Merge pull request #1218 from weseek/master

release v3.5.15

CHANGES.md

@@ -1,7 +1,10 @@
 # CHANGES
 
+## 3.5.15-RC
 
-## 3.5.14-RC
+* 
+
+## 3.5.14
 
 * Feature: Import/Export Page data
 * Fix: The link to Sandbox on Markdown Help Modal doesn't work

package.json

@@ -1,6 +1,6 @@
 {
   "name": "growi",
-  "version": "3.5.14-RC",
+  "version": "3.5.15-RC",
   "description": "Team collaboration software using markdown",
   "tags": [
     "wiki",

src/client/js/components/Admin/Export/ExportPage.jsx

@@ -49,7 +49,7 @@ class ExportPage extends React.Component {
 
   async onZipFileStatRemove(fileName) {
     try {
-      await this.props.appContainer.apiRequest('delete', `/v3/export/${fileName}`, {});
+      await this.props.appContainer.apiDelete(`/v3/export/${fileName}`, {});
 
       this.setState((prevState) => {
         return {

src/client/js/components/Admin/Export/ExportTableMenu.jsx

@@ -24,7 +24,7 @@ class ExportTableMenu extends React.Component {
             </a>
           </li>
           <li>
-            <a type="button" href="#" onClick={() => this.props.onZipFileStatRemove(this.props.fileName)}>
+            <a type="button" role="button" onClick={() => this.props.onZipFileStatRemove(this.props.fileName)}>
               <span className="text-danger"><i className="icon-trash" /> {t('export_management.delete')}</span>
             </a>
           </li>

src/client/js/components/Admin/Import/GrowiZipImportSection.jsx

@@ -36,7 +36,7 @@ class GrowiZipImportSection extends React.Component {
   async discardData() {
     try {
       const { fileName } = this.state;
-      await this.props.appContainer.apiRequest('delete', `/v3/import/${this.state.fileName}`, {});
+      await this.props.appContainer.apiDelete(`/v3/import/${this.state.fileName}`, {});
       this.resetState();
 
       // TODO: toastSuccess, toastError

src/client/js/services/AppContainer.js

@@ -67,6 +67,7 @@ export default class AppContainer extends Container {
     this.fetchUsers = this.fetchUsers.bind(this);
     this.apiGet = this.apiGet.bind(this);
     this.apiPost = this.apiPost.bind(this);
+    this.apiDelete = this.apiDelete.bind(this);
     this.apiRequest = this.apiRequest.bind(this);
   }
 
@@ -278,11 +279,11 @@ export default class AppContainer extends Container {
     targetComponent.launchHandsontableModal(beginLineNumber, endLineNumber);
   }
 
-  apiGet(path, params) {
+  async apiGet(path, params) {
     return this.apiRequest('get', path, { params });
   }
 
-  apiPost(path, params) {
+  async apiPost(path, params) {
     if (!params._csrf) {
       params._csrf = this.csrfToken;
     }
@@ -290,21 +291,20 @@ export default class AppContainer extends Container {
     return this.apiRequest('post', path, params);
   }
 
-  apiRequest(method, path, params) {
-    return new Promise((resolve, reject) => {
-      axios[method](`/_api${path}`, params)
-        .then((res) => {
-          if (res.data.ok) {
-            resolve(res.data);
-          }
-          else {
-            reject(new Error(res.data.error));
-          }
-        })
-        .catch((res) => {
-          reject(res);
-        });
-    });
+  async apiDelete(path, params) {
+    if (!params._csrf) {
+      params._csrf = this.csrfToken;
+    }
+
+    return this.apiRequest('delete', path, { data: params });
+  }
+
+  async apiRequest(method, path, params) {
+    const res = await axios[method](`/_api${path}`, params);
+    if (res.data.ok) {
+      return res.data;
+    }
+    throw new Error(res.data.error);
   }
 
 }

src/server/middleware/access-token-parser.js

@@ -0,0 +1,27 @@
+const loggerFactory = require('@alias/logger');
+
+const logger = loggerFactory('growi:middleware:access-token-parser');
+
+module.exports = (crowi) => {
+
+  return async(req, res, next) => {
+    // TODO: comply HTTP header of RFC6750 / Authorization: Bearer
+    const accessToken = req.query.access_token || req.body.access_token || null;
+    if (!accessToken) {
+      return next();
+    }
+
+    const User = crowi.model('User');
+
+    logger.debug('accessToken is', accessToken);
+
+    const user = await User.findUserByApiToken(accessToken);
+    req.user = user;
+    req.skipCsrfVerify = true;
+
+    logger.debug('Access token parsed: skipCsrfVerify');
+
+    next();
+  };
+
+};

src/server/middleware/admin-required.js

@@ -0,0 +1,24 @@
+const loggerFactory = require('@alias/logger');
+
+const logger = loggerFactory('growi:middleware:admin-required');
+
+module.exports = (crowi) => {
+
+  return async(req, res, next) => {
+    if (req.user != null && (req.user instanceof Object) && '_id' in req.user) {
+      if (req.user.admin) {
+        next();
+        return;
+      }
+
+      logger.warn('This user is not admin.');
+
+      return res.redirect('/');
+    }
+
+    logger.warn('This user has not logged in.');
+
+    return res.redirect('/login');
+  };
+
+};

src/server/middleware/csrf.js

@@ -0,0 +1,27 @@
+const loggerFactory = require('@alias/logger');
+
+const logger = loggerFactory('growi:middleware:csrf');
+
+module.exports = (crowi) => {
+
+  return async(req, res, next) => {
+    const token = req.body._csrf || req.query._csrf || null;
+    const csrfKey = (req.session && req.session.id) || 'anon';
+
+    logger.debug('req.skipCsrfVerify', req.skipCsrfVerify);
+
+    if (req.skipCsrfVerify) {
+      logger.debug('csrf verify skipped');
+      return next();
+    }
+
+    if (crowi.getTokens().verify(csrfKey, token)) {
+      logger.debug('csrf successfully verified');
+      return next();
+    }
+
+    logger.warn('csrf verification failed. return 403', csrfKey, token);
+    return res.sendStatus(403);
+  };
+
+};

src/server/middleware/login-required.js

@@ -0,0 +1,49 @@
+const loggerFactory = require('@alias/logger');
+
+const logger = loggerFactory('growi:middleware:login-required');
+
+/**
+ * require login handler
+ *
+ * @param {boolean} isGuestAllowed whethere guest user is allowed (default false)
+ */
+module.exports = (crowi, isGuestAllowed = false) => {
+
+  return function(req, res, next) {
+
+    // check the route config and ACL
+    if (isGuestAllowed && crowi.aclService.isGuestAllowedToRead()) {
+      logger.debug('Allowed to read: ', req.path);
+      return next();
+    }
+
+    const User = crowi.model('User');
+
+    // check the user logged in
+    if (req.user != null && (req.user instanceof Object) && '_id' in req.user) {
+      if (req.user.status === User.STATUS_ACTIVE) {
+        // Active の人だけ先に進める
+        return next();
+      }
+      if (req.user.status === User.STATUS_REGISTERED) {
+        return res.redirect('/login/error/registered');
+      }
+      if (req.user.status === User.STATUS_SUSPENDED) {
+        return res.redirect('/login/error/suspended');
+      }
+      if (req.user.status === User.STATUS_INVITED) {
+        return res.redirect('/login/invited');
+      }
+    }
+
+    // is api path
+    const path = req.path || '';
+    if (path.match(/^\/_api\/.+$/)) {
+      return res.sendStatus(403);
+    }
+
+    req.session.jumpTo = req.originalUrl;
+    return res.redirect('/login');
+  };
+
+};

src/server/routes/apiv3/export.js

@@ -1,6 +1,6 @@
 const loggerFactory = require('@alias/logger');
 
