mirror of
https://github.com/wekan/wekan.git
synced 2026-11-07 11:02:33 -05:00
Lauri Ojansivu
46e30f01e4
Decided on 2026-10-14. On the import page each of the six asks for what its service needs - a self-hosted Planka its address, username and password; the others an access token (Basecamp also its account id) - lists what that account can import, and fetches the chosen board, list or project. The credentials go with each call and are used for that call's requests only; they are never stored or logged, and the page clears secret fields once a fetch has used them. The fetched JSON fills the import text box and the import goes on as for a pasted export: the service's parser (models/lib/<key>ApiFormat.js) into the generalized importer, with the members step and the loss report. The same JSON can be pasted, or posted to POST /api/boards/import/<key>. - server/apiImport.js: apiImportList and apiImportFetch, signed in only, off with the Admin Panel's import switch, not in Sandstorm, rate limited; credentials checked against the service's own fields (models/lib/apiImportServices.js). - server/lib/apiImportRequest.js: every request through the SSRF guard - pinned address, no redirects, bounded in time and size - so a Planka address cannot point the server at its own network; an administrator can allow such a host with API_IMPORT_ALLOWED_PRIVATE_HOSTS. An error names only the origin and the status. - models/lib/apiImport/<key>.js: each service's client, plain Node with the request injected, paging bounded and the token only in a header. - Each has a docs page under docs/Features/ImportExport/, listed in the coverage index and External-Tools.md. Tests: tests/<key>ApiImport.test.cjs (client with a fake request, every parsed field, wrong shapes), tests/apiImport.test.cjs (credentials, the gate, the wiring, the shapes refused), api-import.e2e.js (the form for every service, fetched JSON imported through the page, refusals incl. a private address). Live tests, read only, run from build.sh / build.bat -> Tests -> Live tests with your own accounts (releases/live-tests/README.md); they were not run here. New strings translated in all locales. Also: the release risk baseline allows the services' API addresses, and the guards that count import creators, list the import sources and pin the platform fetch() calls know the new ones. Thanks to xet7 !
52 lines
2.6 KiB
JavaScript
52 lines
2.6 KiB
JavaScript
// Google Keep through its REST API (models/lib/apiImportServices.js has the
|
|
// contract). The Keep API is for Google Workspace: the token is an OAuth 2
|
|
// access token with the scope https://www.googleapis.com/auth/keep.readonly,
|
|
// from an app the Workspace admin allows or a service account with
|
|
// domain-wide delegation. It is sent as a header, never in a URL.
|
|
//
|
|
// Keep has no notebooks, so there is one thing to import: all notes.
|
|
// GET https://keep.googleapis.com/v1/notes?pageSize=100[&pageToken=...]
|
|
// -> { notes: [note], nextPageToken }
|
|
// Without a filter the API leaves trashed notes out. Attachments are listed
|
|
// in each note but not downloaded; the parser reports them.
|
|
|
|
const API = 'https://keep.googleapis.com/v1';
|
|
export const ALL_NOTES = 'all';
|
|
export const MAX_GOOGLE_KEEP_PAGES = 200;
|
|
export const MAX_GOOGLE_KEEP_NOTES = 20000;
|
|
|
|
function headers(credentials) {
|
|
const token = credentials && typeof credentials.token === 'string' ? credentials.token : '';
|
|
if (!token) throw new Error('token is required');
|
|
return { Authorization: `Bearer ${token}`, Accept: 'application/json' };
|
|
}
|
|
|
|
export async function list(credentials) {
|
|
headers(credentials);
|
|
return [{ id: ALL_NOTES, name: 'Google Keep (all notes)' }];
|
|
}
|
|
|
|
export async function fetch(credentials, id, request) {
|
|
if (id !== ALL_NOTES) throw new Error('Unknown Google Keep source');
|
|
const auth = headers(credentials);
|
|
const notes = [];
|
|
const seen = new Set();
|
|
let pageToken = '';
|
|
for (let page = 0; ; page += 1) {
|
|
if (page >= MAX_GOOGLE_KEEP_PAGES) throw new Error(`Google Keep has more than ${MAX_GOOGLE_KEEP_PAGES} pages of notes`);
|
|
const url = `${API}/notes?pageSize=100${pageToken ? `&pageToken=${encodeURIComponent(pageToken)}` : ''}`;
|
|
const answer = await request(url, { method: 'GET', headers: auth });
|
|
if (!answer || typeof answer !== 'object' || Array.isArray(answer)) throw new Error('Google Keep answered with something that is not a list of notes');
|
|
if (answer.notes !== undefined && !Array.isArray(answer.notes)) throw new Error('Google Keep answered with something that is not a list of notes');
|
|
notes.push(...(answer.notes || []));
|
|
if (notes.length > MAX_GOOGLE_KEEP_NOTES) throw new Error(`Google Keep has more than ${MAX_GOOGLE_KEEP_NOTES} notes`);
|
|
const next = typeof answer.nextPageToken === 'string' ? answer.nextPageToken : '';
|
|
if (!next) break;
|
|
// A page token that comes back again would page forever.
|
|
if (seen.has(next)) throw new Error('Google Keep repeated a page token');
|
|
seen.add(next);
|
|
pageToken = next;
|
|
}
|
|
return { googlekeep: true, notes };
|
|
}
|