Separated laravel app to its own folder (#540)

api/app/Http/Middleware/AcceptsJsonMiddleware.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class AcceptsJsonMiddleware
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Illuminate\Http\Response|\Illuminate\Http\RedirectResponse)  $next
+     * @return \Illuminate\Http\Response|\Illuminate\Http\RedirectResponse
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        $request->headers->set('Accept', 'application/json');
+
+        return $next($request);
+    }
+}

api/app/Http/Middleware/Authenticate.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Auth\Middleware\Authenticate as Middleware;
+
+class Authenticate extends Middleware
+{
+    /**
+     * Get the path the user should be redirected to when they are not authenticated.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return string|null
+     */
+    protected function redirectTo($request)
+    {
+        if (! $request->expectsJson()) {
+            return redirect(front_url('login'));
+        }
+    }
+}

api/app/Http/Middleware/AuthenticateJWT.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Tymon\JWTAuth\Exceptions\JWTException;
+
+class AuthenticateJWT
+{
+    public const API_SERVER_SECRET_HEADER_NAME = 'x-api-secret';
+
+    /**
+     * Verifies the JWT token and validates the IP and User Agent
+     * Invalidates token otherwise
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        // Parse JWT Payload
+        try {
+            $payload = \JWTAuth::parseToken()->getPayload();
+        } catch (JWTException $e) {
+            return $next($request);
+        }
+
+        // Validate IP and User Agent
+        if ($payload) {
+            if ($frontApiSecret = $request->header(self::API_SERVER_SECRET_HEADER_NAME)) {
+                // If it's a trusted SSR request, skip the rest
+                if ($frontApiSecret === config('app.front_api_secret')) {
+                    return $next($request);
+                }
+            }
+
+            // If it's impersonating, skip the rest
+            if ($payload->get('impersonating')) {
+                return $next($request);
+            }
+
+            $error = null;
+            if (! \Hash::check($request->ip(), $payload->get('ip'))) {
+                $error = 'Origin IP is invalid';
+            }
+
+            if (! \Hash::check($request->userAgent(), $payload->get('ua'))) {
+                $error = 'Origin User Agent is invalid';
+            }
+
+            if ($error) {
+                auth()->invalidate();
+
+                return response()->json([
+                    'message' => $error,
+                ], 403);
+            }
+        }
+
+        return $next($request);
+    }
+}

api/app/Http/Middleware/CaddyRequestMiddleware.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class CaddyRequestMiddleware
+{
+    /**
+     * Handle an incoming request.
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        if (! config('custom-domains.enabled')) {
+            return response()->json([
+                'success' => false,
+                'message' => 'Custom domains not enabled',
+            ], 401);
+        }
+
+        if (config('custom-domains.enabled') && ! in_array($request->ip(), config('custom-domains.authorized_ips'))) {
+            return response()->json([
+                'success' => false,
+                'message' => 'Unauthorized IP',
+            ], 401);
+        }
+
+        $secret = $request->route('secret');
+        if (config('custom-domains.caddy_secret') && (! $secret || $secret !== config('custom-domains.caddy_secret'))) {
+            return response()->json([
+                'success' => false,
+                'message' => 'Unauthorized',
+            ], 401);
+        }
+
+        return $next($request);
+    }
+}

api/app/Http/Middleware/CustomDomainRestriction.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Http\Requests\Workspace\CustomDomainRequest;
+use App\Models\Forms\Form;
+use App\Models\Workspace;
+use Closure;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Http\Request;
+
+class CustomDomainRestriction
+{
+    public const CUSTOM_DOMAIN_HEADER = 'x-custom-domain';
+
+    /**
+     * Handle an incoming request.
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        if (! $request->hasHeader(self::CUSTOM_DOMAIN_HEADER) || ! config('custom-domains.enabled')) {
+            return $next($request);
+        }
+
+        $customDomain = $request->header(self::CUSTOM_DOMAIN_HEADER);
+        if (! preg_match(CustomDomainRequest::CUSTOM_DOMAINS_REGEX, $customDomain)) {
+            return response()->json([
+                'success' => false,
+                'message' => 'Invalid domain',
+                'error' => 'invalid_domain',
+            ], 420);
+        }
+
+        // Check if domain is different from current domain
+        $notionFormsDomain = parse_url(config('app.url'))['host'];
+        if ($customDomain == $notionFormsDomain) {
+            return $next($request);
+        }
+
+        // Check if domain is known
+        if (! $workspaces = Workspace::whereJsonContains('custom_domains', $customDomain)->get()) {
+            return response()->json([
+                'success' => false,
+                'message' => 'Unknown domain',
+                'error' => 'invalid_domain',
+            ], 420);
+        }
+
+        $workspacesIds = $workspaces->pluck('id')->toArray();
+        Workspace::addGlobalScope('domain-restricted', function (Builder $builder) use ($workspacesIds) {
+            $builder->whereIn('id', $workspacesIds);
+        });
+        Form::addGlobalScope('domain-restricted', function (Builder $builder) use ($workspacesIds) {
+            $builder->whereIn('workspace_id', $workspacesIds);
+        });
+
+        return $next($request);
+    }
+}