-const logger = loggerFactory('growi:routes:apiv3:export'); // eslint-disable-line no-unused-vars
+const logger = loggerFactory('growi:routes:apiv3:export');
 const path = require('path');
 const fs = require('fs');
 
@@ -15,6 +15,11 @@ const router = express.Router();
  */
 
 module.exports = (crowi) => {
+  const accessTokenParser = require('../../middleware/access-token-parser')(crowi);
+  const loginRequired = require('../../middleware/login-required')(crowi);
+  const adminRequired = require('../../middleware/admin-required')(crowi);
+  const csrf = require('../../middleware/csrf')(crowi);
+
   const { growiBridgeService, exportService } = crowi;
 
   /**
@@ -37,7 +42,7 @@ module.exports = (crowi) => {
    *                      type: object
    *                      description: the property of each file
    */
-  router.get('/status', async(req, res) => {
+  router.get('/status', accessTokenParser, loginRequired, adminRequired, async(req, res) => {
     const zipFileStats = await exportService.getStatus();
 
     // TODO: use res.apiv3
@@ -62,7 +67,7 @@ module.exports = (crowi) => {
    *                    type: object
    *                    description: the property of the zip file
    */
-  router.post('/', async(req, res) => {
+  router.post('/', accessTokenParser, loginRequired, adminRequired, csrf, async(req, res) => {
     // TODO: add express validator
     try {
       const { collections } = req.body;
@@ -118,7 +123,7 @@ module.exports = (crowi) => {
    *              schema:
    *                type: object
    */
-  router.delete('/:fileName', async(req, res) => {
+  router.delete('/:fileName', accessTokenParser, loginRequired, adminRequired, csrf, async(req, res) => {
     // TODO: add express validator
     const { fileName } = req.params;
 

src/server/routes/apiv3/import.js

@@ -1,9 +1,11 @@
 const loggerFactory = require('@alias/logger');
 
 const logger = loggerFactory('growi:routes:apiv3:import'); // eslint-disable-line no-unused-vars
+
 const path = require('path');
 const fs = require('fs');
 const multer = require('multer');
+
 const { ObjectId } = require('mongoose').Types;
 
 const express = require('express');
@@ -18,6 +20,11 @@ const router = express.Router();
 
 module.exports = (crowi) => {
   const { growiBridgeService, importService } = crowi;
+  const accessTokenParser = require('../../middleware/access-token-parser')(crowi);
+  const loginRequired = require('../../middleware/login-required')(crowi);
+  const adminRequired = require('../../middleware/admin-required')(crowi);
+  const csrf = require('../../middleware/csrf')(crowi);
+
   const uploads = multer({
     storage: multer.diskStorage({
       destination: (req, file, cb) => {
@@ -99,7 +106,7 @@ module.exports = (crowi) => {
    *                      type: object
    *                      description: collectionName, insertedIds, failedIds
    */
-  router.post('/', async(req, res) => {
+  router.post('/', accessTokenParser, loginRequired, adminRequired, csrf, async(req, res) => {
     // TODO: add express validator
 
     const { fileName, collections, schema } = req.body;
@@ -175,7 +182,7 @@ module.exports = (crowi) => {
    *                      type: object
    *                      description: the property of each extracted file
    */
-  router.post('/upload', uploads.single('file'), async(req, res) => {
+  router.post('/upload', uploads.single('file'), accessTokenParser, loginRequired, adminRequired, csrf, async(req, res) => {
     const { file } = req;
     const zipFile = importService.getFile(file.filename);
 
@@ -220,7 +227,7 @@ module.exports = (crowi) => {
    *              schema:
    *                type: object
    */
-  router.delete('/:fileName', async(req, res) => {
+  router.delete('/:fileName', accessTokenParser, loginRequired, adminRequired, csrf, async(req, res) => {
     const { fileName } = req.params;
 
     try {

src/server/routes/index.js

@@ -5,6 +5,12 @@ autoReap.options.reapOnError = true; // continue reaping the file even if an err
 
 module.exports = function(crowi, app) {
   const middlewares = require('../util/middlewares')(crowi, app);
+  const accessTokenParser = require('../middleware/access-token-parser')(crowi);
+  const loginRequiredStrictly = require('../middleware/login-required')(crowi);
+  const loginRequired = require('../middleware/login-required')(crowi, true);
+  const adminRequired = require('../middleware/admin-required')(crowi);
+  const csrf = require('../middleware/csrf')(crowi);
+
   const uploads = multer({ dest: `${crowi.tmpDir}uploads` });
   const form = require('../form');
   const page = require('./page')(crowi, app);
@@ -22,18 +28,12 @@ module.exports = function(crowi, app) {
   const revision = require('./revision')(crowi, app);
   const search = require('./search')(crowi, app);
   const hackmd = require('./hackmd')(crowi, app);
-  const {
-    loginRequired,
-    adminRequired,
-    accessTokenParser,
-    csrfVerify: csrf,
-  } = middlewares;
 
   const isInstalled = crowi.configManager.getConfig('crowi', 'app:installed');
 
   /* eslint-disable max-len, comma-spacing, no-multi-spaces */
 
-  app.get('/'                        , middlewares.applicationInstalled, loginRequired(false) , page.showTopPage);
+  app.get('/'                        , middlewares.applicationInstalled, loginRequired , page.showTopPage);
 
   // API v3
   app.use('/api-docs', require('./apiv3/docs')(crowi));
@@ -51,33 +51,33 @@ module.exports = function(crowi, app) {
   app.get('/login/invited'           , login.invited);
   app.post('/login/activateInvited'  , form.invited                         , csrf, login.invited);
   app.post('/login'                  , form.login                           , csrf, loginPassport.loginWithLocal, loginPassport.loginWithLdap, loginPassport.loginFailure);
-  app.post('/_api/login/testLdap'    , loginRequired() , form.login , loginPassport.testLdapCredentials);
+  app.post('/_api/login/testLdap'    , loginRequiredStrictly , form.login , loginPassport.testLdapCredentials);
 
   app.post('/register'               , form.register                        , csrf, login.register);
   app.get('/register'                , middlewares.applicationInstalled    , login.register);
   app.get('/logout'                  , logout.logout);
 
