server.js

var ERR = require('async-stacktrace');
var _ = require('lodash');
var fs = require('fs');
var path = require('path');
var favicon = require('serve-favicon');
var async = require('async');
var express = require('express');
var bodyParser = require('body-parser');
var cookieParser = require('cookie-parser');
var http = require('http');
var https = require('https');

var logger = require('./lib/logger');
var error = require('./lib/error');
var config = require('./lib/config');
var messageQueue = require('./lib/messageQueue');
var assessments = require('./assessments');
var sqldb = require('./lib/sqldb');
var models = require('./models');
var sprocs = require('./sprocs');
var cron = require('./cron');
var socketServer = require('./lib/socket-server');
var serverJobs = require('./lib/server-jobs');
var syncFromDisk = require('./sync/syncFromDisk');

if (config.startServer) {
    logger.info('PrairieLearn server start');

    configFilename = 'config.json';
    if (process.argv.length > 2) {
        configFilename = process.argv[2];
    }

    config.loadConfig(configFilename);

    if (config.logFilename) {
        logger.addFileLogging(config.logFilename);
        logger.verbose('activated file logging: ' + config.logFilename);
    }
}

var app = express();
app.set('views', __dirname);
app.set('view engine', 'ejs');

config.devMode = (app.get('env') == 'development');

app.use(bodyParser.json());
app.use(bodyParser.urlencoded({extended: false}));
app.use(cookieParser());
app.use(favicon(path.join(__dirname, 'public', 'favicon.ico')));
app.use(express.static(path.join(__dirname, 'public')));

// Middleware for all requests
// response_id is logged on request, response, and error to link them together
var chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'.split('')
app.use(function(req, res, next) {res.locals.response_id = _.times(12, function() {return _.sample(chars);}).join(''); next();});
app.use(require('./middlewares/logResponse')); // defers to end of response
app.use(function(req, res, next) {res.locals.urlPrefix = res.locals.plainUrlPrefix = '/pl'; next();});
app.use(function(req, res, next) {res.locals.navbarType = 'plain'; next();});
app.use(function(req, res, next) {res.locals.devMode = config.devMode; next();});
app.use(require('./middlewares/cors'));
app.use(require('./middlewares/authn')); // authentication, set res.locals.authn_user
app.use(require('./middlewares/csrfToken')); // sets and checks res.locals.csrfToken
app.use(require('./middlewares/logRequest'));

// clear all cached course code in dev mode (no authorization needed)
if (config.devMode) {
    app.use(require('./middlewares/undefCourseCode'));
}

// redirect / to /pl
app.use(/^\/?$/, function(req, res, next) {res.redirect('/pl');});

// clear cookies on the homepage to reset any stale session state
app.use(/^\/pl\/?/, require('./middlewares/clearCookies'));

// course selection pages don't need authorization
app.use('/pl', require('./pages/home/home'));
app.use('/pl/enroll', require('./pages/enroll/enroll'));

// dev-mode pages are mounted for both out-of-course access (here) and within-course access (see below)
if (config.devMode) {
    app.use('/pl/loadFromDisk', require('./pages/instructorLoadFromDisk/instructorLoadFromDisk'));
    app.use('/pl/jobSequence', require('./pages/instructorJobSequence/instructorJobSequence'));
}

// all pages under /pl/course_instance require authorization
app.use('/pl/course_instance/:course_instance_id', require('./middlewares/authzCourseInstance')); // sets res.locals.course and res.locals.courseInstance
app.use('/pl/course_instance/:course_instance_id', function(req, res, next) {res.locals.urlPrefix = '/pl/course_instance/' + req.params.course_instance_id; next();});
app.use('/pl/course_instance/:course_instance_id', function(req, res, next) {res.locals.navbarType = 'student'; next();});

// Redirect plain course page to Instructor or Student assessments page.
// We have to do this after initial authz so we know whether we are an Instructor,
// but before instructor authz so we still get a chance to enforce that.
app.use(/^\/pl\/course_instance\/[0-9]+\/?$/, function(req, res, next) {
    if (res.locals.authz_data.has_instructor_view) {
        res.redirect(res.locals.urlPrefix + '/instructor/assessments');
    } else {
        res.redirect(res.locals.urlPrefix + '/assessments');
    }
});

// Redirect Instructor effectiveUser page to the Student version if we don't have Instructor authz.
// This is needed to handle the redirection after we change effective user to a student.
app.use(/^\/pl\/course_instance\/[0-9]+\/instructor\/effectiveUser(\/?.*)$/, function(req, res, next) {
    if (!res.locals.authz_data.has_instructor_view) {
        res.redirect(res.locals.urlPrefix + '/effectiveUser');
    } else {
        next();
    }
});

