Release 6.2.0

Upgrade Windshaft to 4.8.3

.gitignore

@@ -8,6 +8,6 @@ tools/munin/windshaft.conf
 logs/
 pids/
 redis.pid
-test.log
-npm-debug.log
+*.log
 coverage/
+.DS_Store

.jshintignore

@@ -1,4 +1,3 @@
 test/results/
 test/monkey/
 test/benchmark.js
-test/support/

.jshintrc

@@ -40,7 +40,7 @@
     "debug"         : false,     // true: Allow debugger statements e.g. browser breakpoints.
 //    "eqnull"        : false,     // true: Tolerate use of `== null`
 //    "es5"           : false,     // true: Allow ES5 syntax (ex: getters and setters)
-//    "esnext"        : false,     // true: Allow ES.next (ES6) syntax (ex: `const`)
+    "esnext"        : true,     // true: Allow ES.next (ES6) syntax (ex: `const`)
 //    "moz"           : false,     // true: Allow Mozilla specific syntax (extends and overrides esnext features)
 //    // (ex: `for each`, multiple try/catch, function expression…)
 //    "evil"          : false,     // true: Tolerate use of `eval` and `new Function()`

.travis.yml

@@ -1,27 +1,81 @@
-dist: trusty
-addons:
-  postgresql: "9.5"
-  apt:
-    sources:
-      - ubuntu-toolchain-r-test
-    packages:
-      - postgresql-9.5-postgis-2.3
-      - postgresql-plpython-9.5
-      - pkg-config
-      - libcairo2-dev
-      - libjpeg8-dev
-      - libgif-dev
-      - libpango1.0-dev
-      - g++-4.9
+jobs:
+  include:
+    - sudo: required
+      services:
+        - docker
+      language: generic
+      before_install: docker pull carto/nodejs6-xenial-pg101
+      script: npm run docker-test
+    - dist: precise
+      addons:
+        postgresql: "9.5"
+        apt:
+          sources:
+            - ubuntu-toolchain-r-test
+          packages:
+            - pkg-config
+            - libcairo2-dev
+            - libjpeg8-dev
+            - libgif-dev
+            - libpango1.0-dev
+            - g++-4.9
+            - wget
 
-before_install:
-  - createdb template_postgis
-  - createuser publicuser
-  - psql -c "CREATE EXTENSION postgis" template_postgis
+      before_install:
+        # Add custom PPAs from cartodb
+        - sudo add-apt-repository -y ppa:cartodb/postgresql-9.5
+        - sudo add-apt-repository -y ppa:cartodb/gis
+        - sudo add-apt-repository -y ppa:cartodb/gis-testing
 
-env:
-  - NPROCS=1 JOBS=1 PGUSER=postgres CXX=g++-4.9
+        - sudo apt-get update
+      
+        # Force instalation of libgeos-3.5.0 (presumably needed because of existing version of postgis)
+        - sudo apt-get -y install libgeos-3.5.0=3.5.0-1cdb2
 
-language: node_js
-node_js:
-  - "6"
+        # Install postgres db and build deps
+        - sudo /etc/init.d/postgresql stop # stop travis default instance
+        - sudo apt-get -y remove --purge postgresql-9.1
+        - sudo apt-get -y remove --purge postgresql-9.2
+        - sudo apt-get -y remove --purge postgresql-9.3
+        - sudo apt-get -y remove --purge postgresql-9.4
+        - sudo apt-get -y remove --purge postgresql-9.5
+        - sudo apt-get -y remove --purge postgresql-9.6
+        - sudo rm -rf /var/lib/postgresql/
+        - sudo rm -rf /var/log/postgresql/
+        - sudo rm -rf /etc/postgresql/
+        - sudo apt-get -y remove --purge postgis-2.2
+        - sudo apt-get -y autoremove
+        - sudo apt-get -y install postgresql-9.5=9.5.2-3cdb3
+        - sudo apt-get -y install postgresql-server-dev-9.5=9.5.2-3cdb3
+        - sudo apt-get -y install postgresql-plpython-9.5=9.5.2-3cdb3
+        - sudo apt-get -y install postgresql-9.5-postgis-scripts=2.2.2.0-cdb2
+        - sudo apt-get -y install postgresql-9.5-postgis-2.2=2.2.2.0-cdb2
+
+        # configure it to accept local connections from postgres
+        - echo -e "# TYPE  DATABASE        USER            ADDRESS                 METHOD \nlocal   all             postgres                                trust\nlocal   all             all                                     trust\nhost    all             all             127.0.0.1/32            trust" \
+          | sudo tee /etc/postgresql/9.5/main/pg_hba.conf
+        - sudo /etc/init.d/postgresql restart 9.5
+
+        - createdb template_postgis
+        - createuser publicuser
+        - psql -c "CREATE EXTENSION postgis" template_postgis
+        
+        # install yarn 0.27.5
+        - curl -o- -L https://yarnpkg.com/install.sh | bash -s -- --version 0.27.5	
+        - export PATH="$HOME/.yarn/bin:$PATH"
+
+        # instal redis 4
+        - wget http://download.redis.io/releases/redis-4.0.8.tar.gz
+        - tar xvzf redis-4.0.8.tar.gz
+        - cd redis-4.0.8
+        - make
+        - sudo make install
+        - cd ..
+        - rm redis-4.0.8.tar.gz
+
+      env:
+        - NPROCS=1 JOBS=1 PGUSER=postgres CXX=g++-4.9
+
+      language: node_js
+      node_js:
+        - "6"

