From ef7d6db912ed9bdd373a12b470136c5ce1d2b23f Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Fri, 4 Dec 2020 09:37:50 -0500
Subject: [PATCH] feat: server-side work for #9047

- rename Thumbs.commit to Thumbs.migrate
- new PUT method that calls Thumbs.migrate
- `checkThumbPrivileges` now takes a single object parameter (ins. of req/res)
---
 src/api/posts.js                |  2 +-
 src/api/topics.js               |  2 +-
 src/controllers/write/topics.js | 25 +++++++++++++++++++------
 src/routes/write/topics.js      |  1 +
 src/topics/thumbs.js            |  4 ++--
 5 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/src/api/posts.js b/src/api/posts.js
index c96a602484..ca77e1ce33 100644
--- a/src/api/posts.js
+++ b/src/api/posts.js
@@ -37,7 +37,7 @@ postsAPI.edit = async function (caller, data) {
 
 	const editResult = await posts.edit(data);
 	if (editResult.topic.isMainPost) {
-		await topics.thumbs.commit(data.uuid, editResult.topic.tid);
+		await topics.thumbs.migrate(data.uuid, editResult.topic.tid);
 	}
 	if (editResult.topic.renamed) {
 		await events.log({
diff --git a/src/api/topics.js b/src/api/topics.js
index e252dd7515..f313321c8e 100644
--- a/src/api/topics.js
+++ b/src/api/topics.js
@@ -34,7 +34,7 @@ topicsAPI.create = async function (caller, data) {
 	}
 
 	const result = await topics.post(payload);
-	await topics.thumbs.commit(data.uuid, result.topicData.tid);
+	await topics.thumbs.migrate(data.uuid, result.topicData.tid);
 
 	socketHelpers.emitToUids('event:new_post', { posts: [result.postData] }, [caller.uid]);
 	socketHelpers.emitToUids('event:new_topic', result.topicData, [caller.uid]);
diff --git a/src/controllers/write/topics.js b/src/controllers/write/topics.js
index 2277849683..df80991cb1 100644
--- a/src/controllers/write/topics.js
+++ b/src/controllers/write/topics.js
@@ -95,7 +95,7 @@ Topics.getThumbs = async (req, res) => {
 };
 
 Topics.addThumb = async (req, res) => {
-	await checkThumbPrivileges(req, res);
+	await checkThumbPrivileges({ tid: req.params.tid, uid: req.user.uid, res });
 	if (res.headersSent) {
 		return;
 	}
@@ -117,8 +117,21 @@ Topics.addThumb = async (req, res) => {
 	}));
 };
 
+Topics.migrateThumbs = async (req, res) => {
+	await Promise.all([
+		checkThumbPrivileges({ tid: req.params.tid, uid: req.user.uid, res }),
+		checkThumbPrivileges({ tid: req.body.tid, uid: req.user.uid, res }),
+	]);
+	if (res.headersSent) {
+		return;
+	}
+
+	await topics.thumbs.migrate(req.params.tid, req.body.tid);
+	helpers.formatApiResponse(200, res);
+};
+
 Topics.deleteThumb = async (req, res) => {
-	await checkThumbPrivileges(req, res);
+	await checkThumbPrivileges({ tid: req.params.tid, uid: req.user.uid, res });
 	if (res.headersSent) {
 		return;
 	}
@@ -127,17 +140,17 @@ Topics.deleteThumb = async (req, res) => {
 	helpers.formatApiResponse(200, res, await topics.thumbs.get(req.params.tid));
 };
 
-async function checkThumbPrivileges(req, res) {
+async function checkThumbPrivileges({ tid, uid, res }) {
 	// req.params.tid could be either a tid (pushing a new thumb to an existing topic) or a post UUID (a new topic being composed)
-	const isUUID = validator.isUUID(req.params.tid);
+	const isUUID = validator.isUUID(tid);
 
 	// Sanity-check the tid if it's strictly not a uuid
-	if (!isUUID && (isNaN(parseInt(req.params.tid, 10)) || !await topics.exists(req.params.tid))) {
+	if (!isUUID && (isNaN(parseInt(tid, 10)) || !await topics.exists(tid))) {
 		return helpers.formatApiResponse(404, res, new Error('[[error:no-topic]]'));
 	}
 
 	// While drafts are not protected, tids are
-	if (!isUUID && !await privileges.topics.canEdit(req.params.tid, req.user.uid)) {
+	if (!isUUID && !await privileges.topics.canEdit(tid, uid)) {
 		return helpers.formatApiResponse(403, res, new Error('[[error:no-privileges]]'));
 	}
 }
diff --git a/src/routes/write/topics.js b/src/routes/write/topics.js
index aa290c52c8..4ea061e911 100644
--- a/src/routes/write/topics.js
+++ b/src/routes/write/topics.js
@@ -36,6 +36,7 @@ module.exports = function () {
 
 	setupApiRoute(router, 'get', '/:tid/thumbs', [], controllers.write.topics.getThumbs);
 	setupApiRoute(router, 'post', '/:tid/thumbs', [multipartMiddleware, middleware.validateFiles, ...middlewares], controllers.write.topics.addThumb);
+	setupApiRoute(router, 'put', '/:tid/thumbs', [], controllers.write.topics.migrateThumbs);
 	setupApiRoute(router, 'delete', '/:tid/thumbs', [...middlewares, middleware.assert.path], controllers.write.topics.deleteThumb);
 
 	return router;
diff --git a/src/topics/thumbs.js b/src/topics/thumbs.js
index 5303a2d319..1b15441486 100644
--- a/src/topics/thumbs.js
+++ b/src/topics/thumbs.js
@@ -45,11 +45,11 @@ Thumbs.associate = async function (id, path) {
 	db.sortedSetAdd(set, numThumbs, path);
 };
 
-Thumbs.commit = async function (uuid, tid) {
+Thumbs.migrate = async function (uuid, id) {
 	// Converts the draft thumb zset to the topic zset (combines thumbs if applicable)
 	const set = `draft:${uuid}:thumbs`;
 	const thumbs = await db.getSortedSetRange(set, 0, -1);
-	await Promise.all(thumbs.map(async path => await Thumbs.associate(tid, path)));
+	await Promise.all(thumbs.map(async path => await Thumbs.associate(id, path)));
 	await db.delete(set);
 };