// all pages under /pl/course_instance/*/instructor require instructor permissions
app.use('/pl/course_instance/:course_instance_id/instructor', require('./middlewares/authzCourseInstanceHasInstructorView'));
app.use('/pl/course_instance/:course_instance_id/instructor', function(req, res, next) {res.locals.urlPrefix = '/pl/course_instance/' + req.params.course_instance_id + '/instructor'; next();});
app.use('/pl/course_instance/:course_instance_id/instructor', function(req, res, next) {res.locals.navbarType = 'instructor'; next();});

//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
// Instructor pages //////////////////////////////////////////////////

app.use('/pl/course_instance/:course_instance_id/instructor/effectiveUser', require('./pages/instructorEffectiveUser/instructorEffectiveUser'));
app.use('/pl/course_instance/:course_instance_id/instructor/assessments', require('./pages/instructorAssessments/instructorAssessments'));
app.use('/pl/course_instance/:course_instance_id/instructor/assessment/:assessment_id', [
    require('./middlewares/selectAndAuthzAssessment'),
    require('./pages/instructorAssessment/instructorAssessment'),
]);
app.use('/pl/course_instance/:course_instance_id/instructor/assessment_instance/:assessment_instance_id', [
    require('./middlewares/selectAndAuthzAssessmentInstance'),
    require('./pages/instructorAssessmentInstance/instructorAssessmentInstance'),
]);
app.use('/pl/course_instance/:course_instance_id/instructor/question/:question_id', [
    require('./middlewares/selectAndAuthzInstructorQuestion'),
    require('./pages/instructorQuestion/instructorQuestion'),
]);
app.use('/pl/course_instance/:course_instance_id/instructor/gradebook', require('./pages/instructorGradebook/instructorGradebook'));
app.use('/pl/course_instance/:course_instance_id/instructor/questions', require('./pages/instructorQuestions/instructorQuestions'));
app.use('/pl/course_instance/:course_instance_id/instructor/syncs', require('./pages/courseSyncs/courseSyncs'));
app.use('/pl/course_instance/:course_instance_id/instructor/jobSequence', require('./pages/instructorJobSequence/instructorJobSequence'));
app.use('/pl/course_instance/:course_instance_id/instructor/loadFromDisk', require('./pages/instructorLoadFromDisk/instructorLoadFromDisk'));
app.use('/pl/course_instance/:course_instance_id/instructor/course', require('./middlewares/authzCourseInstanceHasCourseView'));
app.use('/pl/course_instance/:course_instance_id/instructor/course', require('./pages/courseOverview/courseOverview'));

// clientFiles
app.use('/pl/course_instance/:course_instance_id/instructor/clientFilesCourse', require('./pages/clientFilesCourse/clientFilesCourse'));
app.use('/pl/course_instance/:course_instance_id/instructor/clientFilesCourseInstance', require('./pages/clientFilesCourseInstance/clientFilesCourseInstance'));
app.use('/pl/course_instance/:course_instance_id/instructor/assessment/:assessment_id/clientFilesAssessment', [
    require('./middlewares/selectAndAuthzAssessment'),
    require('./pages/clientFilesAssessment/clientFilesAssessment'),
]);
app.use('/pl/course_instance/:course_instance_id/instructor/question/:question_id/clientFilesQuestion', [
    require('./middlewares/selectAndAuthzInstructorQuestion'),
    require('./pages/clientFilesQuestion/clientFilesQuestion'),
]);

// generatedFiles
app.use('/pl/course_instance/:course_instance_id/instructor/question/:question_id/generatedFilesQuestion', [
    require('./middlewares/selectAndAuthzInstructorQuestion'),
    require('./pages/instructorGeneratedFilesQuestion/instructorGeneratedFilesQuestion'),
]);

// legacy client file paths
app.use('/pl/course_instance/:course_instance_id/instructor/question/:question_id/file', [
    require('./middlewares/selectAndAuthzInstructorQuestion'),
    require('./pages/legacyQuestionFile/legacyQuestionFile'),
]);
app.use('/pl/course_instance/:course_instance_id/instructor/question/:question_id/text', [
    require('./middlewares/selectAndAuthzInstructorQuestion'),
    require('./pages/legacyQuestionText/legacyQuestionText'),
]);

//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
// Student pages /////////////////////////////////////////////////////

