library.js

/* eslint-disable no-await-in-loop */

'use strict';

const _ = require('lodash');
const validator = require('validator');
const entitiesDecode = require('html-entities').decode;

const nconf = require.main.require('nconf');
const winston = require.main.require('winston');

const db = require.main.require('./src/database');
const meta = require.main.require('./src/meta');
const categories = require.main.require('./src/categories');
const Topics = require.main.require('./src/topics');
const posts = require.main.require('./src/posts');
const User = require.main.require('./src/user');
const Groups = require.main.require('./src/groups');
const Messaging = require.main.require('./src/messaging');
const Notifications = require.main.require('./src/notifications');
const Privileges = require.main.require('./src/privileges');
const plugins = require.main.require('./src/plugins');
const Meta = require.main.require('./src/meta');
const slugify = require.main.require('./src/slugify');
const batch = require.main.require('./src/batch');
const utils = require.main.require('./src/utils');
const SocketPlugins = require.main.require('./src/socket.io/plugins');
const translator = require.main.require('./src/translator');
const privileges = require.main.require('./src/privileges');

const utility = require('./lib/utility');

const parts = {
	before: '(?<=(^|\\P{L}))', // a single unicode non-letter character or start of line
	main: '(@[\\p{L}\\d\\-_.@]+(?<![.-]))', // unicode letters, numbers, dashes, underscores, or periods, negative lookbehind to guard against periods/dashes at end
	after: '((?=\\b)(?=[^-])|(?=[^\\p{L}\\d\\-_.@])|$)', // used to figure out where latin mentions end
};
const regex = RegExp(`${parts.before}${parts.main}`, 'gu');
const isLatinMention = /@[\w\d\-_.@]+$/;

const Mentions = module.exports;

Mentions._defaults = {
	disableFollowedTopics: 'off',
	autofillGroups: 'on',
	disableGroupMentions: '[]',
	overrideIgnores: 'off',
	display: '',
};
Mentions._regex = regex;

SocketPlugins.mentions = {};

Mentions.init = async (data) => {
	const routeHelpers = require.main.require('./src/routes/helpers');
	const controllers = require('./controllers');

	routeHelpers.setupAdminPageRoute(data.router, '/admin/plugins/mentions', controllers.renderAdminPage);
};

async function getSettings() {
	const settings = await Meta.settings.get('mentions');
	return { ...Mentions._defaults, ...settings };
}

Mentions.addAdminNavigation = async (header) => {
	header.plugins.push({
		route: '/plugins/mentions',
		name: 'Mentions',
	});

	return header;
};

async function getNoMentionGroups() {
	let noMentionGroups = ['registered-users', 'verified-users', 'unverified-users', 'guests', 'banned-users'];
	try {
		const settings = await getSettings();
		noMentionGroups = noMentionGroups.concat(JSON.parse(settings.disableGroupMentions));
	} catch (err) {
		winston.error(err);
	}
	return noMentionGroups;
}

Mentions.notify = async function ({ post }) {
	const postOwner = String(post.uid);

	let uidsToNotify;
	let groupsToNotify;
	if (utils.isNumber(post.pid)) {
		const cleanedContent = Mentions.clean(post.content, true, true, true);
		let matches = cleanedContent.match(regex);
		if (!matches) {
			return;
		}

		const noMentionGroups = await getNoMentionGroups();
		matches = _.uniq(
			matches
				.map(match => slugify(match.slice(1)))
				.filter(match => match && !noMentionGroups.includes(match))
		);
		if (!matches.length) {
			return;
		}

		([uidsToNotify, groupsToNotify] = await Promise.all([
			getUidsToNotify(matches),
			getGroupsToNotify(matches),
		]));
	} else if (post._activitypub) { // ActivityPub
		const { tag } = post._activitypub;
		groupsToNotify = []; // cannot mention groups for now
		let slugs = [];
		if (Array.isArray(tag) && tag.length) {
			slugs = tag.reduce((slugs, tag) => {
				if (tag.type === 'Mention' && tag.name && typeof tag.name === 'string') {
					const [slug, hostname] = tag.name.slice(1).split('@');
					if (hostname === nconf.get('url_parsed').hostname) {
						slugs.push(slug);
					}
				}
				return slugs;
			}, []);
		}
		uidsToNotify = slugs.length ? await db.sortedSetScores('userslug:uid', slugs) : [];
		uidsToNotify = uidsToNotify.map(String);
	}