HOWTO_RELEASE

@@ -1,7 +1,7 @@
 1. Test (make clean all check), fix if broken before proceeding
 2. Ensure proper version in package.json
 3. Ensure NEWS section exists for the new version, review it, add release date
-4. Recreate yarn.lock with: `yarn upgrade`
+4. If there are modified dependencies in package.json, update them with `yarn upgrade {{package_name}}@{{version}}`
 5. Commit package.json, yarn.lock, NEWS
 6. git tag -a Major.Minor.Patch # use NEWS section as content
 7. Stub NEWS/package for next version

INSTALL.md

@@ -5,7 +5,7 @@ Make sure that you have the requirements needed. These are
 
 - Core
   - Node.js >=6.9.x
-  - yarn >=0.21.3
+  - yarn >=0.27.5 <1.0.0
   - PostgreSQL >8.3.x, PostGIS >1.5.x
   - Redis >2.4.0 (http://www.redis.io)
   - Mapnik >3.x. See [Installing Mapnik](https://github.com/CartoDB/Windshaft#installing-mapnik).

Makefile

@@ -16,7 +16,7 @@ config.status--test:
 	./configure --environment=test
 
 config/environments/test.js: config.status--test
-	./config.status--test 
+	./config.status--test
 
 TEST_SUITE := $(shell find test/{acceptance,integration,unit} -name "*.js")
 TEST_SUITE_UNIT := $(shell find test/unit -name "*.js")