-  app.get('/admin'                          , loginRequired() , adminRequired , admin.index);
-  app.get('/admin/app'                      , loginRequired() , adminRequired , admin.app.index);
-  app.post('/_api/admin/settings/app'       , loginRequired() , adminRequired , csrf, form.admin.app, admin.api.appSetting);
-  app.post('/_api/admin/settings/siteUrl'   , loginRequired() , adminRequired , csrf, form.admin.siteUrl, admin.api.asyncAppSetting);
-  app.post('/_api/admin/settings/mail'      , loginRequired() , adminRequired , csrf, form.admin.mail, admin.api.appSetting);
-  app.post('/_api/admin/settings/aws'       , loginRequired() , adminRequired , csrf, form.admin.aws, admin.api.appSetting);
-  app.post('/_api/admin/settings/plugin'    , loginRequired() , adminRequired , csrf, form.admin.plugin, admin.api.appSetting);
+  app.get('/admin'                          , loginRequiredStrictly , adminRequired , admin.index);
+  app.get('/admin/app'                      , loginRequiredStrictly , adminRequired , admin.app.index);
+  app.post('/_api/admin/settings/app'       , loginRequiredStrictly , adminRequired , csrf, form.admin.app, admin.api.appSetting);
+  app.post('/_api/admin/settings/siteUrl'   , loginRequiredStrictly , adminRequired , csrf, form.admin.siteUrl, admin.api.asyncAppSetting);
+  app.post('/_api/admin/settings/mail'      , loginRequiredStrictly , adminRequired , csrf, form.admin.mail, admin.api.appSetting);
+  app.post('/_api/admin/settings/aws'       , loginRequiredStrictly , adminRequired , csrf, form.admin.aws, admin.api.appSetting);
+  app.post('/_api/admin/settings/plugin'    , loginRequiredStrictly , adminRequired , csrf, form.admin.plugin, admin.api.appSetting);
 
   // security admin
-  app.get('/admin/security'                     , loginRequired() , adminRequired , admin.security.index);
-  app.post('/_api/admin/security/general'       , loginRequired() , adminRequired , form.admin.securityGeneral, admin.api.securitySetting);
-  app.post('/_api/admin/security/passport-local', loginRequired() , adminRequired , csrf, form.admin.securityPassportLocal, admin.api.securityPassportLocalSetting);
-  app.post('/_api/admin/security/passport-ldap' , loginRequired() , adminRequired , csrf, form.admin.securityPassportLdap, admin.api.securityPassportLdapSetting);
-  app.post('/_api/admin/security/passport-saml' , loginRequired() , adminRequired , csrf, form.admin.securityPassportSaml, admin.api.securityPassportSamlSetting);
-  app.post('/_api/admin/security/passport-basic' , loginRequired() , adminRequired , csrf, form.admin.securityPassportBasic, admin.api.securityPassportBasicSetting);
+  app.get('/admin/security'                     , loginRequiredStrictly , adminRequired , admin.security.index);
+  app.post('/_api/admin/security/general'       , loginRequiredStrictly , adminRequired , form.admin.securityGeneral, admin.api.securitySetting);
+  app.post('/_api/admin/security/passport-local', loginRequiredStrictly , adminRequired , csrf, form.admin.securityPassportLocal, admin.api.securityPassportLocalSetting);
+  app.post('/_api/admin/security/passport-ldap' , loginRequiredStrictly , adminRequired , csrf, form.admin.securityPassportLdap, admin.api.securityPassportLdapSetting);
+  app.post('/_api/admin/security/passport-saml' , loginRequiredStrictly , adminRequired , csrf, form.admin.securityPassportSaml, admin.api.securityPassportSamlSetting);
+  app.post('/_api/admin/security/passport-basic', loginRequiredStrictly , adminRequired , csrf, form.admin.securityPassportBasic, admin.api.securityPassportBasicSetting);
 
   // OAuth
-  app.post('/_api/admin/security/passport-google' , loginRequired() , adminRequired , csrf, form.admin.securityPassportGoogle, admin.api.securityPassportGoogleSetting);
-  app.post('/_api/admin/security/passport-github' , loginRequired() , adminRequired , csrf, form.admin.securityPassportGitHub, admin.api.securityPassportGitHubSetting);
-  app.post('/_api/admin/security/passport-twitter', loginRequired() , adminRequired , csrf, form.admin.securityPassportTwitter, admin.api.securityPassportTwitterSetting);
-  app.post('/_api/admin/security/passport-oidc',    loginRequired() , adminRequired , csrf, form.admin.securityPassportOidc, admin.api.securityPassportOidcSetting);
+  app.post('/_api/admin/security/passport-google' , loginRequiredStrictly , adminRequired , csrf, form.admin.securityPassportGoogle, admin.api.securityPassportGoogleSetting);
+  app.post('/_api/admin/security/passport-github' , loginRequiredStrictly , adminRequired , csrf, form.admin.securityPassportGitHub, admin.api.securityPassportGitHubSetting);
+  app.post('/_api/admin/security/passport-twitter', loginRequiredStrictly , adminRequired , csrf, form.admin.securityPassportTwitter, admin.api.securityPassportTwitterSetting);
+  app.post('/_api/admin/security/passport-oidc',    loginRequiredStrictly , adminRequired , csrf, form.admin.securityPassportOidc, admin.api.securityPassportOidcSetting);
   app.get('/passport/google'                      , loginPassport.loginWithGoogle);
   app.get('/passport/github'                      , loginPassport.loginWithGitHub);
   app.get('/passport/twitter'                     , loginPassport.loginWithTwitter);
@@ -91,159 +91,159 @@ module.exports = function(crowi, app) {
   app.post('/passport/saml/callback'              , loginPassport.loginPassportSamlCallback);
 
   // markdown admin
-  app.get('/admin/markdown'                   , loginRequired() , adminRequired , admin.markdown.index);
-  app.post('/admin/markdown/lineBreaksSetting', loginRequired() , adminRequired , csrf, form.admin.markdown, admin.markdown.lineBreaksSetting); // change form name
-  app.post('/admin/markdown/xss-setting'      , loginRequired() , adminRequired , csrf, form.admin.markdownXss, admin.markdown.xssSetting);
-  app.post('/admin/markdown/presentationSetting', loginRequired() , adminRequired , csrf, form.admin.markdownPresentation, admin.markdown.presentationSetting);
+  app.get('/admin/markdown'                   , loginRequiredStrictly , adminRequired , admin.markdown.index);
+  app.post('/admin/markdown/lineBreaksSetting', loginRequiredStrictly , adminRequired , csrf, form.admin.markdown, admin.markdown.lineBreaksSetting); // change form name
+  app.post('/admin/markdown/xss-setting'      , loginRequiredStrictly , adminRequired , csrf, form.admin.markdownXss, admin.markdown.xssSetting);
+  app.post('/admin/markdown/presentationSetting', loginRequiredStrictly , adminRequired , csrf, form.admin.markdownPresentation, admin.markdown.presentationSetting);
 