// Exam/Homeworks student routes are polymorphic - they have multiple handlers, each of
// which checks the assessment type and calls next() if it's not the right type
app.use('/pl/course_instance/:course_instance_id/assessments', require('./pages/studentAssessments/studentAssessments'));
app.use('/pl/course_instance/:course_instance_id/assessment/:assessment_id', [
    require('./middlewares/selectAndAuthzAssessment'),
    require('./pages/studentAssessmentHomework/studentAssessmentHomework'),
    require('./pages/studentAssessmentExam/studentAssessmentExam'),
]);
app.use('/pl/course_instance/:course_instance_id/assessment_instance/:assessment_instance_id', [
    require('./middlewares/selectAndAuthzAssessmentInstance'),
    require('./pages/studentAssessmentInstanceHomework/studentAssessmentInstanceHomework'),
    require('./pages/studentAssessmentInstanceExam/studentAssessmentInstanceExam'),
]);
app.use('/pl/course_instance/:course_instance_id/instance_question/:instance_question_id', [
    require('./middlewares/selectAndAuthzInstanceQuestion'),
    require('./pages/studentInstanceQuestionHomework/studentInstanceQuestionHomework'),
    require('./pages/studentInstanceQuestionExam/studentInstanceQuestionExam'),
]);
if (config.devMode) {
    app.use('/pl/course_instance/:course_instance_id/loadFromDisk', require('./pages/instructorLoadFromDisk/instructorLoadFromDisk'));
    app.use('/pl/course_instance/:course_instance_id/jobSequence', require('./middlewares/authzCourseInstanceHasInstructorView'));
    app.use('/pl/course_instance/:course_instance_id/jobSequence', require('./pages/instructorJobSequence/instructorJobSequence'));
}

// Allow access to effectiveUser as a Student page, but only for users have authn (not authz) as Instructor
app.use('/pl/course_instance/:course_instance_id/effectiveUser', require('./middlewares/authzCourseInstanceAuthnHasInstructorView'));
app.use('/pl/course_instance/:course_instance_id/effectiveUser', require('./pages/instructorEffectiveUser/instructorEffectiveUser'));

// clientFiles
app.use('/pl/course_instance/:course_instance_id/clientFilesCourse', require('./pages/clientFilesCourse/clientFilesCourse'));
app.use('/pl/course_instance/:course_instance_id/clientFilesCourseInstance', require('./pages/clientFilesCourseInstance/clientFilesCourseInstance'));
app.use('/pl/course_instance/:course_instance_id/assessment/:assessment_id/clientFilesAssessment', [
    require('./middlewares/selectAndAuthzAssessment'),
    require('./pages/clientFilesAssessment/clientFilesAssessment'),
]);
app.use('/pl/course_instance/:course_instance_id/instance_question/:instance_question_id/clientFilesQuestion', [
    require('./middlewares/selectAndAuthzInstanceQuestion'),
    require('./pages/clientFilesQuestion/clientFilesQuestion'),
]);

// generatedFiles
app.use('/pl/course_instance/:course_instance_id/instance_question/:instance_question_id/generatedFilesQuestion', [
    require('./middlewares/selectAndAuthzInstanceQuestion'),
    require('./pages/studentGeneratedFilesQuestion/studentGeneratedFilesQuestion'),
]);

// legacy client file paths
app.use('/pl/course_instance/:course_instance_id/instance_question/:instance_question_id/file', [
    require('./middlewares/selectAndAuthzInstanceQuestion'),
    require('./pages/legacyQuestionFile/legacyQuestionFile'),
]);
app.use('/pl/course_instance/:course_instance_id/instance_question/:instance_question_id/text', [
    require('./middlewares/selectAndAuthzInstanceQuestion'),
    require('./pages/legacyQuestionText/legacyQuestionText'),
]);

//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
// Course pages //////////////////////////////////////////////////////

app.use('/pl/course/:course_id', require('./middlewares/authzCourse')); // set res.locals.course
app.use('/pl/course/:course_id', function(req, res, next) {res.locals.urlPrefix = '/pl/course/' + req.params.course_id; next();});
app.use('/pl/course/:course_id', function(req, res, next) {res.locals.navbarType = 'course'; next();});
app.use(/^\/pl\/course\/[0-9]+\/?$/, function(req, res, next) {res.redirect(res.locals.urlPrefix + '/overview');}); // redirect plain course URL to overview page
app.use('/pl/course/:course_id/overview', require('./pages/courseOverview/courseOverview'));
app.use('/pl/course/:course_id/loadFromDisk', require('./pages/instructorLoadFromDisk/instructorLoadFromDisk'));
app.use('/pl/course/:course_id/syncs', require('./pages/courseSyncs/courseSyncs'));
app.use('/pl/course/:course_id/jobSequence', require('./pages/instructorJobSequence/instructorJobSequence'));

//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
// Administrator pages ///////////////////////////////////////////////

app.use('/pl/administrator', require('./middlewares/authzIsAdministrator'));
app.use('/pl/administrator/overview', require('./pages/administratorOverview/administratorOverview'));