NEWS.md

@@ -1,5 +1,525 @@
 # Changelog
 
+## 6.2.0
+Released 2018-07-20
+
+Notice:
+- This release changes the way that authentication works internally. You'll need to run `bundle exec rake carto:api_key:create_default` in your development environment to keep working.
+
+New features:
+- CI tests with Ubuntu Xenial + PostgreSQL 10.1 and Ubuntu Precise + PostgreSQL 9.5
+- Upgrades Windshaft to [4.8.3](https://github.com/CartoDB/Windshaft/blob/4.8.3/NEWS.md#version-483) which includes:
+  - Update internal deps.
+  - A fix in mapnik-vector-tile to avoid grouping together properties with the same value but a different type.
+  - Performance improvements in the marker symbolizer (local cache, avoid building the collision matrix when possible).
+  - MVT: Disable simplify_distance to avoid multiple simplifications.
+  - Fix a bug with zero length lines not being rendered when using the marker symbolizer.
+  - Reduce size of npm package
+  - Omit attributes validation in layers with aggregation to avoid potentially long instantiation times
+- Upgrades Camshaft to [0.61.11](https://github.com/CartoDB/camshaft/releases/tag/0.61.11):
+  - Use Dollar-Quoted String Constants to avoid Syntax Error while running moran analyses. [0.61.10](https://github.com/CartoDB/camshaft/releases/tag/0.61.10)
+  - Quote name columns when performing trade area analysis to avoid Syntax Errors. [0.61.11](https://github.com/CartoDB/camshaft/releases/tag/0.61.11)
+- Update other deps:
+  - body-parser: 1.18.3
+  - cartodb-psql: 0.11.0
+  - cartodb-redis: 2.0.1
+  - dot: 1.1.2
+  - express: 4.16.3
+  - lru-cache: 4.1.3
+  - node-statsd: 0.1.1,
+  - queue-async: 1.1.0
+  - request: 2.87.0
+  - semver: 5.5.0
+  - step: 1.0.0
+  - turbo-carto: 0.20.4
+  - yargs: 11.1.0
+- Update devel deps:
+  - istanbul: 0.4.5
+  - jshint: 2.9.5
+  - mocha: 3.5.3
+  - moment: 2.22.1
+  - nock: 9.2.6
+  - strftime: 0.10.0
+- Optional instantiation metadata stats (https://github.com/CartoDB/Windshaft-cartodb/pull/952)
+- Experimental dates_as_numbers support
+- Tiles base urls with api key
+
+Bug Fixes:
+- Validates tile coordinates (z/x/y) from request params to be a valid integer value.
+- Static maps fails for unsupported formats
+- Handling errors extracting the column type on dataviews
+- Fix `meta.stats.estimatedFeatureCount` for aggregations and queries with tokens
+- Fix numeric histogram bounds when `start` and `end` are specified (#991)
+- Static maps filters correctly if `layer` option is passed in the url.
+- Aggregation doesn't return out-of-tile, partially aggregated clusters
+- Aggregation was not accurate for high zoom, far away from the origin tiles
+
+Announcements:
+  * Improve error message when the DB query is over the user's limits
+
+## 6.1.0
+Released 2018-04-16
+
+New features:
+- Aggreation filters
+- Upgrades Windshaft to 4.7.0, which includes @carto/mapnik v3.6.2-carto.7 with improvements to metrics and markers caching. It also adds an option to disable the markers symbolizer caches in mapnik.
+
+Bug Fixes:
+- Non-default aggregation selected the wrong columns (e.g. for vector tiles)
+- Aggregation dimensions with alias where broken
+- cartodb_id was not unique accross aggregated vector tiles
+
+## 6.0.0
+Released 2018-03-19
+Backward incompatible changes:
+ - Needs Redis v4
+
+New features:
+ - Upgrades camshaft to 0.61.8
+ - Upgrades cartodb-redis to 1.0.0
+ - Rate limit feature (disabled by default)
+ - Fixes for tests with PG11
+
+## 5.4.0
+Released 2018-03-15
+ - Upgrades Windshaft to 4.5.7 ([Mapnik top metrics](https://github.com/CartoDB/Windshaft/pull/597), [AttributesBackend allows multiple features if all the attributes are the same](https://github.com/CartoDB/Windshaft/pull/602))
+ - Implemented middleware to authorize users via new Api Key system
+ - Keep the old authorization system as fallback
+ - Aggregation widget: Remove NULL categories in 'count' aggregations too
+ - Update request to 2.85.0
+ - Update camshaft to 0.61.4 (Fixes for AOI and Merge analyses)
+ - Update windshaft to 4.6.0, which in turn updates @carto/mapnik to 3.6.2-carto.4 and related dependencies. It brings in a cache for rasterized symbols. See https://github.com/CartoDB/node-mapnik/blob/v3.6.2-carto/CHANGELOG.carto.md#362-carto4
+ - PostGIS: Variables in postgis SQL queries must now additionally be wrapped in `!` (refs [#29](https://github.com/CartoDB/mapnik/issues/29), [mapnik/#3618](https://github.com/mapnik/mapnik/pull/3618)):
+```sql
+-- Before
+SELECT ... WHERE trait = @variable
+
+-- Now
+SELECT ... WHERE trait = !@variable!
+```
+
+## 5.3.1
+Released 2018-02-13
+ - Improve the speed of the aggregation dataview #865
+
+## 5.3.0
+Released 2018-02-12
+ - Upgrades redis-mpool to 0.5.0
+ - Upgrades windshaft to 4.5.2
+ - Upgrades cartodb-redis to 0.15.0
+ - Adds metrics option to the Mapnik renderer
+ - Upgrades camshadft to 0.61.2
+
+## 5.2.1
+Released 2018-02-01
+
+Bug Fixes:
+- Allow use of aggregation with attributes #861
+
+## 5.2.0
+Released 2018-02-01
+
+Announcements:
+ - Upgrade windshaft to [4.3.3](https://github.com/CartoDB/windshaft/releases/tag/4.3.2) adding support for cache-features' in Mapnik/CartoDB layers.
+
+## 5.1.0
+Released 2018-01-30
+New features:
+ - Now mapnik has support for fine-grained metrics.
+ - Variables can be passed for later substitution in postgis datasource.
+
+Announcements:
+ - Upgrade windshaft to [4.3.1](https://github.com/CartoDB/windshaft/releases/tag/4.3.1). Underneath it upgrades mapnik and all the related dependencies.