   // markdown admin
-  app.get('/admin/customize'                , loginRequired() , adminRequired , admin.customize.index);
-  app.post('/_api/admin/customize/css'      , loginRequired() , adminRequired , csrf, form.admin.customcss, admin.api.customizeSetting);
-  app.post('/_api/admin/customize/script'   , loginRequired() , adminRequired , csrf, form.admin.customscript, admin.api.customizeSetting);
-  app.post('/_api/admin/customize/header'   , loginRequired() , adminRequired , csrf, form.admin.customheader, admin.api.customizeSetting);
-  app.post('/_api/admin/customize/theme'    , loginRequired() , adminRequired , csrf, form.admin.customtheme, admin.api.customizeSetting);
-  app.post('/_api/admin/customize/title'    , loginRequired() , adminRequired , csrf, form.admin.customtitle, admin.api.customizeSetting);
-  app.post('/_api/admin/customize/behavior' , loginRequired() , adminRequired , csrf, form.admin.custombehavior, admin.api.customizeSetting);
-  app.post('/_api/admin/customize/layout'   , loginRequired() , adminRequired , csrf, form.admin.customlayout, admin.api.customizeSetting);
-  app.post('/_api/admin/customize/features' , loginRequired() , adminRequired , csrf, form.admin.customfeatures, admin.api.customizeSetting);
-  app.post('/_api/admin/customize/highlightJsStyle' , loginRequired() , adminRequired , csrf, form.admin.customhighlightJsStyle, admin.api.customizeSetting);
+  app.get('/admin/customize'                , loginRequiredStrictly , adminRequired , admin.customize.index);
+  app.post('/_api/admin/customize/css'      , loginRequiredStrictly , adminRequired , csrf, form.admin.customcss, admin.api.customizeSetting);
+  app.post('/_api/admin/customize/script'   , loginRequiredStrictly , adminRequired , csrf, form.admin.customscript, admin.api.customizeSetting);
+  app.post('/_api/admin/customize/header'   , loginRequiredStrictly , adminRequired , csrf, form.admin.customheader, admin.api.customizeSetting);
+  app.post('/_api/admin/customize/theme'    , loginRequiredStrictly , adminRequired , csrf, form.admin.customtheme, admin.api.customizeSetting);
+  app.post('/_api/admin/customize/title'    , loginRequiredStrictly , adminRequired , csrf, form.admin.customtitle, admin.api.customizeSetting);
+  app.post('/_api/admin/customize/behavior' , loginRequiredStrictly , adminRequired , csrf, form.admin.custombehavior, admin.api.customizeSetting);
+  app.post('/_api/admin/customize/layout'   , loginRequiredStrictly , adminRequired , csrf, form.admin.customlayout, admin.api.customizeSetting);
+  app.post('/_api/admin/customize/features' , loginRequiredStrictly , adminRequired , csrf, form.admin.customfeatures, admin.api.customizeSetting);
+  app.post('/_api/admin/customize/highlightJsStyle' , loginRequiredStrictly , adminRequired , csrf, form.admin.customhighlightJsStyle, admin.api.customizeSetting);
 
   // search admin
-  app.get('/admin/search'              , loginRequired() , adminRequired , admin.search.index);
-  app.post('/_api/admin/search/build'  , loginRequired() , adminRequired , csrf, admin.api.searchBuildIndex);
+  app.get('/admin/search'              , loginRequiredStrictly , adminRequired , admin.search.index);
+  app.post('/_api/admin/search/build'  , loginRequiredStrictly , adminRequired , csrf, admin.api.searchBuildIndex);
 
   // notification admin
-  app.get('/admin/notification'              , loginRequired() , adminRequired , admin.notification.index);
-  app.post('/admin/notification/slackIwhSetting', loginRequired() , adminRequired , csrf, form.admin.slackIwhSetting, admin.notification.slackIwhSetting);
-  app.post('/admin/notification/slackSetting', loginRequired() , adminRequired , csrf, form.admin.slackSetting, admin.notification.slackSetting);
-  app.get('/admin/notification/slackAuth'    , loginRequired() , adminRequired , admin.notification.slackAuth);
-  app.get('/admin/notification/slackSetting/disconnect', loginRequired() , adminRequired , admin.notification.disconnectFromSlack);
-  app.post('/_api/admin/notification.add'    , loginRequired() , adminRequired , csrf, admin.api.notificationAdd);
-  app.post('/_api/admin/notification.remove' , loginRequired() , adminRequired , csrf, admin.api.notificationRemove);
-  app.get('/_api/admin/users.search'         , loginRequired() , adminRequired , admin.api.usersSearch);
-  app.get('/admin/global-notification/new'   , loginRequired() , adminRequired , admin.globalNotification.detail);
-  app.get('/admin/global-notification/:id'   , loginRequired() , adminRequired , admin.globalNotification.detail);
-  app.post('/admin/global-notification/new'  , loginRequired() , adminRequired , form.admin.notificationGlobal, admin.globalNotification.create);
-  app.post('/_api/admin/global-notification/toggleIsEnabled', loginRequired() , adminRequired , admin.api.toggleIsEnabledForGlobalNotification);
-  app.post('/admin/global-notification/:id/update', loginRequired() , adminRequired , form.admin.notificationGlobal, admin.globalNotification.update);
-  app.post('/admin/global-notification/:id/remove', loginRequired() , adminRequired , admin.globalNotification.remove);
-
-  app.get('/admin/users'                , loginRequired() , adminRequired , admin.user.index);
-  app.post('/admin/user/invite'         , form.admin.userInvite ,  loginRequired() , adminRequired , csrf, admin.user.invite);
-  app.post('/admin/user/:id/makeAdmin'  , loginRequired() , adminRequired , csrf, admin.user.makeAdmin);
-  app.post('/admin/user/:id/removeFromAdmin', loginRequired() , adminRequired , admin.user.removeFromAdmin);
-  app.post('/admin/user/:id/activate'   , loginRequired() , adminRequired , csrf, admin.user.activate);
-  app.post('/admin/user/:id/suspend'    , loginRequired() , adminRequired , csrf, admin.user.suspend);
-  app.post('/admin/user/:id/remove'     , loginRequired() , adminRequired , csrf, admin.user.remove);
-  app.post('/admin/user/:id/removeCompletely' , loginRequired() , adminRequired , csrf, admin.user.removeCompletely);
+  app.get('/admin/notification'              , loginRequiredStrictly , adminRequired , admin.notification.index);
+  app.post('/admin/notification/slackIwhSetting', loginRequiredStrictly , adminRequired , csrf, form.admin.slackIwhSetting, admin.notification.slackIwhSetting);
+  app.post('/admin/notification/slackSetting', loginRequiredStrictly , adminRequired , csrf, form.admin.slackSetting, admin.notification.slackSetting);
+  app.get('/admin/notification/slackAuth'    , loginRequiredStrictly , adminRequired , admin.notification.slackAuth);
+  app.get('/admin/notification/slackSetting/disconnect', loginRequiredStrictly , adminRequired , admin.notification.disconnectFromSlack);
+  app.post('/_api/admin/notification.add'    , loginRequiredStrictly , adminRequired , csrf, admin.api.notificationAdd);
+  app.post('/_api/admin/notification.remove' , loginRequiredStrictly , adminRequired , csrf, admin.api.notificationRemove);
+  app.get('/_api/admin/users.search'         , loginRequiredStrictly , adminRequired , admin.api.usersSearch);
+  app.get('/admin/global-notification/new'   , loginRequiredStrictly , adminRequired , admin.globalNotification.detail);
+  app.get('/admin/global-notification/:id'   , loginRequiredStrictly , adminRequired , admin.globalNotification.detail);
+  app.post('/admin/global-notification/new'  , loginRequiredStrictly , adminRequired , form.admin.notificationGlobal, admin.globalNotification.create);
+  app.post('/_api/admin/global-notification/toggleIsEnabled', loginRequiredStrictly , adminRequired , admin.api.toggleIsEnabledForGlobalNotification);
+  app.post('/admin/global-notification/:id/update', loginRequiredStrictly , adminRequired , form.admin.notificationGlobal, admin.globalNotification.update);
+  app.post('/admin/global-notification/:id/remove', loginRequiredStrictly , adminRequired , admin.globalNotification.remove);
+
+  app.get('/admin/users'                , loginRequiredStrictly , adminRequired , admin.user.index);
+  app.post('/admin/user/invite'         , form.admin.userInvite ,  loginRequiredStrictly , adminRequired , csrf, admin.user.invite);
+  app.post('/admin/user/:id/makeAdmin'  , loginRequiredStrictly , adminRequired , csrf, admin.user.makeAdmin);
+  app.post('/admin/user/:id/removeFromAdmin', loginRequiredStrictly , adminRequired , admin.user.removeFromAdmin);
+  app.post('/admin/user/:id/activate'   , loginRequiredStrictly , adminRequired , csrf, admin.user.activate);
+  app.post('/admin/user/:id/suspend'    , loginRequiredStrictly , adminRequired , csrf, admin.user.suspend);
+  app.post('/admin/user/:id/remove'     , loginRequiredStrictly , adminRequired , csrf, admin.user.remove);
+  app.post('/admin/user/:id/removeCompletely' , loginRequiredStrictly , adminRequired , csrf, admin.user.removeCompletely);
   // new route patterns from here:
-  app.post('/_api/admin/users.resetPassword'  , loginRequired() , adminRequired , csrf, admin.user.resetPassword);
+  app.post('/_api/admin/users.resetPassword'  , loginRequiredStrictly , adminRequired , csrf, admin.user.resetPassword);
 
