From aeba7674f816bd7834a2f13c3b71b65cceab4f0c Mon Sep 17 00:00:00 2001
From: advplyr <advplyr@protonmail.com>
Date: Tue, 27 Jun 2023 16:41:32 -0500
Subject: [PATCH] Add new api route for downloading backup, remove static
 metadata route

---
 client/components/tables/BackupsTable.vue |  8 +++--
 server/Server.js                          |  3 --
 server/controllers/BackupController.js    | 36 ++++++++++++++++-------
 server/managers/BackupManager.js          |  2 +-
 server/routers/ApiRouter.js               |  1 +
 5 files changed, 33 insertions(+), 17 deletions(-)

diff --git a/client/components/tables/BackupsTable.vue b/client/components/tables/BackupsTable.vue
index 6df009b8..78ecd8e2 100644
--- a/client/components/tables/BackupsTable.vue
+++ b/client/components/tables/BackupsTable.vue
@@ -23,12 +23,13 @@
             <div class="w-full flex flex-row items-center justify-center">
               <ui-btn v-if="backup.serverVersion" small color="primary" @click="applyBackup(backup)">{{ $strings.ButtonRestore }}</ui-btn>
 
-              <a v-if="backup.serverVersion" :href="`/metadata/${$encodeUriPath(backup.path)}?token=${userToken}`" class="mx-1 pt-1 hover:text-opacity-100 text-opacity-70 text-white" download><span class="material-icons text-xl">download</span></a>
+              <button v-if="backup.serverVersion" aria-label="Download Backup" class="inline-flex material-icons text-xl mx-1 mt-1 text-white/70 hover:text-white/100" @click.stop="downloadBackup(backup)">download</button>
+
               <ui-tooltip v-else text="This backup was created with an old version of audiobookshelf no longer supported" direction="bottom" class="mx-2 flex items-center">
                 <span class="material-icons-outlined text-2xl text-error">error_outline</span>
               </ui-tooltip>
 
-              <span class="material-icons text-xl hover:text-error hover:text-opacity-100 text-opacity-70 text-white cursor-pointer mx-1" @click="deleteBackupClick(backup)">delete</span>
+              <button v-if="backup.serverVersion" aria-label="Delete Backup" class="inline-flex material-icons text-xl mx-1 text-white/70 hover:text-error" @click="deleteBackupClick(backup)">delete</button>
             </div>
           </td>
         </tr>
@@ -80,6 +81,9 @@ export default {
     }
   },
   methods: {
+    downloadBackup(backup) {
+      this.$downloadFile(`${process.env.serverUrl}/api/backups/${backup.id}/download?token=${this.userToken}`)
+    },
     confirm() {
       this.showConfirmApply = false
 
diff --git a/server/Server.js b/server/Server.js
index de4156ce..be5a8067 100644
--- a/server/Server.js
+++ b/server/Server.js
@@ -159,9 +159,6 @@ class Server {
     const distPath = Path.join(global.appRoot, '/client/dist')
     router.use(express.static(distPath))
 
-    // Metadata folder static path
-    router.use('/metadata', this.authMiddleware.bind(this), express.static(global.MetadataPath))
-
     // Static folder
     router.use(express.static(Path.join(global.appRoot, 'static')))
 
diff --git a/server/controllers/BackupController.js b/server/controllers/BackupController.js
index 7ee482a9..811af850 100644
--- a/server/controllers/BackupController.js
+++ b/server/controllers/BackupController.js
@@ -14,18 +14,14 @@ class BackupController {
   }
 
   async delete(req, res) {
-    var backup = this.backupManager.backups.find(b => b.id === req.params.id)
-    if (!backup) {
-      return res.sendStatus(404)
-    }
-    await this.backupManager.removeBackup(backup)
+    await this.backupManager.removeBackup(req.backup)
 
     res.json({
       backups: this.backupManager.backups.map(b => b.toJSON())
     })
   }
 
-  async upload(req, res) {
+  upload(req, res) {
     if (!req.files.file) {
       Logger.error('[BackupController] Upload backup invalid')
       return res.sendStatus(500)
@@ -33,12 +29,22 @@ class BackupController {
     this.backupManager.uploadBackup(req, res)
   }
 
-  async apply(req, res) {
-    var backup = this.backupManager.backups.find(b => b.id === req.params.id)
-    if (!backup) {
-      return res.sendStatus(404)
+  /**
+   * api/backups/:id/download
+   * 
+   * @param {*} req 
+   * @param {*} res 
+   */
+  download(req, res) {
+    if (global.XAccel) {
+      Logger.debug(`Use X-Accel to serve static file ${req.backup.fullPath}`)
+      return res.status(204).header({ 'X-Accel-Redirect': global.XAccel + req.backup.fullPath }).send()
     }
-    await this.backupManager.requestApplyBackup(backup)
+    res.sendFile(req.backup.fullPath)
+  }
+
+  async apply(req, res) {
+    await this.backupManager.requestApplyBackup(req.backup)
     res.sendStatus(200)
   }
 
@@ -47,6 +53,14 @@ class BackupController {
       Logger.error(`[BackupController] Non-admin user attempting to access backups`, req.user)
       return res.sendStatus(403)
     }
+
+    if (req.params.id) {
+      req.backup = this.backupManager.backups.find(b => b.id === req.params.id)
+      if (!req.backup) {
+        return res.sendStatus(404)
+      }
+    }
+
     next()
   }
 }
diff --git a/server/managers/BackupManager.js b/server/managers/BackupManager.js
index bb6a47a0..906a3063 100644
--- a/server/managers/BackupManager.js
+++ b/server/managers/BackupManager.js
@@ -31,7 +31,7 @@ class BackupManager {
   }
 
   async init() {
-    var backupsDirExists = await fs.pathExists(this.BackupPath)
+    const backupsDirExists = await fs.pathExists(this.BackupPath)
     if (!backupsDirExists) {
       await fs.ensureDir(this.BackupPath)
       await filePerms.setDefault(this.BackupPath)
diff --git a/server/routers/ApiRouter.js b/server/routers/ApiRouter.js
index d23f6400..9277f4c3 100644
--- a/server/routers/ApiRouter.js
+++ b/server/routers/ApiRouter.js
@@ -196,6 +196,7 @@ class ApiRouter {
     this.router.get('/backups', BackupController.middleware.bind(this), BackupController.getAll.bind(this))
     this.router.post('/backups', BackupController.middleware.bind(this), BackupController.create.bind(this))
     this.router.delete('/backups/:id', BackupController.middleware.bind(this), BackupController.delete.bind(this))
+    this.router.get('/backups/:id/download', BackupController.middleware.bind(this), BackupController.download.bind(this))
     this.router.get('/backups/:id/apply', BackupController.middleware.bind(this), BackupController.apply.bind(this))
     this.router.post('/backups/upload', BackupController.middleware.bind(this), BackupController.upload.bind(this))