Release v2.17.0: add read-only user previews and access fallbacks

src/web/middleware.js

@@ -23,6 +23,9 @@ module.exports = function registerMiddleware(app, deps) {
   app.use(async function (req, _res, next) {
     try {
       req.currentUser = await loadCurrentUser(pool, req);
+      req.authenticatedUser = req.currentUser && req.currentUser.authenticatedUser
+        ? req.currentUser.authenticatedUser
+        : req.currentUser;
       next();
     } catch (error) {
       next(error);
@@ -32,14 +35,26 @@ module.exports = function registerMiddleware(app, deps) {
   registerErrorPageMiddleware(app, deps.pages);
 
   app.use(function (req, res, next) {
+    const isViewAsStop = req.method === 'POST' && req.path === '/settings/view-as/stop';
+    if (req.currentUser && req.currentUser.isViewingAs && !['GET', 'HEAD', 'OPTIONS'].includes(String(req.method || '').toUpperCase()) && !isViewAsStop) {
+      const error = new Error('This preview is read-only. Exit View as to make changes.');
+      error.statusCode = 403;
+      error.expose = true;
+      return next(error);
+    }
+
     if (req.path === '/' || req.path === '/login' || req.path === '/logout' || req.path === '/forgot-password' || req.path === '/reset-password' || req.path === '/verify-email' || req.path === '/slides/popup-preview' || req.path.indexOf('/api/internal/slide-thumbnails/') === 0 || req.path === '/api/internal/sync/player-media' || req.path === '/api/internal/sync/player-font' || req.path === '/api/internal/sync/player-control') {
       return next();
     }
 
     return requireAuth(req, res, function () {
-      if (req.currentUser && req.currentUser.mustChangePassword && req.path !== '/account' && req.path !== '/account/password' && req.path !== '/account/sessions/revoke' && req.path !== '/logout') {
-        return res.redirect('/account?message=' + encodeURIComponent('Please change your password before continuing.'));
+      const mustChangePassword = req.currentUser && req.currentUser.isViewingAs
+        ? Boolean(req.authenticatedUser && req.authenticatedUser.mustChangePassword)
+        : Boolean(req.authenticatedUser && req.authenticatedUser.mustChangePassword || req.currentUser && req.currentUser.mustChangePassword);
+      if (mustChangePassword && req.path !== '/account/password' && req.path !== '/settings/view-as/stop' && req.path !== '/logout') {
+        return res.redirect('/account/password');
       }
+
       next();
     });
   });