	if ((!uidsToNotify && !groupsToNotify) || (!uidsToNotify.length && !groupsToNotify.length)) {
		return;
	}
	const settings = await getSettings();
	const [topic, userData, topicFollowers] = await Promise.all([
		Topics.getTopicFields(post.tid, ['title', 'cid']),
		User.getUserFields(post.uid, ['username']),
		settings.disableFollowedTopics === 'on' ? Topics.getFollowers(post.tid) : [],
	]);
	const { displayname } = userData;
	const title = entitiesDecode(topic.title);

	let uids = uidsToNotify.filter(
		uid => uid !== postOwner && !topicFollowers.includes(uid)
	);

	if (settings.privilegedDirectReplies === 'on') {
		const toPid = await posts.getPostField(post.pid, 'toPid');
		uids = await filterPrivilegedUids(uids, post.cid, toPid);
	}

	const groupMemberUids = {};
	groupsToNotify.forEach((groupData) => {
		groupData.members = groupData.members.filter((uid) => {
			if (!uid || groupMemberUids[uid]) {
				return false;
			}
			groupMemberUids[uid] = 1;
			return !uids.includes(uid) &&
				uid !== postOwner &&
				!topicFollowers.includes(uid);
		});
	});

	const filteredUids = await filterUidsAlreadyMentioned(uids, post.pid);
	if (filteredUids.length) {
		const notifText = translator.compile('notifications:user-mentioned-you-in', displayname, title);
		await sendNotificationToUids(post, filteredUids, 'user', notifText);
		await db.setAdd(`mentions:pid:${post.pid}:uids`, filteredUids);
	}

	for (let i = 0; i < groupsToNotify.length; ++i) {
		if (groupsToNotify[i] && groupsToNotify[i].name && groupsToNotify[i].members) {
			const memberUids = groupsToNotify[i].members;
			const groupName = groupsToNotify[i].name;
			const groupMentionSent = await db.isSetMember(`mentions:pid:${post.pid}:groups`, groupName);
			if (!groupMentionSent && memberUids.length) {
				const notifText = translator.compile('notifications:user-mentioned-group-in', displayname, groupName, title);
				await sendNotificationToUids(post, memberUids, groupName, notifText);
				await db.setAdd(`mentions:pid:${post.pid}:groups`, groupName);
			}
		}
	}
};

Mentions.notifyMessage = async (hookData) => {
	const cleanedContent = Mentions.clean(hookData.data.content, false, true, true);
	let matches = cleanedContent.match(regex);
	if (!Array.isArray(matches) || !matches.length) {
		return;
	}
	const { message } = hookData;
	const { roomId } = message;
	matches = _.uniq(matches.map(match => slugify(match.slice(1))));

	const [matchedUids, roomData] = await Promise.all([
		getUidsToNotify(matches),
		Messaging.getRoomData(roomId),
	]);
	if (!roomData || !matchedUids.length || !roomData.public) {
		return;
	}
	const io = require.main.require('./src/socket.io');

	const [onlineUidsInRoom, fromUser, isUserInRoom, notifSettings, parsedMessage, checks] = await Promise.all([
		io.getUidsInRoom(`chat_room_${roomId}`),
		User.getUserFields(message.fromuid, ['username']),
		Messaging.isUsersInRoom(matchedUids, roomId),
		Messaging.getUidsNotificationSetting(matchedUids, roomId),
		Messaging.parse(message.content, message.fromuid, 0, message.roomId, false),
		Promise.all(matchedUids.map(
			uid => !roomData.groups.length || Groups.isMemberOfAny(uid, roomData.groups)
		)),
	]);

	const uidsToNotify = matchedUids.filter(
		(uid, idx) => checks[idx] &&
			isUserInRoom[idx] &&
			!onlineUidsInRoom.includes(String(uid)) &&
			notifSettings[idx] === Messaging.notificationSettings.ATMENTION
	);
	if (!uidsToNotify.length) {
		return;
	}
	const roomName = validator.escape(String(roomData.roomName || `Room ${roomId}`));
	const icon = Messaging.getRoomIcon(roomData);
	const notifObj = await Notifications.create({
		type: 'mention',
		bodyShort: `[[notifications:user-mentioned-you-in-room, ${fromUser.displayname}, ${icon}, ${roomName}]]`,
		bodyLong: parsedMessage,
		nid: `chat_${roomId}_${message.fromuid}_${message.mid}`,
		mid: message.mid,
		from: message.fromuid,
		path: `/chats/${roomId}`,
		importance: 6,
	});
	await Notifications.push(notifObj, uidsToNotify);
};