+
+## 5.0.1
+Released 2018-01-29
+
+Bug Fixes:
+- Allow aggregation for queries with no the_geom (only the_geom_webmercator) #856
+
+## 5.0.0
+Released 2018-01-29
+
+Backward incompatible changes:
+- Aggregation dataview returns categories with the same type as the database type. For example, if we are aggretating by a numeric field, the resulting JSON will contain a number instead of a stringified number.
+
+## 4.8.0
+Released 2018-01-04
+
+New features:
+ - Return url template in metadata #838.
+
+Bux fixes:
+ - Tests: Order torque objects before comparison
+
+## 4.7.0
+Released 2018-01-03
+
+New features:
+ - Return tilejson in metadata #837.
+
+Bug fixes:
+ - Allow to create vector map-config for layers that doesn't have points. Layers with lines or polygons won't be aggregated by default.
+
+
+## 4.6.0
+Released 2018-01-02
+
+Announcements:
+ - Upgrades windshaft to [4.2.0](https://github.com/CartoDB/windshaft/releases/tag/4.2.0).
+ - Validate aggregation input params.
+ - Fix column names collisions in histograms [#828](https://github.com/CartoDB/Windshaft-cartodb/pull/828).
+ - Add full-sample aggregation support for vector map-config.
+
+## 4.5.0
+Released 2017-12-19
+
+Announcements:
+ - Date histograms: Add second, decade, century and millenium aggregations
+ - Date histograms: Switch the auto threshold from 366 buckets to 100.
+ - Logging all errors.
+ - Add support for aggregated visualizations.
+ - Allow vector-only map-config creation.
+ - Histograms: Now they accept a `no_filters` parameter.
+
+
+## 4.4.0
+Released 2017-12-12
+
+Announcements:
+ - Upgrades camshaft to [0.60.0](https://github.com/CartoDB/camshaft/releases/tag/0.60.0).
+
+
+## 4.3.1
+Released 2017-12-12
+
+Bug fix:
+  - Fixed bug introduced in version 4.0.1 that brokes the static map generation using JPG as format #808
+
+## 4.3.0
+Released 2017-12-11
+
+Announcements:
+- Optimize Formula queries.
+- Optimize Formula queries in overviews.
+- Optimize Numeric Histogram queries.
+- Optimize Date Histogram queries.
+- Date Histograms: Now returns the same value for max/min/avg/timestamp per bin.
+- Date Histograms: Now it should return the same no matter the DB/Client time zone.
+
+## 4.2.0
+Released 2017-12-04
+
+Announcements:
+ - Allow to request MVT tiles without CartoCSS
+ - Upgrades windshaft to [4.1.0](https://github.com/CartoDB/windshaft/releases/tag/4.1.0).
+
+
+## 4.1.1
+Released 2017-11-29
+
+Announcements:
+ - Upgrades turbo-carto to [0.20.2](https://github.com/CartoDB/turbo-carto/releases/tag/0.20.2).
+
+
+## 4.1.0
+Released 2017-mm-dd
+
+Announcements:
+ - Upgrades windshaft to [4.0.1](https://github.com/CartoDB/windshaft/releases/tag/4.0.1).
+ - Add `categories` query param to define the number of categories to be ranked for aggregation dataviews.
+
+
+## 4.0.1
+Released 2017-10-18
+
+Announcements:
+ - Upgrades camshaft to [0.59.4](https://github.com/CartoDB/camshaft/releases/tag/0.59.4).
+ - Upgrades windshaft to [4.0.0](https://github.com/CartoDB/windshaft/releases/tag/4.0.0).
+ - Split and move `req2params` method to multiple middlewares.
+ - Use express error handler middleware to respond in case of something went wrong.
+ - Use `res.locals` object to share info between middlewares and leave `req.params` as an object containing properties mapped to the named route params.
+ - Move `LZMA` decompression to its own middleware.
+ - Implement stats middleware removing some duplicated code while sending response.
+
+
+## 4.0.0
+Released 2017-10-04
+
+Backward incompatible changes:
+ - Removes `list` dataview type.
+
+Announcements:
+ - Upgrades body-parser to 1.18.2.
+ - Upgrades express to 4.16.0.
+ - Upgrades debug to 3.1.0.
+ - Upgrades request to 2.83.0.
+ - Upgrades turbo-carto to [0.20.1](https://github.com/CartoDB/turbo-carto/releases/tag/0.20.1)
+ - Upgrades cartodb-psql to [0.10.2](https://github.com/CartoDB/node-cartodb-psql/releases/tag/0.10.2).
+ - Upgrades camshaft to [0.59.2](https://github.com/CartoDB/camshaft/releases/tag/0.59.2).
+ - Upgrades windshaft to [3.3.3](https://github.com/CartoDB/windshaft/releases/tag/3.3.3).
+ - Upgrades yarn minimum version requirement to v0.27.5
+
+
+## 3.13.0
+Released 2017-10-02
+ - Upgrades camshaft, cartodb-query-tables, and turbo-carto: better support for query variables.
+
+Bugfixes:
+ - Bounding box parameter ignored in static named maps #735.
+ - camhaft 0.59.1 fixes duplicate columns in aggregate-intersection analysis
+
+## 3.12.10
+Released 2017-09-18
+ - Upgrades windshaft to [3.3.2](https://github.com/CartoDB/windshaft/releases/tag/3.3.2).
+
+## 3.12.9
+Released 2017-09-07
+
+Bug fixes:
+- Do not use distinct when calculating quantiles. #743
+
+## 3.12.8
+Released 2017-09-07
+
+Bug fixes:
+- Integer out of range in date histograms. (https://github.com/CartoDB/support/issues/962)
+
+## 3.12.7
+Released 2017-09-01
+
+ - Upgrades camshaft to [0.58.1](https://github.com/CartoDB/camshaft/releases/tag/0.58.1).
+
+
+## 3.12.6
+Released 2017-08-31
+
+ - Upgrades camshaft to [0.58.0](https://github.com/CartoDB/camshaft/releases/tag/0.58.0).
+
+
+## 3.12.5
+Released 2017-08-24
+
+ - Upgrades camshaft to [0.57.0](https://github.com/CartoDB/camshaft/releases/tag/0.57.0).
+
+
+## 3.12.4
+Released 2017-08-23
+
+Announcements:
+ - Upgrades camshaft to [0.56.0](https://github.com/CartoDB/camshaft/releases/tag/0.56.0).
+
+## 3.12.3
+Released 2017-08-22