-  app.get('/admin/users/external-accounts'               , loginRequired() , adminRequired , admin.externalAccount.index);
-  app.post('/admin/users/external-accounts/:id/remove'   , loginRequired() , adminRequired , admin.externalAccount.remove);
+  app.get('/admin/users/external-accounts'               , loginRequiredStrictly , adminRequired , admin.externalAccount.index);
+  app.post('/admin/users/external-accounts/:id/remove'   , loginRequiredStrictly , adminRequired , admin.externalAccount.remove);
 
   // user-groups admin
-  app.get('/admin/user-groups'             , loginRequired(), adminRequired, admin.userGroup.index);
-  app.get('/admin/user-group-detail/:id'          , loginRequired(), adminRequired, admin.userGroup.detail);
-  app.post('/admin/user-group/create'      , form.admin.userGroupCreate, loginRequired(), adminRequired, csrf, admin.userGroup.create);
-  app.post('/admin/user-group/:userGroupId/update', loginRequired(), adminRequired, csrf, admin.userGroup.update);
-  app.post('/admin/user-group.remove' , loginRequired(), adminRequired, csrf, admin.userGroup.removeCompletely);
-  app.get('/_api/admin/user-groups', loginRequired(), adminRequired, admin.api.userGroups);
+  app.get('/admin/user-groups'             , loginRequiredStrictly, adminRequired, admin.userGroup.index);
+  app.get('/admin/user-group-detail/:id'          , loginRequiredStrictly, adminRequired, admin.userGroup.detail);
+  app.post('/admin/user-group/create'      , form.admin.userGroupCreate, loginRequiredStrictly, adminRequired, csrf, admin.userGroup.create);
+  app.post('/admin/user-group/:userGroupId/update', loginRequiredStrictly, adminRequired, csrf, admin.userGroup.update);
+  app.post('/admin/user-group.remove' , loginRequiredStrictly, adminRequired, csrf, admin.userGroup.removeCompletely);
+  app.get('/_api/admin/user-groups', loginRequiredStrictly, adminRequired, admin.api.userGroups);
 
   // user-group-relations admin
-  app.post('/admin/user-group-relation/create', loginRequired(), adminRequired, csrf, admin.userGroupRelation.create);
-  app.post('/admin/user-group-relation/:id/remove-relation/:relationId', loginRequired(), adminRequired, csrf, admin.userGroupRelation.remove);
+  app.post('/admin/user-group-relation/create', loginRequiredStrictly, adminRequired, csrf, admin.userGroupRelation.create);
+  app.post('/admin/user-group-relation/:id/remove-relation/:relationId', loginRequiredStrictly, adminRequired, csrf, admin.userGroupRelation.remove);
 
   // importer management for admin
-  app.get('/admin/importer'                , loginRequired() , adminRequired , admin.importer.index);
-  app.post('/_api/admin/settings/importerEsa' , loginRequired() , adminRequired , csrf , form.admin.importerEsa , admin.api.importerSettingEsa);
-  app.post('/_api/admin/settings/importerQiita' , loginRequired() , adminRequired , csrf , form.admin.importerQiita , admin.api.importerSettingQiita);
-  app.post('/_api/admin/import/esa'        , loginRequired() , adminRequired , admin.api.importDataFromEsa);
-  app.post('/_api/admin/import/testEsaAPI' , loginRequired() , adminRequired , csrf , form.admin.importerEsa , admin.api.testEsaAPI);
-  app.post('/_api/admin/import/qiita'        , loginRequired() , adminRequired , admin.api.importDataFromQiita);
-  app.post('/_api/admin/import/testQiitaAPI' , loginRequired() , adminRequired , csrf , form.admin.importerQiita , admin.api.testQiitaAPI);
+  app.get('/admin/importer'                , loginRequiredStrictly , adminRequired , admin.importer.index);
+  app.post('/_api/admin/settings/importerEsa' , loginRequiredStrictly , adminRequired , csrf , form.admin.importerEsa , admin.api.importerSettingEsa);
+  app.post('/_api/admin/settings/importerQiita' , loginRequiredStrictly , adminRequired , csrf , form.admin.importerQiita , admin.api.importerSettingQiita);
+  app.post('/_api/admin/import/esa'        , loginRequiredStrictly , adminRequired , admin.api.importDataFromEsa);
+  app.post('/_api/admin/import/testEsaAPI' , loginRequiredStrictly , adminRequired , csrf , form.admin.importerEsa , admin.api.testEsaAPI);
+  app.post('/_api/admin/import/qiita'        , loginRequiredStrictly , adminRequired , admin.api.importDataFromQiita);
+  app.post('/_api/admin/import/testQiitaAPI' , loginRequiredStrictly , adminRequired , csrf , form.admin.importerQiita , admin.api.testQiitaAPI);
 
   // export management for admin
-  app.get('/admin/export' , loginRequired() , adminRequired ,admin.export.index);
-  app.get('/admin/export/:fileName' , loginRequired() , adminRequired ,admin.export.download);
+  app.get('/admin/export' , loginRequiredStrictly , adminRequired ,admin.export.index);
+  app.get('/admin/export/:fileName' , loginRequiredStrictly , adminRequired ,admin.export.download);
 