async function getUidsToNotify(matches) {
	const uids = await db.sortedSetScores('userslug:uid', matches);
	return _.uniq(uids.filter(Boolean).map(String));
}

async function getGroupsToNotify(matches) {
	if (!matches.length) {
		return [];
	}
	const groupNames = Object.values(await db.getObjectFields('groupslug:groupname', matches));
	const groupMembers = await Promise.all(groupNames.map(async (groupName) => {
		if (!groupName) {
			return [];
		}
		return db.getSortedSetRange(`group:${groupName}:members`, 0, 999);
	}));
	return groupNames.map((groupName, i) => ({
		name: groupName,
		members: groupMembers[i],
	}));
}

Mentions.actionPostsPurge = async (hookData) => {
	if (hookData && Array.isArray(hookData.posts)) {
		await db.deleteAll([
			...hookData.posts.map(p => `mentions:pid:${p.pid}:uids`),
			...hookData.posts.map(p => `mentions:pid:${p.pid}:groups`),
		]);
	}
};

async function filterUidsAlreadyMentioned(uids, pid) {
	const isMember = await db.isSetMembers(`mentions:pid:${pid}:uids`, uids);
	return uids.filter((uid, index) => !isMember[index]);
}

Mentions.addFilters = async (data) => {
	data.regularFilters.push({ name: '[[notifications:mentions]]', filter: 'mention' });
	return data;
};

Mentions.notificationTypes = async (data) => {
	data.types.push('notificationType_mention');
	return data;
};

Mentions.addFields = async (data) => {
	if (!Meta.config.hideFullname) {
		data.fields.push('fullname');
	}
	return data;
};

async function sendNotificationToUids(postData, uids, nidType, notificationText) {
	if (!uids.length) {
		return;
	}

	const filteredUids = [];
	const notification = await createNotification(postData, nidType, notificationText);
	if (!notification) {
		return;
	}
	const settings = await getSettings();
	await batch.processArray(uids, async (uids) => {
		uids = await Privileges.topics.filterUids('read', postData.tid, uids);
		if (settings.overrideIgnores !== 'on') {
			uids = await Topics.filterIgnoringUids(postData.tid, uids);
		}
		filteredUids.push(...uids);
	}, {
		interval: 1000,
		batch: 500,
	});

	if (notification && filteredUids.length) {
		plugins.hooks.fire('action:mentions.notify', { notification, uids: filteredUids });
		Notifications.push(notification, filteredUids);
	}
}

async function createNotification(postData, nidType, notificationText) {
	// postData.sourceContent or postData.content is not parsed yet
	// this is triggered from action:post.save or action:post.edit
	await posts.parsePost(postData);

	return await Notifications.create({
		type: 'mention',
		bodyShort: notificationText,
		bodyLong: postData.content,
		nid: `tid:${postData.tid}:pid:${postData.pid}:uid:${postData.uid}:${nidType}`,
		pid: postData.pid,
		tid: postData.tid,
		from: postData.uid,
		path: `/post/${encodeURIComponent(postData.pid)}`,
		importance: 6,
	});
}

Mentions.parsePost = async (data) => {
	const { postData, type } = data;
	if (!postData.content) {
		return data;
	}

	const parsed = await Mentions.parseRaw(postData.content, type);
	data.postData.content = parsed;
	return data;
};

function removePunctuationSuffix(string) {
	return string.replace(/[!?.]*$/, '');
}

async function getMatches(content, isMarkdown = false) {
	const splitContent = utility.split(content, isMarkdown, false, true);
	let matches = [];
	splitContent.forEach((cleanedContent, i) => {
		if ((i % 2) === 0) {
			matches = matches.concat(cleanedContent.match(regex) || []);
		}
	});

	return { splitContent, matches };
}

Mentions.getMatches = async (content) => {
	// Exported method only accepts markdown, also filters out dupes and matches to ensure slugs exist
	let { matches } = await getMatches(content, true);
	matches = await filterMatches(matches);
	if (!matches.length) {
		return new Set();
	}

	const normalized = matches.map(match => match.slice(1).toLowerCase());
	let [uids, localCids, remoteCids] = await Promise.all([
		User.getUidsByUserslugs(normalized),
		db.sortedSetScores('categoryhandle:cid', normalized),
		db.getObjectFields('handle:cid', normalized),
	]);
	remoteCids = Object.values(remoteCids);