+
+Announcements:
+ - Upgrades camshaft to [0.55.8](https://github.com/CartoDB/camshaft/releases/tag/0.55.8).
+
+## 3.12.2
+Released 2017-08-16
+
+Bug fixes:
+ - Polygon count problems #725.
+
+
+## 3.12.1
+Released 2017-08-13
+ - Upgrades cartodb-psql to [0.10.1](https://github.com/CartoDB/node-cartodb-psql/releases/tag/0.10.1).
+ - Upgrades windshaft to [3.3.1](https://github.com/CartoDB/windshaft/releases/tag/3.3.1).
+ - Upgrades camshaft to [0.55.7](https://github.com/CartoDB/camshaft/releases/tag/0.55.7).
+
+
+## 3.12.0
+Released 2017-08-10
+
+Announcements:
+ - Apply max tile response time for requests to layergoup, tiles, static maps, attributes and dataviews services #717.
+ - Upgrades windshaft to [3.3.0](https://github.com/CartoDB/windshaft/releases/tag/3.3.0).
+ - Upgrades cartodb-redis to [0.14.0](https://github.com/CartoDB/node-cartodb-redis/releases/tag/0.14.0).
+
+
+## 3.11.0
+Released 2017-08-08
+
+Announcements:
+ - Allow to override with any aggregation for histograms instantiated w/o aggregation.
+
+Bug fixes:
+ - Apply timezone after truncating the minimun date for each bin to calculate timestamps in time-series.
+ - Support timestamp with timezones to calculate the number of bins in time-series.
+ - Fixed issue related to name collision while building time-series query.
+
+
+## 3.10.1
+Released 2017-08-04
+
+Bug fixes:
+ - Exclude Infinities & NaNs from ramps #719.
+ - Fixed issue in time-series when aggregation starts at 1970-01-01 (epoch) #720.
+
+
+## 3.10.0
+Released 2017-08-03
+
+Announcements:
+ - Improve time-series dataview, now supports date aggregations (e.g: daily, weekly, monthly, etc.) and timezones (UTC by default) #698.
+ - Support special numeric values (±Infinity, NaN) for json responses #706
+
+
+## 3.9.8
+Released 2017-07-21
+
+ - Upgrades windshaft to [3.2.2](https://github.com/CartoDB/windshaft/releases/tag/3.2.2).
+
+
+## 3.9.7
+Released 2017-07-20
+
+Bug fixes:
+ - Respond with 204 (No content) when vector tile has no data #712
+
+Announcements:
+ - Upgrades turbo-carto to [0.19.2](https://github.com/CartoDB/turbo-carto/releases/tag/0.19.2)
+
+
+## 3.9.6
+Released 2017-07-11
+
+ - Dataviews: support for aggregation in search results #708
+
+
+## 3.9.5
+Released 2017-06-27
+
+ - Dataviews: support special numeric values (±Infinity, NaN) #700
+
+
+## 3.9.4
+Released 2017-06-22
+
+Announcements:
+ - Upgrades camshaft to [0.55.6](https://github.com/CartoDB/camshaft/releases/tag/0.55.6).
+
+## 3.9.3
+Released 2017-06-16
+
+Announcements:
+ - Upgrades camshaft to [0.55.5](https://github.com/CartoDB/camshaft/releases/tag/0.55.5).
+
+## 3.9.2
+Released 2017-06-16
+
+Announcements:
+ - Upgrades camshaft to [0.55.4](https://github.com/CartoDB/camshaft/releases/tag/0.55.4).
+
+## 3.9.1
+Released 2017-06-06
+
+Announcements:
+ - Upgrades camshaft to [0.55.3](https://github.com/CartoDB/camshaft/releases/tag/0.55.3).
+
+
+## 3.9.0
+Released 2017-05-31
+
+Announcements:
+ - Upgrades windshaft to [3.2.1](https://github.com/CartoDB/windshaft/releases/tag/3.2.1).
+ - Add support to retrieve info about layer stats in map instantiation.
+ - Upgrades camshaft to [0.55.2](https://github.com/CartoDB/camshaft/releases/tag/0.55.2).
+ - Remove promise polyfill from turbo-carto adapter
+
+
+## 3.8.0
+Released 2017-05-22
+
+Announcements:
+ - Upgrades camshaft to [0.55.0](https://github.com/CartoDB/camshaft/releases/tag/0.55.0).
+ - Upgrades turbo-carto to [0.19.1](https://github.com/CartoDB/turbo-carto/releases/tag/0.19.1)
+
+
+## 3.7.1
+Released 2017-05-18
+
+Bug fixes:
+ - Fix buffersize assignment when is not defined in requested mapconfig.
+
+
+## 3.7.0
+Released 2017-05-18
+
+Announcements:
+- Manage multiple values of buffer-size for different formats
+- Upgrades windshaft to [3.2.0](https://github.com/CartoDB/windshaft/releases/tag/3.2.0).
+
+
+## 3.6.6
+Released 2017-05-11
+
+Announcements:
+ - Upgrades camshaft to [0.54.4](https://github.com/CartoDB/camshaft/releases/tag/0.54.4).
+
+
+## 3.6.5
+Released 2017-05-09
+
+Announcements:
+ - Upgrades camshaft to [0.54.3](https://github.com/CartoDB/camshaft/releases/tag/0.54.3).
+
+
+## 3.6.4
+Released 2017-05-05
+
+Announcements:
+ - Upgrade cartodb-psql to [0.8.0](https://github.com/CartoDB/node-cartodb-psql/releases/tag/0.8.0).
+ - Upgrades camshaft to [0.54.2](https://github.com/CartoDB/camshaft/releases/tag/0.54.2).
+ - Upgrades windshaft to [3.1.2](https://github.com/CartoDB/windshaft/releases/tag/3.1.2).
+
+
+## 3.6.3
+Released 2017-04-25
+
+Announcements:
+ - Upgrades windshaft to [3.1.1](https://github.com/CartoDB/windshaft/releases/tag/3.1.1).
+
+
+## 3.6.2
+Released 2017-04-24
+
+Announcements:
+ - Upgrades grainstore to [1.6.3](https://github.com/CartoDB/grainstore/releases/tag/1.6.3).
+
+
+## 3.6.1
+Released 2017-04-24
+
+Announcements:
+ - Upgrades camshaft to [0.54.1](https://github.com/CartoDB/camshaft/releases/tag/0.54.1).
+
+
+## 3.6.0
+Released 2017-04-20
+
+Announcements:
+ - Upgrades camshaft to [0.54.0](https://github.com/CartoDB/camshaft/releases/tag/0.54.0).
+
+
+## 3.5.1
+Released 2017-04-11
+
+Announcements:
+ - Upgrades camshaft to [0.53.1](https://github.com/CartoDB/camshaft/releases/tag/0.53.1).
+
+
+## 3.5.0
+Released 2017-04-10
+
+Bug fixes:
+ - Fix invalidation of cache for maps with analyses #638.
+
+Announcements:
+ - Upgrades camshaft to [0.53.0](https://github.com/CartoDB/camshaft/releases/tag/0.53.0).
+
+
 ## 3.4.0
 Released 2017-04-03
 