-  app.get('/me'                       , loginRequired() , me.index);
-  app.get('/me/password'              , loginRequired() , me.password);
-  app.get('/me/apiToken'              , loginRequired() , me.apiToken);
-  app.post('/me'                      , loginRequired() , csrf , form.me.user , me.index);
+  app.get('/me'                       , loginRequiredStrictly , me.index);
+  app.get('/me/password'              , loginRequiredStrictly , me.password);
+  app.get('/me/apiToken'              , loginRequiredStrictly , me.apiToken);
+  app.post('/me'                      , loginRequiredStrictly , csrf , form.me.user , me.index);
   // external-accounts
-  app.get('/me/external-accounts'                         , loginRequired() , me.externalAccounts.list);
-  app.post('/me/external-accounts/disassociate'           , loginRequired() , me.externalAccounts.disassociate);
-  app.post('/me/external-accounts/associateLdap'          , loginRequired() , form.login , me.externalAccounts.associateLdap);
+  app.get('/me/external-accounts'                         , loginRequiredStrictly , me.externalAccounts.list);
+  app.post('/me/external-accounts/disassociate'           , loginRequiredStrictly , me.externalAccounts.disassociate);
+  app.post('/me/external-accounts/associateLdap'          , loginRequiredStrictly , form.login , me.externalAccounts.associateLdap);
 
-  app.post('/me/password'             , form.me.password          , loginRequired() , me.password);
-  app.post('/me/imagetype'            , form.me.imagetype         , loginRequired() , me.imagetype);
-  app.post('/me/apiToken'             , form.me.apiToken          , loginRequired() , me.apiToken);
+  app.post('/me/password'             , form.me.password          , loginRequiredStrictly , me.password);
+  app.post('/me/imagetype'            , form.me.imagetype         , loginRequiredStrictly , me.imagetype);
+  app.post('/me/apiToken'             , form.me.apiToken          , loginRequiredStrictly , me.apiToken);
 
-  app.get('/:id([0-9a-z]{24})'       , loginRequired(false) , page.redirector);
-  app.get('/_r/:id([0-9a-z]{24})'    , loginRequired(false) , page.redirector); // alias
-  app.get('/attachment/:pageId/:fileName'  , loginRequired(false), attachment.api.obsoletedGetForMongoDB); // DEPRECATED: remains for backward compatibility for v3.3.x or below
-  app.get('/attachment/:id([0-9a-z]{24})'  , loginRequired(false), attachment.api.get);
-  app.get('/download/:id([0-9a-z]{24})'    , loginRequired(false), attachment.api.download);
+  app.get('/:id([0-9a-z]{24})'       , loginRequired , page.redirector);
+  app.get('/_r/:id([0-9a-z]{24})'    , loginRequired , page.redirector); // alias
+  app.get('/attachment/:pageId/:fileName'  , loginRequired, attachment.api.obsoletedGetForMongoDB); // DEPRECATED: remains for backward compatibility for v3.3.x or below
+  app.get('/attachment/:id([0-9a-z]{24})'  , loginRequired, attachment.api.get);
+  app.get('/download/:id([0-9a-z]{24})'    , loginRequired, attachment.api.download);
 
-  app.get('/_search'                 , loginRequired(false) , search.searchPage);
-  app.get('/_api/search'             , accessTokenParser , loginRequired(false) , search.api.search);
+  app.get('/_search'                 , loginRequired , search.searchPage);
+  app.get('/_api/search'             , accessTokenParser , loginRequired , search.api.search);
 
   app.get('/_api/check_username'           , user.api.checkUsername);
-  app.get('/_api/me/user-group-relations'  , accessTokenParser , loginRequired() , me.api.userGroupRelations);
-  app.get('/_api/user/bookmarks'           , loginRequired(false) , user.api.bookmarks);
+  app.get('/_api/me/user-group-relations'  , accessTokenParser , loginRequiredStrictly , me.api.userGroupRelations);
+  app.get('/_api/user/bookmarks'           , loginRequired , user.api.bookmarks);
 
