Merge pull request #7461 from weseek/imprv/116613-include-anyone-with-the-link-page-in-the-deletion-target

imprv: Include anyone with the link page in the deletion target

packages/app/src/server/models/page.ts

@@ -57,7 +57,7 @@ type PaginatedPages = {
 export type CreateMethod = (path: string, body: string, user, options: PageCreateOptions) => Promise<PageDocument & { _id: any }>
 export interface PageModel extends Model<PageDocument> {
   [x: string]: any; // for obsolete static methods
-  findByIdsAndViewer(pageIds: ObjectIdLike[], user, userGroups?, includeEmpty?: boolean): Promise<PageDocument[]>
+  findByIdsAndViewer(pageIds: ObjectIdLike[], user, userGroups?, includeEmpty?: boolean, includeAnyoneWithTheLink?: boolean): Promise<PageDocument[]>
   findByPathAndViewer(path: string | null, user, userGroups?, useFindOne?: true, includeEmpty?: boolean): Promise<PageDocument & HasObjectId | null>
   findByPathAndViewer(path: string | null, user, userGroups?, useFindOne?: false, includeEmpty?: boolean): Promise<(PageDocument & HasObjectId)[]>
   countByPathAndViewer(path: string | null, user, userGroups?, includeEmpty?:boolean): Promise<number>
@@ -553,11 +553,13 @@ schema.statics.replaceTargetWithPage = async function(exPage, pageToReplaceWith?
 /*
  * Find pages by ID and viewer.
  */
-schema.statics.findByIdsAndViewer = async function(pageIds: string[], user, userGroups?, includeEmpty?: boolean): Promise<PageDocument[]> {
+schema.statics.findByIdsAndViewer = async function(
+    pageIds: string[], user, userGroups?, includeEmpty?: boolean, includeAnyoneWithTheLink?: boolean,
+): Promise<PageDocument[]> {
   const baseQuery = this.find({ _id: { $in: pageIds } });
   const queryBuilder = new PageQueryBuilder(baseQuery, includeEmpty);
 
-  await queryBuilder.addViewerCondition(user, userGroups);
+  await queryBuilder.addViewerCondition(user, userGroups, includeAnyoneWithTheLink);
 
   return queryBuilder.query.exec();
 };

packages/app/src/server/routes/apiv3/pages.js

@@ -1,6 +1,7 @@
 
 import { SupportedTargetModel, SupportedAction } from '~/interfaces/activity';
 import { subscribeRuleNames } from '~/interfaces/in-app-notification';
+import { PageGrant } from '~/interfaces/page';
 import loggerFactory from '~/utils/logger';
 
 import { generateAddActivityMiddleware } from '../../middlewares/add-activity';
@@ -202,6 +203,9 @@ module.exports = (crowi) => {
       body('isRecursively')
         .custom(v => v === 'true' || v === true || v == null)
         .withMessage('The body property "isRecursively" must be "true" or true. (Omit param for false)'),
+      body('isAnyoneWithTheLink')
+        .custom(v => v === 'true' || v === true || v == null)
+        .withMessage('The body property "isAnyoneWithTheLink" must be "true" or true. (Omit param for false)'),
     ],
     legacyPagesMigration: [
       body('convertPath').optional().isString().withMessage('convertPath must be a string'),
@@ -831,24 +835,33 @@ module.exports = (crowi) => {
   });
 
   router.post('/delete', accessTokenParser, loginRequiredStrictly, validator.deletePages, apiV3FormValidator, async(req, res) => {
-    const { pageIdToRevisionIdMap, isCompletely, isRecursively } = req.body;
+    const {
+      pageIdToRevisionIdMap, isCompletely, isRecursively, isAnyoneWithTheLink,
+    } = req.body;
+
     const pageIds = Object.keys(pageIdToRevisionIdMap);
 
     if (pageIds.length === 0) {
       return res.apiv3Err(new ErrorV3('Select pages to delete.', 'no_page_selected'), 400);
     }
+    if (isAnyoneWithTheLink && pageIds.length !== 1) {
+      return res.apiv3Err(new ErrorV3('Only one restricted page can be selected', 'not_single_page'), 400);
+    }
     if (pageIds.length > LIMIT_FOR_MULTIPLE_PAGE_OP) {
       return res.apiv3Err(new ErrorV3(`The maximum number of pages you can select is ${LIMIT_FOR_MULTIPLE_PAGE_OP}.`, 'exceeded_maximum_number'), 400);
     }
 
     let pagesToDelete;
     try {
-      pagesToDelete = await Page.findByIdsAndViewer(pageIds, req.user, null, true);
+      pagesToDelete = await Page.findByIdsAndViewer(pageIds, req.user, null, true, isAnyoneWithTheLink);
     }
     catch (err) {
       logger.error('Failed to find pages to delete.', err);
       return res.apiv3Err(new ErrorV3('Failed to find pages to delete.'));
     }
+    if (isAnyoneWithTheLink && pagesToDelete[0].grant !== PageGrant.GRANT_RESTRICTED) {
+      return res.apiv3Err(new ErrorV3('The grant of the retrieved page is not restricted'), 500);
+    }
 
     let pagesCanBeDeleted;
     /*