stuff Partially fix ActivateLicensesModal.spec [IN PROGRESS] Don't display deleted users Move userID to classroom.deletedMembers on user delete (not retroactive) Fix PDF links for course guides, remove old PDFs from repo Remove deprecated SalesView Remove underline for not-yet-linked student names Only show class select when there's more than one Ignore case when sorting student names Use student.broadName instead of name for display and sorting Fix initial load not showing progress after joining a course (hacky) Fix text entry for enrollment number input Fix enrollment statistics Fix enrollment stats completely (and add back in per-class unenrolled count) Add deletedMembers to classroom schema More fixes to enrollment stats (don't count nonmember prepaids) Don't use 0 as implicit false for openSpots Update suggested number of credit to buy automatically Fix classroom edit form ignoring cleared values Add alert text when more users selected than enrollments available Alert user when trying to assign course to unenrolled students Alert user when assigning course to nobody Add some tests for TeacherClassView bulk assign alerts Fix TeacherClassView tests failing without demos Use model/collection.fakeRequests :D Remove unused comment Fix handling of improperly sorted deleted users on clientside Add test for moving deleted users to deletedMembers Add script for moving all deleted classroom members to classroom.deletedMembers Completely rewrite tallying up enrollment statistics Fix some tests to not be dependent on logged-in user Address PR comments Fix default number of enrollments to buy Fix i18n for not enough enrollments Use custom error message for classroom name length
2016-04-07 17:55:42 -04:00
app.delete('/db/user/:handle', mw.users.removeFromClassrooms)
app.get('/db/user', mw.users.fetchByGPlusID, mw.users.fetchByFacebookID)
app.put('/db/user/-/become-student', mw.users.becomeStudent)
app.put('/db/user/-/remain-teacher', mw.users.remainTeacher)
Improve student account recovery This adds the ability to verify email addresses of a user, so we know they have access to the email address on their account. Until a user has verified their email address, any teacher of a class they're in can reset their password for them via the Teacher Dashboard. When a user's email address is verified, a teacher may trigger a password recovery email to be sent to the student. Verification links are valid forever, until the user changes the email address they have on file. They are created using a timestamp, with a sha256 of timestamp+salt+userID+email. Currently the hash value is rather long, could be shorter. Squashed commit messages: Add server endpoints for verifying email address Add server endpoints for verifying email address (pt 2) Add Server+Client endpoint for sending verification email Add client view for verification links Add Edit Student Modal for resetting passwords Add specs for EditStudentModal Tweak method name in EditStudentModal Add edit student button to TeacherClassView Fix up frontend for teacher password resetting Add middleware for teacher password resetting Improve button UX in EditStudentModal Add JoinClassModal Add welcome emails, use broad name Use email without domain as fallback instead of full email Fetch user on edit student modal open Don't allow password reset if student email is verified Set role to student on user signup with classCode Tweak interface for joinClassModal Add button to request verification email for yourself Fix verify email template ID Move text to en.coffee Minor tweaks Fix code review comments Fix some tests, disable a broken one Fix misc tests Fix more tests Refactor recovery email sending to auth Fix overbroad sass Add options to refactored recovery email function Rename getByCode to fetchByCode Fix error message Fix up error handling in users middleware Use .get instead of .toObject Use findById Fix more code review comments Disable still-broken test
2016-05-11 17:39:26 -04:00
app.post('/db/user/:userID/request-verify-email', mw.users.sendVerificationEmail)
app.post('/db/user/:userID/verify/:verificationCode', mw.users.verifyEmailAddress) # TODO: Finalize URL scheme
2016-06-21 12:29:41 -04:00
app.get('/db/user/-/students', mw.auth.checkHasPermission(['admin']), mw.users.getStudents)
app.get('/db/user/-/teachers', mw.auth.checkHasPermission(['admin']), mw.users.getTeachers)
2016-06-30 18:32:58 -04:00
app.post('/db/user/:handle/signup-with-facebook', mw.users.signupWithFacebook)
app.post('/db/user/:handle/signup-with-gplus', mw.users.signupWithGPlus)
app.post('/db/user/:handle/signup-with-password', mw.users.signupWithPassword)
app.post('/db/user/:handle/destudent', mw.auth.checkHasPermission(['admin']), mw.users.destudent)
app.post('/db/user/:handle/deteacher', mw.auth.checkHasPermission(['admin']), mw.users.deteacher)
app.get('/db/prepaid', mw.auth.checkLoggedIn(), mw.prepaids.fetchByCreator)
2016-07-18 12:41:42 -04:00
app.get('/db/prepaid/-/active-schools', mw.auth.checkHasPermission(['admin']), mw.prepaids.fetchActiveSchools)
app.post('/db/prepaid', mw.auth.checkHasPermission(['admin']), mw.prepaids.post)
app.post('/db/prepaid/:handle/redeemers', mw.prepaids.redeem)
2015-12-16 20:09:22 -05:00
2015-12-29 00:03:43 -05:00
app.get '/db/products', require('./db/product').get
2016-03-09 19:59:25 -05:00
TrialRequest = require '../models/TrialRequest'
app.get('/db/trial.request', mw.trialRequests.fetchByApplicant, mw.auth.checkHasPermission(['admin']), mw.rest.get(TrialRequest))
app.post('/db/trial.request', mw.trialRequests.post)
2016-03-09 19:59:25 -05:00
app.get('/db/trial.request/:handle', mw.auth.checkHasPermission(['admin']), mw.rest.getByHandle(TrialRequest))
app.put('/db/trial.request/:handle', mw.auth.checkHasPermission(['admin']), mw.trialRequests.put)
2016-06-21 12:29:41 -04:00
app.get('/db/trial.request/-/users', mw.auth.checkHasPermission(['admin']), mw.trialRequests.getUsers)
2015-12-29 00:03:43 -05:00
app.get('/healthcheck', mw.healthcheck)