app.js

@@ -2,14 +2,24 @@ var http = require('http');
 var https = require('https');
 var path = require('path');
 var fs = require('fs');
-
 var _ = require('underscore');
+var semver = require('semver');
+const setICUEnvVariable = require('./lib/cartodb/utils/icu_data_env_setter');
 
 // jshint undef:false
 var log = console.log.bind(console);
 var logError = console.error.bind(console);
 // jshint undef:true
 
+var nodejsVersion = process.versions.node;
+if (!semver.satisfies(nodejsVersion, '>=6.9.0')) {
+    logError(`Node version ${nodejsVersion} is not supported, please use Node.js 6.9 or higher.`);
+    process.exit(1);
+}
+
+// This function should be called before the require('yargs').
+setICUEnvVariable();
+
 var argv = require('yargs')
     .usage('Usage: $0 <environment> [options]')
     .help('h')
@@ -90,8 +100,6 @@ if ( global.environment.log_filename ) {
 global.log4js.configure(log4jsConfig);
 global.logger = global.log4js.getLogger();
 
-global.environment.api_hostname = require('os').hostname().split('.')[0];
-
 // Include cartodb_windshaft only _after_ the "global" variable is set
 // See https://github.com/Vizzuality/Windshaft-cartodb/issues/28
 var cartodbWindshaft = require('./lib/cartodb/server');

config/environments/development.js.example

@@ -6,32 +6,68 @@ var config = {
     // Its default size is 4, but it can be changed at startup time (the absolute maximum is 128).
     // See http://docs.libuv.org/en/latest/threadpool.html
     ,uv_threadpool_size: undefined
+    // Time in milliseconds to force GC cycle.
+    // Disable by using <=0 value.
+    ,gc_interval: 10000
     // Regular expression pattern to extract username
     // from hostname. Must have a single grabbing block.
     ,user_from_host: '^(.*)\\.localhost'
 
     // Base URLs for the APIs
     //
-    // See http://github.com/CartoDB/Windshaft-cartodb/wiki/Unified-Map-API
-    //
-    // Base url for the Templated Maps API
-    // "/api/v1/map/named" is the new API,
-    // "/tiles/template" is for compatibility with versions up to 1.6.x
-    ,base_url_templated: '(?:/api/v1/map/named|/user/:user/api/v1/map/named|/tiles/template)'
-    // Base url for the Detached Maps API
-    // "maps" is the the new API,
-    // "tiles/layergroup" is for compatibility with versions up to 1.6.x
-    ,base_url_detached: '(?:/api/v1/map|/user/:user/api/v1/map|/tiles/layergroup)'
+    // See https://github.com/CartoDB/Windshaft-cartodb/wiki/Unified-Map-API
+    ,routes: {
+        v1: {
+            paths: [
+                '/api/v1',
+                '/user/:user/api/v1',
+            ],
+            // Base url for the Detached Maps API
+            // "/api/v1/map" is the new API,
+            map: {
+                paths: [
+                    '/map',
+                ]
+            },
+            // Base url for the Templated Maps API
+            // "/api/v1/map/named" is the new API,
+            template: {
+                paths: [
+                    '/map/named'
+                ]
+            }
+        },
+        // For compatibility with versions up to 1.6.x
+        v0: {
+            paths: [
+                '/tiles'
+            ],
+            // Base url for the Detached Maps API
+            // "/tiles/layergroup" is for compatibility with versions up to 1.6.x
+            map: {
+                paths: [
+                    '/layergroup'
+                ]
+            },
+            // Base url for the Templated Maps API
+            // "/tiles/template" is for compatibility with versions up to 1.6.x
+            template: {
+                paths: [
+                    '/template'
+                ]
+            }
+        }
+    }
 