	matches = matches.map((slug, idx) => {
		if (uids[idx]) {
			return {
				type: 'uid',
				id: uids[idx],
				slug,
			};
		} else if (localCids[idx] || remoteCids[idx]) {
			return {
				type: 'cid',
				id: localCids[idx] || remoteCids[idx],
				slug,
			};
		}

		return false;
	}).filter(Boolean);

	return new Set(matches);
};

async function filterMatches(matches) {
	if (!matches.length) {
		return [];
	}

	matches = Array.from(new Set(matches));
	const slugs = matches.map(match => match.slice(1));
	const exists = await meta.slugTaken(slugs);
	const remoteCidExists = await db.isObjectFields('handle:cid', slugs);

	return matches.filter((m, i) => exists[i] || remoteCidExists[i]);
}

Mentions.parseRaw = async (content, type = 'default') => {
	if (type === 'plaintext') {
		return content;
	}

	// Note: Mentions.clean explicitly can't be called here because I need the content unstripped
	let { splitContent, matches } = await getMatches(content);

	if (!matches.length) {
		return content;
	}

	const settings = await getSettings();

	matches = _.uniq(matches).map((match) => {
		/**
		 * Javascript-flavour of regex does not support lookaround,
		 * so need to clean up the cruft by discarding everthing
		 * before the @
		 */
		const atIndex = match.indexOf('@');
		return atIndex !== 0 ? match.slice(atIndex) : match;
	});

	// Convert matches to anchor html
	let replacements = new Set();
	await Promise.all(matches.map(async (match) => {
		const slug = slugify(match.slice(1));
		match = removePunctuationSuffix(match);
		let cid = 0;
		let groupExists = 0;
		const uid = await User.getUidByUserslug(slug);
		if (!uid) {
			({ groupExists, cid } = await utils.promiseParallel({
				groupExists: Groups.existsBySlug(slug),
				cid: categories.getCidByHandle(slug),
			}));
		}

		if (uid || groupExists || cid) {
			let url;
			let user;
			let mentionType = 'user';
			switch (true) {
				case !!uid: {
					user = await User.getUserFields(uid, ['uid', 'username', 'userslug', 'fullname', 'url']);
					url = `/user/${encodeURIComponent(user.userslug)}`;
					if (type.startsWith('activitypub') && !utils.isNumber(uid)) {
						url = user.url || user.uid;
					}
					break;
				}

				case !!cid: {
					mentionType = 'category';
					const category = await categories.getCategoryFields(cid, ['slug']);
					url = `/category/${category.slug}`;
					break;
				}

				case !!groupExists: {
					mentionType = 'group';
					url = `/groups/${slug}`;
					break;
				}
			}

			replacements.add({ match, url, user, mentionType });
		}
	}));


	replacements = Array.from(replacements)
		.sort((a, b) => {
			return b.user && a.user ? b.user.userslug.length - a.user.userslug.length : 0;
		})
		.forEach(({ match, url, user, mentionType }) => {
			const regex = isLatinMention.test(match) ?
				RegExp(`${parts.before}${match}${parts.after}`, 'gu') :
				RegExp(`${parts.before}${match}`, 'gu');
			let skip = false;
			splitContent = splitContent.map((c, i) => {
				// *Might* not be needed anymore? Check pls...
				if (skip || (i % 2) === 1) {
					skip = c === '<code>'; // if code block detected, skip the content inside of it
					return c;
				}

				return c.replace(regex, (match) => {
					// Again, cleaning up lookaround leftover bits
					const atIndex = match.indexOf('@');
					const plain = match.slice(0, atIndex);
					match = match.slice(atIndex + 1);
					if (user && user.uid) {
						switch (settings.display) {
							case 'fullname':
								match = user.displayname || match;
								break;
							case 'username':
								match = user.username;
								break;
						}
					}

					let str;
					if (type === 'markdown') {
						str = `[${!settings.display ? '@' : ''}${match}](${nconf.get('url')}${url})`;
					} else {
						str = `<a class="plugin-mentions-${mentionType} plugin-mentions-a" href="${nconf.get('relative_path')}${url}" aria-label="Profile: ${match}">${!settings.display ? '@' : ''}<bdi>${match}</bdi></a>`;
					}

					return plain + str;
				});
			});
		});

	return splitContent.join('');
};

Mentions.clean = function (input, isMarkdown, stripBlockquote, stripCode) {
	let split = utility.split(input, isMarkdown, stripBlockquote, stripCode);
	// only keep non-code/non-blockquote
	split = split.filter((el, i) => (i % 2) === 0);
	return split.join('');
};