//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
// Error handling ////////////////////////////////////////////////////

app.use(require('./middlewares/notFound')); // if no earlier routes matched, this will match and generate a 404 error
app.use(require('./pages/error/error'));

//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
// Server startup ////////////////////////////////////////////////////

var server;

module.exports.startServer = function(callback) {
    if (config.serverType === 'https') {
        var options = {
            key: fs.readFileSync('/etc/pki/tls/private/localhost.key'),
            cert: fs.readFileSync('/etc/pki/tls/certs/localhost.crt'),
            ca: [fs.readFileSync('/etc/pki/tls/certs/server-chain.crt')]
        };
        server = https.createServer(options, app);
        server.listen(config.serverPort);
        logger.verbose('server listening to HTTPS on port ' + config.serverPort);
        callback(null);
    } else if (config.serverType === 'http') {
        server = http.createServer(app);
        server.listen(config.serverPort);
        logger.verbose('server listening to HTTP on port ' + config.serverPort);
        callback(null);
    } else {
        callback('unknown serverType: ' + config.serverType);
    }
};

module.exports.stopServer = function(callback) {
    if (!server) return callback(new Error('cannot stop an undefined server'));
    server.close(function(err) {
        if (ERR(err, callback)) return;
        callback(null);
    });
};

module.exports.insertDevUser = function(callback) {
    // add dev user as Administrator
    var sql
        = "INSERT INTO users (uid, name)"
        + " VALUES ('dev@example.com', 'Dev User')"
        + " ON CONFLICT (uid) DO UPDATE"
        + " SET name = EXCLUDED.name"
        + " RETURNING user_id;";
    sqldb.queryOneRow(sql, [], function(err, result) {
        if (ERR(err, callback)) return;
        var user_id = result.rows[0].user_id;
        var sql
            = "INSERT INTO administrators (user_id)"
            + " VALUES ($user_id)"
            + " ON CONFLICT (user_id) DO NOTHING;";
        var params = {user_id};
        sqldb.query(sql, params, function(err) {
            if (ERR(err, callback)) return;
            callback(null);
        });
    });
};

if (config.startServer) {
    async.series([
        function(callback) {
            var pgConfig = {
                user: config.postgresqlUser,
                database: config.postgresqlDatabase,
                host: config.postgresqlHost,
                password: config.postgresqlPassword,
                max: 10,
                idleTimeoutMillis: 30000,
            };
            logger.verbose('Connecting to database ' + pgConfig.postgresqlUser + '@' + pgConfig.host + ':' + pgConfig.database);
            var idleErrorHandler = function(err) {
                logger.error('idle client error', err);
            };
            sqldb.init(pgConfig, idleErrorHandler, function(err) {
                if (ERR(err, callback)) return;
                logger.verbose('Successfully connected to database');
                callback(null);
            });
        },
        function(callback) {
            models.init(function(err) {
                if (ERR(err, callback)) return;
                callback(null);
            });
        },
        function(callback) {
            sprocs.init(function(err) {
                if (ERR(err, callback)) return;
                callback(null);
            });
        },
        function(callback) {
            cron.init(function(err) {
                if (ERR(err, callback)) return;
                callback(null);
            });
        },
        function(callback) {
            var ampqConfig = {
                amqpAddress: config.amqpAddress,
                amqpResultQueue: config.amqpResultQueue,
                amqpStartQueue: config.amqpStartQueue,
            };
            messageQueue.init(ampqConfig, assessments.processGradingResult, function(err) {
                if (err) err = error.newMessage(err, 'Unable to connect to message queue');
                if (ERR(err, callback)) return;
                callback(null);
            });
        },
        function(callback) {
            if (!config.devMode) return callback(null);
            module.exports.insertDevUser(function(err) {
                if (ERR(err, callback)) return;
                callback(null);
            });
        },
        function(callback) {
            logger.verbose('Starting server...');
            module.exports.startServer(function(err) {
                if (ERR(err, callback)) return;
                callback(null);
            });
        },
        function(callback) {
            socketServer.init(server, function(err) {
                if (ERR(err, callback)) return;
                callback(null);
            });
        },
        function(callback) {
            serverJobs.init(function(err) {
                if (ERR(err, callback)) return;
                callback(null);
            });
        },
    ], function(err, data) {
        if (err) {
            logger.error('Error initializing PrairieLearn server:', err, data);
            logger.error('Exiting...');
            process.exit(1);
        } else {
            logger.info('PrairieLearn server ready');
            if (config.devMode) {
                logger.info('Go to ' + config.serverType + '://localhost:' + config.serverPort + '/pl');
            }
        }
    });
}

//module.exports = app;