     // Resource URLs expose endpoints to request/retrieve metadata associated to Maps: dataviews, analysis node status.
     //
-    // This URLs depend on how `base_url_detached` and `user_from_host` are configured: the application can be
+    // This URLs depend on how `routes` and `user_from_host` are configured: the application can be
     // configured to accept request with the {user} in the header host or in the request path.
     // It also might depend on the configured cdn_url via `serverMetadata.cdn_url`.
     //
     // This template allows to make the endpoints generation more flexible, the template exposes the following params:
     //  1. {{=it.cdn_url}}: will be used when `serverMetadata.cdn_url` exists.
-    //  2. {{=it.user}}: will use the username as extraced from `user_from_host` or `base_url_detached`.
+    //  2. {{=it.user}}: will use the username as extraced from `user_from_host` or `routes`.
     //  3. {{=it.port}}: will use the `port` from this very same configuration file.
     ,resources_url_templates: {
         http: 'http://{{=it.user}}.localhost.lan:{{=it.port}}/api/v1/map',
@@ -51,12 +87,12 @@ var config = {
     // idle socket timeout, in milliseconds
     ,socket_timeout: 600000
     ,enable_cors: true
-    ,cache_enabled: false
-    ,log_format: ':req[X-Real-IP] :method :req[Host]:url :status :response-time ms -> :res[Content-Type] (:res[X-Tiler-Profiler])'
+    ,cache_enabled: true
+    ,log_format: ':req[X-Real-IP] :method :req[Host]:url :status :response-time ms -> :res[Content-Type] (:res[X-Tiler-Profiler]) (:res[X-Tiler-Errors])'
     // If log_filename is given logs will be written
     // there, in append mode. Otherwise stdout is used (default).
     // Log file will be re-opened on receiving the HUP signal
-    ,log_filename: undefined
+    ,log_filename: 'logs/node-windshaft.log'
     // Templated database username for authorized user
     // Supported labels: 'user_id' (read from redis)
     ,postgres_auth_user: 'development_cartodb_user_<%= user_id %>'
@@ -64,39 +100,25 @@ var config = {
     // Supported labels: 'user_id', 'user_password' (both read from redis)
     ,postgres_auth_pass: '<%= user_password %>'
     ,postgres: {
-        // Parameters to pass to datasource plugin of mapnik
-        // See http://github.com/mapnik/mapnik/wiki/PostGIS
-        type: "postgis",
         user: "publicuser",
         password: "public",
         host: '127.0.0.1',
         port: 5432,
-        extent: "-20037508.3,-20037508.3,20037508.3,20037508.3",
-        /* experimental
-        geometry_field: "the_geom",
-        extent: "-180,-90,180,90",
-        srid: 4326,
-        */
-        // max number of rows to return when querying data, 0 means no limit
-        row_limit: 65535,
-        simplify_geometries: true,
-        use_overviews: true, // use overviews to retrieve raster
-        /*
-         * Set persist_connection to false if you want
-         * database connections to be closed on renderer
-         * expiration (1 minute after last use).
-         * Setting to true (the default) would never
-         * close any connection for the server's lifetime
-         */
-        persist_connection: false,
-        max_size: 500
+        pool: {
+            // maximum number of resources to create at any given time
+            size: 16,
+            // max milliseconds a resource can go unused before it should be destroyed
+            idleTimeout: 3000,
+            // frequency to check for idle resources
+            reapInterval: 1000
+        }
     }
     ,mapnik_version: undefined
     ,mapnik_tile_format: 'png8:m=h'
     ,statsd: {
         host: 'localhost',
         port: 8125,
-        prefix: 'dev.',
+        prefix: 'dev.', // could be hostname, better not containing dots
         cacheDns: true
         // support all allowed node-statsd options
     }
@@ -104,6 +126,12 @@ var config = {
       // Milliseconds since last access before renderer cache item expires
       cache_ttl: 60000,
       statsInterval: 5000, // milliseconds between each report to statsd about number of renderers and mapnik pool status
+      mvt: {
+        //If enabled, MVTs will be generated with PostGIS directly, instead of using Mapnik,
+        //PostGIS 2.4 is required for this to work
+        //If disabled it will use Mapnik MVT generation
+        usePostGIS: false
+      },
       mapnik: {
           // The size of the pool of internal mapnik backend
           // This pool size is per mapnik renderer created in Windshaft's RendererFactory
@@ -156,6 +184,30 @@ var config = {
           // It will only work if snapToGrid is enabled
           clipByBox2d: false, // this requires postgis >=2.2 and geos >=3.5
 
