From 0f9005f3e8e91516d78040694810e2342409deb3 Mon Sep 17 00:00:00 2001
From: Steve Cassidy <steve.cassidy@mq.edu.au>
Date: Sun, 24 Sep 2023 08:27:49 +1000
Subject: [PATCH] Hide restore behind developer mode

Signed-off-by: Steve Cassidy <steve.cassidy@mq.edu.au>
---
 src/api/routes.ts     | 26 +++++++++++++-------------
 src/routes.ts         | 16 +++++++++-------
 views/home.handlebars |  5 ++++-
 3 files changed, 26 insertions(+), 21 deletions(-)

diff --git a/src/api/routes.ts b/src/api/routes.ts
index 157e31ba..be2c0124 100644
--- a/src/api/routes.ts
+++ b/src/api/routes.ts
@@ -240,21 +240,21 @@ api.post('/users/:id/admin', requireAuthenticationAPI, async (req, res) => {
   }
 });
 
-api.post(
-  '/restore',
-  upload.single('backup'),
-  requireAuthenticationAPI,
-  async (req: any, res) => {
-    if (userIsClusterAdmin(req.user)) {
-      await restoreFromBackup(req.file.path);
-      res.json({status: 'success'});
-    } else {
-      res.status(401).end();
+if (DEVELOPER_MODE) {
+  api.post(
+    '/restore',
+    upload.single('backup'),
+    requireAuthenticationAPI,
+    async (req: any, res) => {
+      if (userIsClusterAdmin(req.user)) {
+        await restoreFromBackup(req.file.path);
+        res.json({status: 'success'});
+      } else {
+        res.status(401).end();
+      }
     }
-  }
-);
+  );
 
-if (DEVELOPER_MODE) {
   api.post(
     '/notebooks/:notebook_id/delete',
     requireAuthenticationAPI,
diff --git a/src/routes.ts b/src/routes.ts
index eacb6268..4b9fd1d7 100644
--- a/src/routes.ts
+++ b/src/routes.ts
@@ -211,6 +211,7 @@ app.get('/', async (req, res) => {
         cluster_admin: userIsClusterAdmin(req.user),
         provider: provider,
         public_key: signing_key.public_key,
+        developer: DEVELOPER_MODE,
       });
     }
   } else {
@@ -295,13 +296,14 @@ app.get('/users', requireClusterAdmin, async (req, res) => {
   }
 });
 
-app.get('/restore/', requireClusterAdmin, async (req, res) => {
-  if (req.user) {
-    res.render('restore');
-  } else {
-    res.status(401).end();
-  }
-});
+if (DEVELOPER_MODE)
+  app.get('/restore/', requireClusterAdmin, async (req, res) => {
+    if (req.user) {
+      res.render('restore');
+    } else {
+      res.status(401).end();
+    }
+  });
 
 app.get('/up/', (req, res) => {
   res.status(200).json({up: 'true'});
diff --git a/views/home.handlebars b/views/home.handlebars
index c37b5989..ad2c630f 100644
--- a/views/home.handlebars
+++ b/views/home.handlebars
@@ -73,9 +73,12 @@
         <div class="card-body">
           <a href="/users/">User Management</a>
         </div>
+        {{#if developer}}
          <div class="card-body">
           <a href="/restore/">Restore from backup</a>
-        </div>       
+        </div>   
+        {{/if}}
+
       </div>
       {{/if}}
     </div>