api/app/Http/Middleware/EncryptCookies.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Cookie\Middleware\EncryptCookies as Middleware;
+
+class EncryptCookies extends Middleware
+{
+    /**
+     * The names of the cookies that should not be encrypted.
+     *
+     * @var array
+     */
+    protected $except = [
+        //
+    ];
+}

api/app/Http/Middleware/Form/ProForm.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Http\Middleware\Form;
+
+use App\Models\Forms\Form;
+use Closure;
+use Illuminate\Http\Request;
+
+class ProForm
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Illuminate\Http\Response|\Illuminate\Http\RedirectResponse)  $next
+     * @return \Illuminate\Http\Response|\Illuminate\Http\RedirectResponse
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        if ($request->route('formId') && $form = Form::findOrFail($request->route('formId'))) {
+            if ($form->is_pro) {
+                $request->merge([
+                    'form' => $form,
+                ]);
+
+                return $next($request);
+            }
+        }
+
+        return response([
+            'status' => 'Unauthorized',
+            'message' => 'You need a subscription to access this content.',
+        ], 403);
+    }
+}

api/app/Http/Middleware/Form/ProtectedForm.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Http\Middleware\Form;
+
+use App\Models\Forms\Form;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+
+class ProtectedForm
+{
+    public const PASSWORD_HEADER_NAME = 'form-password';
+
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Illuminate\Http\Response|\Illuminate\Http\RedirectResponse)  $next
+     * @return \Illuminate\Http\Response|\Illuminate\Http\RedirectResponse
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        if (! $request->route('slug')) {
+            return $next($request);
+        }
+
+        $form = Form::where('slug', $request->route('slug'))->firstOrFail();
+        $request->merge([
+            'form' => $form,
+        ]);
+        $userIsFormOwner = Auth::check() && Auth::user()->ownsForm($form);
+        if (! $userIsFormOwner && $this->isProtected($request, $form)) {
+            return response([
+                'status' => 'Unauthorized',
+                'message' => 'Form is protected.',
+            ], 403);
+        }
+
+        return $next($request);
+    }
+
+    public static function isProtected(Request $request, Form $form)
+    {
+        if (! $form->has_password) {
+            return false;
+        }
+
+        return ! self::hasCorrectPassword($request, $form);
+    }
+
+    public static function hasCorrectPassword(Request $request, Form $form)
+    {
+        return $request->headers->has(self::PASSWORD_HEADER_NAME) && $request->headers->get(self::PASSWORD_HEADER_NAME) == hash('sha256', $form->password);
+    }
+}

api/app/Http/Middleware/Form/ResolveFormMiddleware.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Middleware\Form;
+
+use App\Models\Forms\Form;
+use Closure;
+use Illuminate\Http\Request;
+
+class ResolveFormMiddleware
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Illuminate\Http\Response|\Illuminate\Http\RedirectResponse)  $next
+     * @return \Illuminate\Http\Response|\Illuminate\Http\RedirectResponse
+     */
+    public function handle(Request $request, Closure $next, string $routeParamName = 'id')
+    {
+        $form = Form::where($routeParamName, $request->route($routeParamName))->firstOrFail();
+        $request->merge([
+            'form' => $form,
+        ]);
+
+        return $next($request);
+    }
+}

