Fixed sandbox. Multiple tabs work now.

WiP on selectable mosaico templates.

TODO: Make files always point to trusted URL, such that we don't have to rebase them. They are public anyway. The same goes for mosaico endpoints: /mosaico/templates and /mosaico/img

lib/client-helpers.js

@@ -14,9 +14,9 @@ async function getAnonymousConfig(context, trusted) {
         externalPasswordResetLink: config.ldap.passwordresetlink,
         language: config.language || 'en',
         isAuthenticated: !!context.user,
-        trustedUrlBase: urls.getTrustedUrl(),
+        trustedUrlBase: urls.getTrustedUrlBase(),
         trustedUrlBaseDir: urls.getTrustedUrlBaseDir(),
-        sandboxUrlBase: urls.getSandboxUrl(),
+        sandboxUrlBase: urls.getSandboxUrlBase(),
         sandboxUrlBaseDir: urls.getSandboxUrlBaseDir(),
         trusted
     }

lib/file-helpers.js

@@ -10,9 +10,9 @@ const multer = require('multer')({
     dest: uploadedFilesDir
 });
 
-function installUploadHandler(router, url, dontReplace = false) {
+function installUploadHandler(router, url, getUrl = null, dontReplace = false) {
     router.postAsync(url, passport.loggedIn, multer.array('files[]'), async (req, res) => {
-        return res.json(await files.createFiles(req.context, req.params.type, req.params.entityId, req.files, dontReplace));
+        return res.json(await files.createFiles(req.context, req.params.type, req.params.entityId, req.files, getUrl, dontReplace));
     });
 }
 

lib/passport.js

@@ -116,16 +116,22 @@ module.exports.authByAccessToken = (req, res, next) => {
 };
 
 module.exports.tryAuthByRestrictedAccessToken = (req, res, next) => {
-    if (req.cookies.restricted_access_token) {
-        users.getByRestrictedAccessToken(req.cookies.restricted_access_token).then(user => {
-            req.user = user;
-            next();
-        }).catch(err => {
-            next();
-        });
-    } else {
+    const pathComps = req.url.split('/');
+
+    pathComps.shift();
+    const restrictedAccessToken = pathComps.shift();
+    pathComps.unshift('');
+
+    const url = pathComps.join('/');
+
+    req.url = url;
+
+    users.getByRestrictedAccessToken(restrictedAccessToken).then(user => {
+        req.user = user;
         next();
-    }
+    }).catch(err => {
+        next();
+    });
 };
 
 module.exports.setup = app => {

lib/tools.js

@@ -3,6 +3,7 @@
 const _ = require('./translate')._;
 const util = require('util');
 const isemail = require('isemail');
+const path = require('path');
 
 const bluebird = require('bluebird');
 
@@ -46,7 +47,7 @@ async function getTemplate(template) {
         source = compiled.html;
     }
 
-    const renderer = hbs.handlebars.compile(compiled.html);
+    const renderer = hbs.handlebars.compile(source);
     templates.set(key, renderer);
 
     return renderer;

lib/urls.js

@@ -3,27 +3,41 @@
 const config = require('config');
 const urllib = require('url');
 
+function getTrustedUrlBase() {
+    return urllib.resolve(config.www.trustedUrlBase, '');
+}
+
+function getSandboxUrlBase() {
+    return urllib.resolve(config.www.sandboxUrlBase, '');
+}
+
 function getTrustedUrl(path) {
     return urllib.resolve(config.www.trustedUrlBase, path || '');
 }
 
-function getSandboxUrl(path) {
-    return urllib.resolve(config.www.sandboxUrlBase, path || '');
+function getSandboxUrl(path, context) {
+    if (context && context.user && context.user.restrictedAccessToken) {
+        return urllib.resolve(config.www.sandboxUrlBase, context.user.restrictedAccessToken + '/' + (path || ''));
+    } else {
+        return urllib.resolve(config.www.sandboxUrlBase, 'ANONYMOUS/' + (path || ''));
+    }
 }
 
 function getTrustedUrlBaseDir() {
-    const mailtrainUrl = urllib.parse(getTrustedUrl());
-    return mailtrainUrl.pathname;
+    const ivisUrl = urllib.parse(config.www.trustedUrlBase);
+    return ivisUrl.pathname;
 }
 
 function getSandboxUrlBaseDir() {
-    const mailtrainUrl = urllib.parse(getSandboxUrl());
-    return mailtrainUrl.pathname;
+    const ivisUrl = urllib.parse(config.www.sandboxUrlBase);
+    return ivisUrl.pathname;
 }
 
 module.exports = {
     getTrustedUrl,
     getSandboxUrl,
+    getTrustedUrlBase,
+    getSandboxUrlBase,
     getTrustedUrlBaseDir,
     getSandboxUrlBaseDir
 };