Show right permission pages on the list

lib/models/bookmark.js

@@ -12,32 +12,32 @@ module.exports = function(crowi) {
   });
   bookmarkSchema.index({page: 1, user: 1}, {unique: true});
 
-  bookmarkSchema.statics.populatePage = function(bookmarks) {
+  bookmarkSchema.statics.populatePage = function(bookmarks, requestUser) {
     var Bookmark = this;
     var User = crowi.model('User');
     var Page = crowi.model('Page');
 
-    return new Promise(function(resolve, reject) {
-      Bookmark.populate(bookmarks, {path: 'page'}, function(err, bookmarks) {
-        if (err) {
-          return reject(err);
-        }
-
-        Bookmark.populate(bookmarks, {path: 'page.revision', model: 'Revision'}, function(err, bookmarks) {
-          if (err) {
-            return reject(err);
+    requestUser = requestUser || null;
+
+    // mongoose promise に置き換えてみたものの、こいつは not native promise but original promise だったので
+    // これ以上は置き換えないことにする ...
+    // @see http://eddywashere.com/blog/switching-out-callbacks-with-promises-in-mongoose/
+    return Bookmark.populate(bookmarks, {path: 'page'})
+      .then(function(bookmarks) {
+        return Bookmark.populate(bookmarks, {path: 'page.revision', model: 'Revision'});
+      }).then(function(bookmarks) {
+        // hmm...
+        bookmarks = bookmarks.filter(function(bookmark) {
+          // requestUser を指定しない場合 public のみを返す
+          if (requestUser === null) {
+            return bookmark.page.isPublic();
           }
 
-          Bookmark.populate(bookmarks, {path: 'page.revision.author', model: 'User', select: User.USER_PUBLIC_FIELDS}, function(err, bookmarks) {
-            if (err) {
-              return reject(err);
-            }
-
-            return resolve(bookmarks);
-          });
+          return bookmark.page.isGrantedFor(requestUser);
         });
+
+        return Bookmark.populate(bookmarks, {path: 'page.revision.author', model: 'User', select: User.USER_PUBLIC_FIELDS});
       });
-    });
   };
 
   // bookmark チェック用
@@ -55,9 +55,19 @@ module.exports = function(crowi) {
     });
   };
 
+  /**
+   * option = {
+   *  limit: Int
+   *  offset: Int
+   *  requestUser: User
+   * }
+   */
   bookmarkSchema.statics.findByUser = function(user, option) {
     var User = crowi.model('User');
     var Bookmark = this;
+    var requestUser = option.requestUser || null;
+
+    debug('Finding bookmark with requesting user:', requestUser);
 
     var limit = option.limit || 50;
     var offset = option.offset || 0;
@@ -78,7 +88,7 @@ module.exports = function(crowi) {
             return resolve(bookmarks);
           }
 
-          return Bookmark.populatePage(bookmarks).then(resolve).catch(reject);
+          return Bookmark.populatePage(bookmarks, requestUser).then(resolve);
         });
     });
   };

lib/routes/page.js

@@ -133,7 +133,7 @@ module.exports = function(crowi, app) {
           userData = data;
           renderVars.pageUser = userData;
 
-          return Bookmark.findByUser(userData, {limit: 10, populatePage: true});
+          return Bookmark.findByUser(userData, {limit: 10, populatePage: true, requestUser: req.user});
         }).then(function(bookmarkList) {
           debug(bookmarkList);
           renderVars.bookmarkList = bookmarkList;
@@ -276,7 +276,7 @@ module.exports = function(crowi, app) {
     var renderVars = {};
 
     var pagerOptions = { offset: offset, limit : limit };
-    var queryOptions = { offset: offset, limit : limit + 1, populatePage: true};
+    var queryOptions = { offset: offset, limit : limit + 1, populatePage: true, requestUser: req.user};
 
     User.findUserByUsername(username)
     .then(function(user) {