routes/note.php


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

<?php

use Digitigrade\HttpResponseStatus\Forbidden;
use Digitigrade\HttpResponseStatus\NotFound;
use Digitigrade\HttpResponseStatus\PolicyRejected;
use Digitigrade\HttpResponseStatus\TemporaryRedirect;
use Digitigrade\Model\Instance;
use Digitigrade\Model\Note;
use Digitigrade\Model\NotePrivacyScope;
use Digitigrade\Model\UserAccount;
use Digitigrade\PolicyManager;
use Digitigrade\Router;

Router::getInstance()->mount('/note/:id', function (array $args) {
    $note = Note::find($args['id']);
    $instance = Instance::findByRequestHeaders();
    if ($note == null || $note->deleted) {
        throw new NotFound("i don't know that note");
    }
    if (!$note->author->isLocal) {
        throw new NotFound("i don't want to tell you about non local notes sorry");
    }
    PolicyManager::getInstance()->checkFederationOrThrow($note, $instance);
    if (isset($_SERVER['HTTP_ACCEPT']) && str_contains($_SERVER['HTTP_ACCEPT'], 'text/html')) {
        throw new TemporaryRedirect('/@/' . $note->author->handle . "/note/$note->id");
    }
    // if it's not public we need to check whether the requesting instance is allowed to see it
    if ($note->privacy->scope != NotePrivacyScope::PUBLIC ) {
        $instance = Instance::requireByRequestHeaders();
        $allowed = $note->getRelevantServers();
        if (!in_array($instance, $allowed)) {
            throw new Forbidden();
        }
    }
    json_response($note);
});

Router::getInstance()->mount('/@/:handle/note/:id', function (array $args) {
    $note = Note::find($args['id']);
    if ($note == null || $note->deleted) {
        throw new NotFound("i don't know that note");
    }
    // check the current user is allowed to see it
    if ($note->privacy->scope != NotePrivacyScope::PUBLIC ) {
        $user = UserAccount::requireByCurrentSession();
        if (!in_array($user->actor, $note->getRelevantActors())) {
            throw new Forbidden();
        }
    }
    // change the handle in the url if it's wrong
    if ($args['handle'] != $note->author->getFullHandle()) {
        throw new TemporaryRedirect('/@/' . $note->author->getFullHandle() . "/note/$note->id");
    }
    render_template('thread_page', ['note' => $note]);
});