   // HTTP RPC Styled API (に徐々に移行していいこうと思う)
-  app.get('/_api/users.list'          , accessTokenParser , loginRequired(false) , user.api.list);
-  app.get('/_api/pages.list'          , accessTokenParser , loginRequired(false) , page.api.list);
-  app.get('/_api/pages.recentCreated' , accessTokenParser , loginRequired(false) , page.api.recentCreated);
-  app.post('/_api/pages.create'       , accessTokenParser , loginRequired() , csrf, page.api.create);
-  app.post('/_api/pages.update'       , accessTokenParser , loginRequired() , csrf, page.api.update);
-  app.get('/_api/pages.get'           , accessTokenParser , loginRequired(false) , page.api.get);
-  app.get('/_api/pages.exist'         , accessTokenParser , loginRequired(false) , page.api.exist);
-  app.get('/_api/pages.updatePost'    , accessTokenParser, loginRequired(false), page.api.getUpdatePost);
-  app.get('/_api/pages.getPageTag'    , accessTokenParser , loginRequired(false) , page.api.getPageTag);
+  app.get('/_api/users.list'          , accessTokenParser , loginRequired , user.api.list);
+  app.get('/_api/pages.list'          , accessTokenParser , loginRequired , page.api.list);
+  app.get('/_api/pages.recentCreated' , accessTokenParser , loginRequired , page.api.recentCreated);
+  app.post('/_api/pages.create'       , accessTokenParser , loginRequiredStrictly , csrf, page.api.create);
+  app.post('/_api/pages.update'       , accessTokenParser , loginRequiredStrictly , csrf, page.api.update);
+  app.get('/_api/pages.get'           , accessTokenParser , loginRequired , page.api.get);
+  app.get('/_api/pages.exist'         , accessTokenParser , loginRequired , page.api.exist);
+  app.get('/_api/pages.updatePost'    , accessTokenParser, loginRequired, page.api.getUpdatePost);
+  app.get('/_api/pages.getPageTag'    , accessTokenParser , loginRequired , page.api.getPageTag);
   // allow posting to guests because the client doesn't know whether the user logged in
-  app.post('/_api/pages.seen'         , accessTokenParser , loginRequired(false) , page.api.seen);
-  app.post('/_api/pages.rename'       , accessTokenParser , loginRequired() , csrf, page.api.rename);
-  app.post('/_api/pages.remove'       , loginRequired() , csrf, page.api.remove); // (Avoid from API Token)
-  app.post('/_api/pages.revertRemove' , loginRequired() , csrf, page.api.revertRemove); // (Avoid from API Token)
-  app.post('/_api/pages.unlink'       , loginRequired() , csrf, page.api.unlink); // (Avoid from API Token)
-  app.post('/_api/pages.duplicate'    , accessTokenParser, loginRequired(), csrf, page.api.duplicate);
-  app.get('/tags'                     , loginRequired(false), tag.showPage);
-  app.get('/_api/tags.list'           , accessTokenParser, loginRequired(false), tag.api.list);
-  app.get('/_api/tags.search'         , accessTokenParser, loginRequired(false), tag.api.search);
-  app.post('/_api/tags.update'        , accessTokenParser, loginRequired(false), tag.api.update);
-  app.get('/_api/comments.get'        , accessTokenParser , loginRequired(false) , comment.api.get);
-  app.post('/_api/comments.add'       , comment.api.validators.add(), accessTokenParser , loginRequired() , csrf, comment.api.add);
-  app.post('/_api/comments.update'       , comment.api.validators.add(), accessTokenParser , loginRequired() , csrf, comment.api.update);
-  app.post('/_api/comments.remove'    , accessTokenParser , loginRequired() , csrf, comment.api.remove);
-  app.get('/_api/bookmarks.get'       , accessTokenParser , loginRequired(false) , bookmark.api.get);
-  app.post('/_api/bookmarks.add'      , accessTokenParser , loginRequired() , csrf, bookmark.api.add);
-  app.post('/_api/bookmarks.remove'   , accessTokenParser , loginRequired() , csrf, bookmark.api.remove);
-  app.post('/_api/likes.add'          , accessTokenParser , loginRequired() , csrf, page.api.like);
-  app.post('/_api/likes.remove'       , accessTokenParser , loginRequired() , csrf, page.api.unlike);
-  app.get('/_api/attachments.list'    , accessTokenParser , loginRequired(false) , attachment.api.list);
-  app.post('/_api/attachments.add'                  , uploads.single('file'), autoReap, accessTokenParser, loginRequired() ,csrf, attachment.api.add);
-  app.post('/_api/attachments.uploadProfileImage'   , uploads.single('file'), autoReap, accessTokenParser, loginRequired() ,csrf, attachment.api.uploadProfileImage);
-  app.post('/_api/attachments.remove'               , accessTokenParser , loginRequired() , csrf, attachment.api.remove);
-  app.post('/_api/attachments.removeProfileImage'   , accessTokenParser , loginRequired() , csrf, attachment.api.removeProfileImage);
-  app.get('/_api/attachments.limit'   , accessTokenParser , loginRequired(), attachment.api.limit);
-
-  app.get('/_api/revisions.get'       , accessTokenParser , loginRequired(false) , revision.api.get);
-  app.get('/_api/revisions.ids'       , accessTokenParser , loginRequired(false) , revision.api.ids);
-  app.get('/_api/revisions.list'      , accessTokenParser , loginRequired(false) , revision.api.list);
-
-  app.get('/trash$'                   , loginRequired(false) , page.trashPageShowWrapper);
-  app.get('/trash/$'                  , loginRequired(false) , page.trashPageListShowWrapper);
-  app.get('/trash/*/$'                , loginRequired(false) , page.deletedPageListShowWrapper);
+  app.post('/_api/pages.seen'         , accessTokenParser , loginRequired , page.api.seen);
+  app.post('/_api/pages.rename'       , accessTokenParser , loginRequiredStrictly , csrf, page.api.rename);
+  app.post('/_api/pages.remove'       , loginRequiredStrictly , csrf, page.api.remove); // (Avoid from API Token)
+  app.post('/_api/pages.revertRemove' , loginRequiredStrictly , csrf, page.api.revertRemove); // (Avoid from API Token)
+  app.post('/_api/pages.unlink'       , loginRequiredStrictly , csrf, page.api.unlink); // (Avoid from API Token)
+  app.post('/_api/pages.duplicate'    , accessTokenParser, loginRequiredStrictly, csrf, page.api.duplicate);
+  app.get('/tags'                     , loginRequired, tag.showPage);
+  app.get('/_api/tags.list'           , accessTokenParser, loginRequired, tag.api.list);
+  app.get('/_api/tags.search'         , accessTokenParser, loginRequired, tag.api.search);
+  app.post('/_api/tags.update'        , accessTokenParser, loginRequired, tag.api.update);
+  app.get('/_api/comments.get'        , accessTokenParser , loginRequired , comment.api.get);
+  app.post('/_api/comments.add'       , comment.api.validators.add(), accessTokenParser , loginRequiredStrictly , csrf, comment.api.add);
+  app.post('/_api/comments.update'    , comment.api.validators.add(), accessTokenParser , loginRequiredStrictly , csrf, comment.api.update);
+  app.post('/_api/comments.remove'    , accessTokenParser , loginRequiredStrictly , csrf, comment.api.remove);
+  app.get('/_api/bookmarks.get'       , accessTokenParser , loginRequired , bookmark.api.get);
+  app.post('/_api/bookmarks.add'      , accessTokenParser , loginRequiredStrictly , csrf, bookmark.api.add);
+  app.post('/_api/bookmarks.remove'   , accessTokenParser , loginRequiredStrictly , csrf, bookmark.api.remove);
+  app.post('/_api/likes.add'          , accessTokenParser , loginRequiredStrictly , csrf, page.api.like);
+  app.post('/_api/likes.remove'       , accessTokenParser , loginRequiredStrictly , csrf, page.api.unlike);
+  app.get('/_api/attachments.list'    , accessTokenParser , loginRequired , attachment.api.list);
+  app.post('/_api/attachments.add'                  , uploads.single('file'), autoReap, accessTokenParser, loginRequiredStrictly ,csrf, attachment.api.add);
+  app.post('/_api/attachments.uploadProfileImage'   , uploads.single('file'), autoReap, accessTokenParser, loginRequiredStrictly ,csrf, attachment.api.uploadProfileImage);
+  app.post('/_api/attachments.remove'               , accessTokenParser , loginRequiredStrictly , csrf, attachment.api.remove);
+  app.post('/_api/attachments.removeProfileImage'   , accessTokenParser , loginRequiredStrictly , csrf, attachment.api.removeProfileImage);
+  app.get('/_api/attachments.limit'   , accessTokenParser , loginRequiredStrictly, attachment.api.limit);
+
+  app.get('/_api/revisions.get'       , accessTokenParser , loginRequired , revision.api.get);
+  app.get('/_api/revisions.ids'       , accessTokenParser , loginRequired , revision.api.ids);
+  app.get('/_api/revisions.list'      , accessTokenParser , loginRequired , revision.api.list);
+
+  app.get('/trash$'                   , loginRequired , page.trashPageShowWrapper);
+  app.get('/trash/$'                  , loginRequired , page.trashPageListShowWrapper);
+  app.get('/trash/*/$'                , loginRequired , page.deletedPageListShowWrapper);
 
   app.get('/_hackmd/load-agent'          , hackmd.loadAgent);
   app.get('/_hackmd/load-styles'         , hackmd.loadStyles);
-  app.post('/_api/hackmd.integrate'      , accessTokenParser , loginRequired() , csrf, hackmd.validateForApi, hackmd.integrate);
-  app.post('/_api/hackmd.discard'        , accessTokenParser , loginRequired() , csrf, hackmd.validateForApi, hackmd.discard);
-  app.post('/_api/hackmd.saveOnHackmd'   , accessTokenParser , loginRequired() , csrf, hackmd.validateForApi, hackmd.saveOnHackmd);
+  app.post('/_api/hackmd.integrate'      , accessTokenParser , loginRequiredStrictly , csrf, hackmd.validateForApi, hackmd.integrate);
+  app.post('/_api/hackmd.discard'        , accessTokenParser , loginRequiredStrictly , csrf, hackmd.validateForApi, hackmd.discard);
+  app.post('/_api/hackmd.saveOnHackmd'   , accessTokenParser , loginRequiredStrictly , csrf, hackmd.validateForApi, hackmd.saveOnHackmd);
 
-  app.get('/*/$'                   , loginRequired(false) , page.showPageWithEndOfSlash, page.notFound);
-  app.get('/*'                     , loginRequired(false) , page.showPage, page.notFound);
+  app.get('/*/$'                   , loginRequired , page.showPageWithEndOfSlash, page.notFound);
+  app.get('/*'                     , loginRequired , page.showPage, page.notFound);
 };

src/server/util/middlewares.js

@@ -1,5 +1,6 @@
-const debug = require('debug')('growi:lib:middlewares');
+// eslint-disable-next-line no-unused-vars
 const logger = require('@alias/logger')('growi:lib:middlewares');
+
 const { formatDistanceStrict } = require('date-fns');
 const pathUtils = require('growi-commons').pathUtils;
 const md5 = require('md5');
@@ -27,25 +28,6 @@ module.exports = (crowi, app) => {
     next();
   };
 
