Merge pull request #2520 from withspectrum/weekly-merge

Weekly merge

Author: brianlovin

config-overrides.js

@@ -114,7 +114,7 @@ module.exports = function override(config, env) {
             // Don't return the cached index.html for API requests or /auth pages
             if (url.pathname.indexOf('/api') === 0) return;
             if (url.pathname.indexOf('/auth') === 0) return;
-            return new URL('/index.html', url);
+            return new URL('https://spectrum.chat/index.html');
           },
           requestType: ['navigate'],
         },

iris/index.js

@@ -9,11 +9,25 @@ debug('logging with debug enabled!');
 import { createServer } from 'http';
 import express from 'express';
 import Raven from 'shared/raven';
+import { ApolloEngine } from 'apollo-engine';
 import { init as initPassport } from './authentication.js';
-import engine from './routes/middlewares/engine';
-const PORT = 3001;
 import type { DBUser } from 'shared/types';
 
+const PORT = process.env.PORT ? parseInt(process.env.PORT, 10) : 3001;
+
+const engine = new ApolloEngine({
+  logging: {
+    level: 'WARN',
+  },
+  apiKey: process.env.APOLLO_ENGINE_API_KEY,
+  // Only send perf data to the remote server in production
+  reporting: {
+    disabled: process.env.NODE_ENV !== 'production',
+    hostname: process.env.NOW_URL || undefined,
+    privateHeaders: ['authorization', 'Authorization', 'AUTHORIZATION'],
+  },
+});
+
 // Initialize authentication
 initPassport();
 
@@ -49,16 +63,14 @@ const server = createServer(app);
 import createSubscriptionsServer from './routes/create-subscription-server';
 const subscriptionsServer = createSubscriptionsServer(server, '/websocket');
 
-// Start webserver
-server.listen(PORT);
+// Start API wrapped in Apollo Engine
+engine.listen({
+  port: PORT,
+  httpServer: server,
+  graphqlPaths: ['/api'],
+});
 console.log(`GraphQL server running at http://localhost:${PORT}/api`);
 
-if (process.env.NODE_ENV === 'production') {
-  // Start Apollo Engine
-  console.log('Apollo Engine starting...');
-  engine.start();
-}
-
 process.on('unhandledRejection', async err => {
   console.error('Unhandled rejection', err);
   try {

iris/models/thread.js

@@ -324,7 +324,8 @@ export const publishThread = (
 
 export const setThreadLock = (
   threadId: string,
-  value: boolean
+  value: boolean,
+  userId: string
 ): Promise<DBThread> => {
   return (
     db
@@ -335,6 +336,8 @@ export const setThreadLock = (
       .update(
         {
           isLocked: value,
+          lockedBy: value === true ? userId : db.literal(),
+          lockedAt: value === true ? new Date() : db.literal(),
         },
         { returnChanges: true }
       )

iris/mutations/message/addMessage.js

@@ -50,6 +50,8 @@ export default async (
 
   const thread = await loaders.thread.load(message.threadId);
 
+  if (thread.isLocked) throw new UserError("Can't reply in a locked thread.");
+
   let contextPermissions;
   // Make sure that we have permission to send a message in the community
   if (message.threadType === 'story') {

iris/mutations/thread/setThreadLock.js

@@ -4,6 +4,7 @@ import UserError from '../../utils/UserError';
 import { getThreads, setThreadLock } from '../../models/thread';
 import { getUserPermissionsInChannel } from '../../models/usersChannels';
 import { getUserPermissionsInCommunity } from '../../models/usersCommunities';
+import type { DBThread } from 'shared/types';
 
 export default async (
   _: any,
@@ -17,13 +18,23 @@ export default async (
     return new UserError('You must be signed in to make changes.');
   }
 
-  const thread = await loaders.thread.load(threadId);
+  const thread: DBThread = await loaders.thread.load(threadId);
 
   // if the thread doesn't exist
   if (!thread || thread.deletedAt) {
     return new UserError(`Could not find thread with ID '${threadId}'.`);
   }
 
+  // A threads author can always lock their thread, but only unlock it if
+  // it was locked by themselves. (if a mod locks a thread an author cannot
+  // unlock it anymore)
+  const isAuthor = thread.creatorId === currentUser.id;
+  const authorCanLock =
+    !thread.isLocked || thread.lockedBy === thread.creatorId;
+  if (isAuthor && authorCanLock) {
+    return setThreadLock(threadId, value, currentUser.id);
+  }
+
   // get the channel permissions
   let [
     currentUserChannelPermissions,
@@ -46,10 +57,15 @@ export default async (
     currentUserCommunityPermissions.isOwner ||
     currentUserCommunityPermissions.isModerator
   ) {
-    return setThreadLock(threadId, value);
+    return setThreadLock(threadId, value, currentUser.id);
   }
 
   // if the user is not a channel or community owner, the thread can't be locked
+  if (isAuthor) {
+    return new UserError(
+      "You don't have permission to unlock this thread as it was locked by a moderator."
+    );
+  }
   return new UserError(
     "You don't have permission to make changes to this thread."
   );

iris/package.json

@@ -1,7 +1,7 @@
 {
   "dependencies": {
     "algoliasearch": "^3.24.7",
-    "apollo-engine": "0.8.4",
+    "apollo-engine": "1.x",
     "apollo-local-query": "^0.3.0",
     "apollo-upload-client": "^5.1.0",
     "apollo-upload-server": "^2.0.4",

iris/routes/api/graphql.js

@@ -12,6 +12,7 @@ import schema from '../../schema';
 export default graphqlExpress(req => ({
   schema,
   formatError: createErrorFormatter(req),
+  tracing: true,
   context: {
     user: req.user,
     loaders: createLoaders(),
@@ -30,5 +31,4 @@ export default graphqlExpress(req => ({
       },
     }),
   ],
-  tracing: true,
 }));

iris/routes/middlewares/engine.js

@@ -8,12 +8,6 @@ if (process.env.NODE_ENV === 'development') {
   middlewares.use(logging);
 }
 
-// Start apollo engine
-if (process.env.NODE_ENV === 'production' && !process.env.FORCE_DEV) {
-  const engine = require('./engine').default;
-  middlewares.use(engine.expressMiddleware());
-}
-
 if (process.env.NODE_ENV === 'production' && !process.env.FORCE_DEV) {
   // Raven (Sentry client) needs to come before everything else
   const raven = require('shared/middlewares/raven').default;

iris/routes/middlewares/index.js

@@ -32,10 +32,20 @@ module.exports = {
           );
 
         debug(`@${user.username || user.id} listening to updated DM threads`);
-        return asyncify(listenToUpdatedDirectMessageThreads(user.id), err => {
-          // Don't crash the whole API server on error in the listener
-          console.error(err);
-          Raven.captureException(err);
+        return asyncify(listenToUpdatedDirectMessageThreads(user.id), {
+          onError: err => {
+            // Don't crash the whole API server on error in the listener
+            console.error(err);
+            Raven.captureException(err);
+          },
+          onClose: cursor => {
+            if (cursor) {
+              /* ignore errors that happen when closing the cursor */
+              try {
+                cursor.close(() => {});
+              } catch (err) {}
+            }
+          },
         });
       },
     },