api/app/Http/Middleware/ImpersonationMiddleware.php

@@ -0,0 +1,104 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Tymon\JWTAuth\Exceptions\JWTException;
+
+class ImpersonationMiddleware
+{
+    public const ADMIN_LOG_PREFIX = '[admin_action] ';
+
+    public const LOG_ROUTES = [
+        'open.forms.store',
+        'open.forms.update',
+        'open.forms.duplicate',
+        'open.forms.regenerate-link',
+    ];
+
+    public const ALLOWED_ROUTES = [
+        'logout',
+
+        // Forms
+        'forms.ai.generate',
+        'forms.ai.show',
+        'forms.assets.show',
+        'forms.show',
+        'forms.answer',
+        'forms.fetchSubmission',
+        'forms.users.index',
+        'open.forms.index-all',
+        'open.forms.store',
+        'open.forms.assets.upload',
+        'open.forms.update',
+        'open.forms.duplicate',
+        'open.forms.regenerate-link',
+        'open.forms.submissions',
+        'open.forms.submissions.file',
+        'open.providers',
+        'open.forms.integrations',
+        'open.forms.integrations.events',
+
+        // Workspaces
+        'open.workspaces.index',
+        'open.workspaces.create',
+        'open.workspaces.delete',
+        'open.workspaces.save-custom-domains',
+        'open.workspaces.databases.search',
+        'open.workspaces.databases.show',
+        'open.workspaces.form.stats',
+        'open.workspaces.forms.index',
+        'open.workspaces.users.index',
+
+        'templates.index',
+        'templates.create',
+        'templates.update',
+        'templates.show',
+
+        'user.current',
+        'local.temp',
+        'vapor.signed-storage-url',
+        'upload-file'
+    ];
+
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Illuminate\Http\Response|\Illuminate\Http\RedirectResponse)  $next
+     * @return \Illuminate\Http\Response|\Illuminate\Http\RedirectResponse
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        try {
+            if (!auth()->check() || !auth()->payload()->get('impersonating')) {
+                return $next($request);
+            }
+        } catch (JWTException $e) {
+            return $next($request);
+        }
+
+        // Check that route is allowed
+        $routeName = $request->route()->getName();
+        if (!in_array($routeName, self::ALLOWED_ROUTES)) {
+            return response([
+                'message' => 'Unauthorized when impersonating',
+                'route' => $routeName,
+                'impersonator' => auth()->payload()->get('impersonator_id'),
+                'impersonated_account' => auth()->id(),
+                'url' => $request->fullUrl(),
+                'payload' => $request->all(),
+            ], 403);
+        } elseif (in_array($routeName, self::LOG_ROUTES)) {
+            \Log::warning(self::ADMIN_LOG_PREFIX . 'Impersonator action', [
+                'route' => $routeName,
+                'url' => $request->fullUrl(),
+                'impersonated_account' => auth()->id(),
+                'impersonator' => auth()->payload()->get('impersonator_id'),
+                'payload' => $request->all(),
+            ]);
+        }
+
+        return $next($request);
+    }
+}

api/app/Http/Middleware/IsAdmin.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class IsAdmin
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @return mixed
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        if ($request->user() && ! $request->user()->admin) {
+            // This user is not a paying customer...
+            if ($request->expectsJson()) {
+                return response([
+                    'message' => 'You are not allowed.',
+                    'type' => 'error',
+                ], 403);
+            }
+
+            return redirect('home');
+        }
+
+        return $next($request);
+    }
+}

api/app/Http/Middleware/IsModerator.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class IsModerator
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @return mixed
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        if ($request->user() && ! $request->user()->moderator) {
+            // This user is not a paying customer...
+            if ($request->expectsJson()) {
+                return response([
+                    'message' => 'You are not allowed.',
+                    'type' => 'error',
+                ], 403);
+            }
+
+            return redirect('home');
+        }
+
+        return $next($request);
+    }
+}

api/app/Http/Middleware/IsNotSubscribed.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class IsNotSubscribed
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @return mixed
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        if ($request->user() && $request->user()->subscribed()) {
+            // This user is a paying customer...
+            if ($request->expectsJson()) {
+                return response([
+                    'message' => 'You are already subscribed to NotionForms Pro.',
+                    'type' => 'error',
+                ], 401);
+            }
+
+            return redirect('billing');
+        }
+
+        return $next($request);
+    }
+}

api/app/Http/Middleware/IsSubscribed.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class IsSubscribed
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @return mixed
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        if ($request->user() && ! $request->user()->subscribed()) {
+            // This user is not a paying customer...
+            if ($request->expectsJson()) {
+                return response([
+                    'message' => 'You are not subscribed to NotionForms Pro.',
+                    'type' => 'error',
+                ], 401);
+            }
+
+            return redirect('billing');
+        }
+
+        return $next($request);
+    }
+}

api/app/Http/Middleware/PreventRequestsDuringMaintenance.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\PreventRequestsDuringMaintenance as Middleware;
+
+class PreventRequestsDuringMaintenance extends Middleware
+{
+    /**
+     * The URIs that should be reachable while maintenance mode is enabled.
+     *
+     * @var array
+     */
+    protected $except = [
+        //
+    ];
+}

api/app/Http/Middleware/RedirectIfAuthenticated.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Providers\RouteServiceProvider;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+
+class RedirectIfAuthenticated
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  string|null  ...$guards
+     * @return mixed
+     */
+    public function handle(Request $request, Closure $next, ...$guards)
+    {
+        $guards = empty($guards) ? [null] : $guards;
+
+        foreach ($guards as $guard) {
+            if (Auth::guard($guard)->check()) {
+                if ($request->expectsJson()) {
+                    return response()->json(['error' => 'Already authenticated.'], 400);
+                } else {
+                    return redirect(RouteServiceProvider::HOME);
+                }
+            }
+        }
+
+        return $next($request);
+    }
+}