-  middlewares.csrfVerify = function(req, res, next) {
-    const token = req.body._csrf || req.query._csrf || null;
-    const csrfKey = (req.session && req.session.id) || 'anon';
-
-    debug('req.skipCsrfVerify', req.skipCsrfVerify);
-    if (req.skipCsrfVerify) {
-      debug('csrf verify skipped');
-      return next();
-    }
-
-    if (crowi.getTokens().verify(csrfKey, token)) {
-      debug('csrf successfully verified');
-      return next();
-    }
-
-    logger.warn('csrf verification failed. return 403', csrfKey, token);
-    return res.sendStatus(403);
-  };
-
   middlewares.swigFunctions = function() {
     return function(req, res, next) {
       require('../util/swigFunctions')(crowi, app, req, res.locals);
@@ -174,87 +156,6 @@ module.exports = (crowi, app) => {
     };
   };
 
-  middlewares.adminRequired = function(req, res, next) {
-    if (req.user != null && (req.user instanceof Object) && '_id' in req.user) {
-      if (req.user.admin) {
-        next();
-        return;
-      }
-      return res.redirect('/');
-    }
-    return res.redirect('/login');
-  };
-
-  /**
-   * require login handler
-   *
-   * @param {boolean} isStrictly whethere strictly restricted (default true)
-   */
-  middlewares.loginRequired = function(isStrictly = true) {
-    return function(req, res, next) {
-
-      // when the route is not strictly restricted
-      if (!isStrictly) {
-        // when allowed to read
-        if (crowi.aclService.isGuestAllowedToRead()) {
-          logger.debug('Allowed to read: ', req.path);
-          return next();
-        }
-      }
-
-      const User = crowi.model('User');
-
-      // check the user logged in
-      if (req.user != null && (req.user instanceof Object) && '_id' in req.user) {
-        if (req.user.status === User.STATUS_ACTIVE) {
-          // Active の人だけ先に進める
-          return next();
-        }
-        if (req.user.status === User.STATUS_REGISTERED) {
-          return res.redirect('/login/error/registered');
-        }
-        if (req.user.status === User.STATUS_SUSPENDED) {
-          return res.redirect('/login/error/suspended');
-        }
-        if (req.user.status === User.STATUS_INVITED) {
-          return res.redirect('/login/invited');
-        }
-      }
-
-      // is api path
-      const path = req.path || '';
-      if (path.match(/^\/_api\/.+$/)) {
-        return res.sendStatus(403);
-      }
-
-      req.session.jumpTo = req.originalUrl;
-      return res.redirect('/login');
-    };
-  };
-
-  middlewares.accessTokenParser = function(req, res, next) {
-    // TODO: comply HTTP header of RFC6750 / Authorization: Bearer
-    const accessToken = req.query.access_token || req.body.access_token || null;
-    if (!accessToken) {
-      return next();
-    }
-
-    const User = crowi.model('User');
-
-    debug('accessToken is', accessToken);
-    User.findUserByApiToken(accessToken)
-      .then((userData) => {
-        req.user = userData;
-        req.skipCsrfVerify = true;
-        debug('Access token parsed: skipCsrfVerify');
-
-        next();
-      })
-      .catch((err) => {
-        next();
-      });
-  };
-
   // this is for Installer
   middlewares.applicationNotInstalled = async function(req, res, next) {
     const isInstalled = await appService.isDBInitialized();

src/test/util/middlewares.test.js → src/test/middleware/login-required.test.js

@@ -4,13 +4,15 @@ import each from 'jest-each';
 
 const { getInstance } = require('../setup-crowi');
 
-describe('middlewares.loginRequired', () => {
+describe('loginRequired', () => {
   let crowi;
-  let middlewares;
+  let loginRequiredStrictly;
+  let loginRequired;
 
   beforeEach(async(done) => {
     crowi = await getInstance();
-    middlewares = require('@server/util/middlewares')(crowi, null);
+    loginRequiredStrictly = require('@server/middleware/login-required')(crowi);
+    loginRequired = require('@server/middleware/login-required')(crowi, true);
     done();
   });
 
@@ -30,13 +32,6 @@ describe('middlewares.loginRequired', () => {
     };
     const next = jest.fn().mockReturnValue('next');
 
-    let loginRequired;
-
-    beforeEach(async(done) => {
-      loginRequired = middlewares.loginRequired(false);
-      done();
-    });
-
     test('pass guest user when aclService.isGuestAllowedToRead() returns true', () => {
       // prepare spy for AclService.isGuestAllowedToRead
       const isGuestAllowedToReadSpy = jest.spyOn(crowi.aclService, 'isGuestAllowedToRead')
@@ -79,11 +74,9 @@ describe('middlewares.loginRequired', () => {
     };
     const next = jest.fn().mockReturnValue('next');
 
-    let loginRequired;
     let isGuestAllowedToReadSpy;
 
     beforeEach(async(done) => {
-      loginRequired = middlewares.loginRequired();
       // reset session object
       req.session = {};
       // spy for AclService.isGuestAllowedToRead
@@ -94,7 +87,7 @@ describe('middlewares.loginRequired', () => {
     test('send status 403 when \'req.path\' starts with \'_api\'', () => {
       req.path = '/_api/someapi';
 
-      const result = loginRequired(req, res, next);
+      const result = loginRequiredStrictly(req, res, next);
 
       expect(isGuestAllowedToReadSpy).not.toHaveBeenCalled();
       expect(next).not.toHaveBeenCalled();
@@ -107,7 +100,7 @@ describe('middlewares.loginRequired', () => {
     test('redirect to \'/login\' when the user does not loggedin', () => {
       req.path = '/path/that/requires/loggedin';
 
-      const result = loginRequired(req, res, next);
+      const result = loginRequiredStrictly(req, res, next);
 
       expect(isGuestAllowedToReadSpy).not.toHaveBeenCalled();
       expect(next).not.toHaveBeenCalled();
@@ -126,7 +119,7 @@ describe('middlewares.loginRequired', () => {
         status: User.STATUS_ACTIVE,
       };
 
-      const result = loginRequired(req, res, next);
+      const result = loginRequiredStrictly(req, res, next);
 
       expect(isGuestAllowedToReadSpy).not.toHaveBeenCalled();
       expect(res.sendStatus).not.toHaveBeenCalled();
@@ -150,7 +143,7 @@ describe('middlewares.loginRequired', () => {
           status: userStatus,
         };
 
-        const result = loginRequired(req, res, next);
+        const result = loginRequiredStrictly(req, res, next);
 
         expect(isGuestAllowedToReadSpy).not.toHaveBeenCalled();
         expect(next).not.toHaveBeenCalled();
@@ -170,7 +163,7 @@ describe('middlewares.loginRequired', () => {
         status: User.STATUS_DELETED,
       };
 
-      const result = loginRequired(req, res, next);
+      const result = loginRequiredStrictly(req, res, next);
 
       expect(isGuestAllowedToReadSpy).not.toHaveBeenCalled();
       expect(next).not.toHaveBeenCalled();