/*
	Local utility methods
*/
async function filterPrivilegedUids(uids, cid, toPid) {
	let toPidUid;
	if (toPid) {
		toPidUid = await posts.getPostField(toPid, 'uid');
	}

	// Remove administrators, global mods, and moderators of the post's cid
	uids = await Promise.all(uids.map(async (uid) => {
		// Direct replies are a-ok.
		if (uid === toPidUid) {
			return uid;
		}

		const [isAdmin, isMod] = await Promise.all([
			User.isAdministrator(uid),
			User.isModerator(uid, cid), // covers gmod as well
		]);

		return isAdmin || isMod ? false : uid;
	}));

	return uids.filter(Boolean);
}

async function filterDisallowedFullnames(users) {
	if (!users.length) return [];
	const userSettings = await User.getMultipleUserSettings(users.map(user => user.uid));
	return users.filter((user, index) => userSettings[index] && userSettings[index].showfullname);
}

async function stripDisallowedFullnames(users) {
	if (!users.length) return [];
	const userSettings = await User.getMultipleUserSettings(users.map(user => user.uid));
	users.forEach((user, index) => {
		if (user && userSettings[index] && !userSettings[index].showfullname) {
			user.fullname = null;
		}
	});
}

/*
	WebSocket methods
*/

SocketPlugins.mentions.getTopicUsers = async (socket, data) => {
	const canRead = await privileges.topics.can('read', data.tid, socket.uid);
	if (!canRead) {
		throw new Error('[[error:no-privileges]]');
	}
	const uids = await Topics.getUids(data.tid);
	let users = await User.getUsers(uids);
	users = users.filter(u => u && u.userslug);
	if (Meta.config.hideFullname) {
		return users;
	}
	await stripDisallowedFullnames(users);
	return users;
};

SocketPlugins.mentions.listGroups = async function () {
	const settings = await getSettings();
	if (settings.autofillGroups === 'off') {
		return [];
	}

	const groups = await Groups.getGroups('groups:visible:createtime', 0, -1);
	const noMentionGroups = await getNoMentionGroups();
	const filteredGroups = groups.filter(g => g && !noMentionGroups.includes(g))
		.map(g => validator.escape(String(g)));
	const fields = ['name', 'slug', 'icon', 'memberCount', 'labelColor', 'textColor'];
	return (await Groups.getGroupsFields(filteredGroups, fields))
		.filter(g => g && g.name && g.slug)
		.map(g => ({ ..._.pick(g, fields), isGroup: true }));
};

SocketPlugins.mentions.userSearch = async (socket, data) => {
	const allowed = await privileges.global.can('search:users', socket.uid);
	if (!allowed) {
		throw new Error('[[error:no-privileges]]');
	}

	const searchOpts = {
		uid: socket.uid,
		query: data.query,
		sortBy: 'postcount',
		hardCap: 1000,
		paginate: true,
		resultsPerPage: 100,
	};

	const [byUsername, byFullname, settings] = await Promise.all([
		User.search({ ...searchOpts, searchBy: 'username' }),
		!Meta.config.hideFullname ?
			User.search({ ...searchOpts, searchBy: 'fullname' }) :
			Promise.resolve({ users : [] }),
		getSettings(),
	]);

	let { users } = byUsername;

	const [fullnameUsers] = await Promise.all([
		// Hide results of users that do not allow their full name to be visible (prevents "enumeration attack")
		filterDisallowedFullnames(byFullname.users),
		// Strip fullnames of users that do not allow their full name to be visible
		stripDisallowedFullnames(users),
	]);

	// Merge results, filter duplicates (from username search, leave fullname results)
	const fullnameUidSet = new Set(fullnameUsers.map(u => u.uid));
	users = users.filter(u => !fullnameUidSet.has(u.uid)).concat(fullnameUsers);
	users.sort((a, b) => b.postcount - a.postcount);

	if (settings.privilegedDirectReplies === 'on') {
		if (data.composerObj) {
			const cid = Topics.getTopicField(data.composerObj.tid, 'cid');
			const filteredUids = await filterPrivilegedUids(users.map(userObj => userObj.uid), cid, data.composerObj.toPid);

			users = users.filter(userObj => filteredUids.includes(userObj.uid));
		}

		return users;
	}

	// Remote categories
	let { categories: categoriesObj } = await categories.search(data);
	categoriesObj = categoriesObj.filter(category => !utils.isNumber(category.cid));

	return [...users, ...categoriesObj];
};