frontend/backend update

app/Http/Controllers/Sharing/FileSharingController.php

@@ -0,0 +1,220 @@
+<?php
+
+namespace App\Http\Controllers\Sharing;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Collection;
+use Illuminate\Http\Request;
+use Illuminate\Support\Arr;
+use App\FileManagerFolder;
+use App\FileManagerFile;
+use App\User;
+use App\Share;
+
+class FileSharingController extends Controller
+{
+    /**
+     * Get shared record
+     *
+     * @param Request $request
+     * @return mixed
+     */
+    public function index($token)
+    {
+        // Get sharing record
+        return Share::where('token', $token)
+            ->firstOrFail(['token', 'item_id', 'type', 'permission', 'protected']);
+    }
+
+    /**
+     * Check Password for protected item
+     *
+     * @param Request $request
+     * @param $token
+     * @return array
+     */
+    public function authenticate(Request $request, $token)
+    {
+        // TODO: validacia
+
+        // Get sharing record
+        $shared = Share::where('token', $token)->firstOrFail();
+
+        // Check password
+        if (!Hash::check($request->password, $shared->password)) {
+
+            abort(401, 'Sorry, your password is incorrect.');
+        }
+
+        // Get owner of shared content
+        $user = User::find($shared->user_id);
+
+        // Define scope
+        $scope = !is_null($shared->permission) ? $shared->permission : 'visitor';
+
+        // Generate token for visitor/editor
+        $token = $user->createToken('token', [$scope])->accessToken;
+
+        // Return authorize token with shared options
+        return response(Arr::except($shared, ['password', 'user_id', 'updated_at', 'created_at']), 200)
+            ->cookie('shared_token', $shared->token, 43200)
+            ->cookie('token', $token, 43200);
+    }
+
+    /**
+     * Browse private folders
+     *
+     * @param Request $request
+     * @param $unique_id
+     * @return Collection
+     */
+    public function browse_private(Request $request, $unique_id)
+    {
+        // Check if token exist
+        if (!$request->has('token'))
+            abort(404, "Sorry, you don't request any content");
+
+        // Get sharing record
+        $shared = Share::where('token', $request->token)->firstOrFail();
+
+        // Check directory authentication
+        $this->check_authenticated_access($request);
+
+        // Check if user can get directory
+        $this->check_folder_access($unique_id, $shared);
+
+        // Get folders and files
+        $folders = FileManagerFolder::where('user_id', $shared->user_id)
+            ->where('parent_id', $unique_id)
+            ->get();
+
+        $files = FileManagerFile::where('user_id', $shared->user_id)
+            ->where('folder_id', $unique_id)
+            ->get();
+
+        // Collect folders and files to single array
+        return collect([$folders, $files])->collapse();
+    }
+
+    /**
+     * Browse public folders
+     *
+     * @param Request $request
+     * @param $unique_id
+     * @return Collection
+     */
+    public function browse_public(Request $request, $unique_id)
+    {
+
+        // Check if token exist
+        if (!$request->has('token'))
+            abort(404, "Sorry, you don't request any content");
+
+        // Get sharing record
+        $shared = Share::where('token', $request->token)->firstOrFail();
+
+        // Abort if folder is protected
+        if ($shared->protected) {
+            abort(403, "Sorry, you don't have permission");
+        }
+
+        // Check if user can get directory
+        $this->check_folder_access($unique_id, $shared);
+
+        // Get folders and files
+        $folders = FileManagerFolder::where('user_id', $shared->user_id)
+            ->where('parent_id', $unique_id)
+            ->get();
+
+        $files = FileManagerFile::where('user_id', $shared->user_id)
+            ->where('folder_id', $unique_id)
+            ->get();
+
+        // Add shared token to file
+        /*if ($shared->protected) {
+
+            $files->map(function ($file) use ($shared) {
+                //$file->thumbnail = $file->getOriginal('thumbnail') . '?token=' . $shared->token;
+
+                $file->thumbnail = route('thumbnail-public', ['name' => $file->getOriginal('thumbnail')]);
+            });
+        }*/
+
+        // Collect folders and files to single array
+        return collect([$folders, $files])->collapse();
+    }
+
+    /**
+     * Get shared public file record
+     *
+     * @param $token
+     * @return mixed
+     */
+    public function file_public($token)
+    {
+        // Get sharing record
+        $shared = Share::where('token', $token)->firstOrFail();
+
+        // Abort if file is protected
+        if ($shared->protected) {
+            abort(403, "Sorry, you don't have permission");
+        }
+
+        // Return record
+        return FileManagerFile::where('user_id', $shared->user_id)
+            ->where('unique_id', $shared->item_id)
+            ->firstOrFail(['name', 'basename', 'thumbnail', 'type', 'filesize', 'mimetype']);
+    }
+
+    /**
+     * Get shared private file record
+     *
+     * @param $token
+     * @return mixed
+     */
+    public function file_private(Request $request, $token)
+    {
+        // Get sharing record
+        $shared = Share::where('token', $token)->firstOrFail();
+
+        // Check file authentication
+        $this->check_authenticated_access($request);
+
+        // Return record
+        return FileManagerFile::where('user_id', $shared->user_id)
+            ->where('unique_id', $shared->item_id)
+            ->firstOrFail(['name', 'basename', 'thumbnail', 'type', 'filesize', 'mimetype']);
+    }
+
+    /**
+     * Check if user has access to requested folder
+     *
+     * @param $folder_unique_id
+     * @param $shared
+     */
+    protected function check_folder_access($unique_id, $shared): void
+    {
+        // Get all children folders
+        $foldersIds = FileManagerFolder::with('folders:id,parent_id,unique_id,name')
+            ->where('user_id', $shared->user_id)
+            ->where('parent_id', $shared->item_id)
+            ->get();
+
+        // Get all authorized parent folders by shared folder as root of tree
+        $authorized_parent_folder_ids = Arr::flatten([filter_folders_ids($foldersIds), $shared->item_id]);
+
+        // Check user access
+        if (!in_array($unique_id, $authorized_parent_folder_ids)) abort(401);
+    }
+
+    /**
+     * @param Request $request
+     */
+    protected function check_authenticated_access(Request $request): void
+    {
+        // Check directory permission
+        if ($request->cookie('shared_token') !== $request->token)
+            abort(401, "Sorry, you don't have permission");
+    }
+}