api/app/Http/Middleware/SelfHostedCredentialsMiddleware.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Illuminate\Support\Facades\Cache;
+use App\Models\User;
+
+class SelfHostedCredentialsMiddleware
+{
+    public const ALLOWED_ROUTES = [
+        'login',
+        'credentials.update',
+        'user.current',
+        'logout',
+    ];
+
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (app()->environment('testing')) {
+            return $next($request);
+        }
+
+        if (in_array($request->route()->getName(), self::ALLOWED_ROUTES)) {
+            return $next($request);
+        }
+
+        if (
+            config('app.self_hosted') &&
+            $request->user() &&
+            !$this->isInitialSetupComplete()
+        ) {
+            return response()->json([
+                'message' => 'You must change your credentials when in self-hosted mode',
+                'type' => 'error',
+            ], Response::HTTP_FORBIDDEN);
+        }
+
+        return $next($request);
+    }
+
+    private function isInitialSetupComplete(): bool
+    {
+        return (bool) Cache::remember('initial_user_setup_complete', 60 * 60, function () {
+            $maxUserId = $this->getMaxUserId();
+            if ($maxUserId === 0) {
+                return false;
+            }
+            return !User::where('email', 'admin@opnform.com')->exists();
+        });
+    }
+
+    private function getMaxUserId(): int
+    {
+        return (int) Cache::remember('max_user_id', 60 * 60, function () {
+            return User::max('id') ?? 0;
+        });
+    }
+}

api/app/Http/Middleware/SetLocale.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+
+class SetLocale
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return mixed
+     */
+    public function handle($request, Closure $next)
+    {
+        if ($locale = $this->parseLocale($request)) {
+            app()->setLocale($locale);
+        }
+
+        return $next($request);
+    }
+
+    /**
+     * @param  \Illuminate\Http\Request  $request
+     * @return string|null
+     */
+    protected function parseLocale($request)
+    {
+        $locales = config('app.locales');
+
+        $locale = $request->server('HTTP_ACCEPT_LANGUAGE');
+        $locale = substr($locale, 0, strpos($locale, ',') ?: strlen($locale));
+
+        if (array_key_exists($locale, $locales)) {
+            return $locale;
+        }
+
+        $locale = substr($locale, 0, 2);
+        if (array_key_exists($locale, $locales)) {
+            return $locale;
+        }
+    }
+}

api/app/Http/Middleware/TrimStrings.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\TrimStrings as Middleware;
+
+class TrimStrings extends Middleware
+{
+    /**
+     * The names of the attributes that should not be trimmed.
+     *
+     * @var array
+     */
+    protected $except = [
+        'password',
+        'password_confirmation',
+    ];
+
+    /**
+     * The route name where this shouldn't be applied
+     *
+     * @var string[]
+     */
+    protected $exceptUrls = [
+        '/\/api\/forms\/(.*)\/answer/',
+    ];
+
+    public function handle($request, \Closure $next)
+    {
+        // Check if URL matches
+        foreach ($this->exceptUrls as $urlRegex) {
+            $matches = null;
+            preg_match($urlRegex, $request->url(), $matches);
+
+            if (count($matches)) {
+                return $next($request);
+            }
+        }
+
+        return parent::handle($request, $next);
+    }
+}

api/app/Http/Middleware/TrustHosts.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Http\Middleware\TrustHosts as Middleware;
+
+class TrustHosts extends Middleware
+{
+    /**
+     * Get the host patterns that should be trusted.
+     *
+     * @return array
+     */
+    public function hosts()
+    {
+        return [
+            $this->allSubdomainsOfApplicationUrl(),
+        ];
+    }
+}

api/app/Http/Middleware/TrustProxies.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Http\Middleware\TrustProxies as Middleware;
+use Illuminate\Http\Request;
+
+class TrustProxies extends Middleware
+{
+    /**
+     * The trusted proxies for this application.
+     *
+     * @var array|string|null
+     */
+    protected $proxies;
+
+    /**
+     * The headers that should be used to detect proxies.
+     *
+     * @var int
+     */
+    protected $headers =
+        Request::HEADER_X_FORWARDED_FOR |
+        Request::HEADER_X_FORWARDED_HOST |
+        Request::HEADER_X_FORWARDED_PORT |
+        Request::HEADER_X_FORWARDED_PROTO |
+        Request::HEADER_X_FORWARDED_AWS_ELB;
+}

api/app/Http/Middleware/VerifyCsrfToken.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;
+
+class VerifyCsrfToken extends Middleware
+{
+    /**
+     * The URIs that should be excluded from CSRF verification.
+     *
+     * @var array
+     */
+    protected $except = [
+        'stripe/webhook',
+        'vapor/signed-storage-url',
+        'upload-file',
+    ];
+}