+          postgis: {
+              // Parameters to pass to datasource plugin of mapnik
+              // See http://github.com/mapnik/mapnik/wiki/PostGIS
+              user: "publicuser",
+              password: "public",
+              host: '127.0.0.1',
+              port: 5432,
+              extent: "-20037508.3,-20037508.3,20037508.3,20037508.3",
+              // max number of rows to return when querying data, 0 means no limit
+              row_limit: 65535,
+              /*
+               * Set persist_connection to false if you want
+               * database connections to be closed on renderer
+               * expiration (1 minute after last use).
+               * Setting to true (the default) would never
+               * close any connection for the server's lifetime
+               */
+               persist_connection: false,
+               simplify_geometries: true,
+               use_overviews: true, // use overviews to retrieve raster
+               max_size: 500,
+               twkb_encoding: true
+          },
+
           limits: {
               // Time in milliseconds a render request can take before it fails, some notes:
               //  - 0 means no render limit
@@ -169,26 +221,17 @@ var config = {
               cacheOnTimeout: true
           },
 
-          geojson: {
-                dbPoolParams: {
-                      // maximum number of resources to create at any given time
-                      size: 16,
-                      // max milliseconds a resource can go unused before it should be destroyed
-                      idleTimeout: 3000,
-                      // frequency to check for idle resources
-                      reapInterval: 1000
-                },
+          // If enabled Mapnik will reuse the features retrieved from the database
+          // instead of requesting them once per style inside a layer
+          'cache-features': true,
 
-              // SQL queries will be wrapped with ST_ClipByBox2D
-              // Returning the portion of a geometry falling within a rectangle
-              // It will only work if snapToGrid is enabled
-              clipByBox2d: false, // this requires postgis >=2.2 and geos >=3.5
-              // geometries will be simplified using ST_RemoveRepeatedPoints
-              // which cost is no more expensive than snapping and results are
-              // much closer to the original geometry
-              removeRepeatedPoints: false // this requires postgis >=2.2
+          // Require metrics to the renderer
+          metrics: false,
+
+          // Options for markers attributes, ellipses and images caches
+          markers_symbolizer_caches: {
+              disabled: false
           }
-
       },
       http: {
           timeout: 2000, // the timeout in ms for a http tile request
@@ -204,16 +247,7 @@ var config = {
               src: __dirname + '/../../assets/default-placeholder.png'
           }
       },
-      torque: {
-          dbPoolParams: {
-              // maximum number of resources to create at any given time
-              size: 16,
-              // max milliseconds a resource can go unused before it should be destroyed
-              idleTimeout: 3000,
-              // frequency to check for idle resources
-              reapInterval: 1000
-          }
-      }
+      torque: {}
     }
     // anything analyses related
     ,analysis: {
@@ -234,7 +268,7 @@ var config = {
             // If filename is given logs comming from analysis client  will be written
             // there, in append mode. Otherwise 'log_filename' is used. Otherwise stdout is used (default).
             // Log file will be re-opened on receiving the HUP signal
-            filename: '/tmp/analysis.log'
+            filename: 'logs/node-windshaft-analysis.log'
         },
         // Define max execution time in ms for analyses or tags
         // If analysis or tag are not found in redis this values will be used as default.
@@ -304,6 +338,12 @@ var config = {
     // X-Tiler-Profile header containing elapsed timing for various
     // steps taken for producing the response.
     ,useProfiler:true
+    ,serverMetadata: {
+      cdn_url: {
+        http: undefined,
+        https: undefined
+      }
+    }
     // Settings for the health check available at /health
     ,health: {
       enabled: false,
@@ -321,8 +361,28 @@ var config = {
         // whether the affected tables for a given SQL must query directly postgresql or use the SQL API
         cdbQueryTablesFromPostgres: true,
         // whether in mapconfig is available stats & metadata for each layer
-        layerMetadata: true
-
+        layerStats: true,
+        // whether it should rate limit endpoints (global configuration)
+        rateLimitsEnabled: false,
+        // whether it should rate limit one or more endpoints (only if rateLimitsEnabled = true)
+        rateLimitsByEndpoint: {
+            anonymous: false,
+            static: false,
+            static_named: false,
+            dataview: false,
+            dataview_search: false,
+            analysis: false,
+            analysis_catalog: false,
+            tile: false,
+            attributes: false,
+            named_list: false,
+            named_create: false,
+            named_get: false,
+            named: false,
+            named_update: false,
+            named_delete: false,
+            named_tiles: false
+        }
     }
 };
 

config/environments/production.js.example

@@ -6,32 +6,68 @@ var config = {
     // Its default size is 4, but it can be changed at startup time (the absolute maximum is 128).
     // See http://docs.libuv.org/en/latest/threadpool.html
     ,uv_threadpool_size: undefined
+    // Time in milliseconds to force GC cycle.
+    // Disable by using <=0 value.
+    ,gc_interval: 10000
     // Regular expression pattern to extract username
     // from hostname. Must have a single grabbing block.
     ,user_from_host: '^(.*)\\.cartodb\\.com$'
 
     // Base URLs for the APIs
     //
-    // See http://github.com/CartoDB/Windshaft-cartodb/wiki/Unified-Map-API
-    //
-    // Base url for the Templated Maps API
-    // "/api/v1/map/named" is the new API,
-    // "/tiles/template" is for compatibility with versions up to 1.6.x
-    ,base_url_templated: '(?:/api/v1/map/named|/user/:user/api/v1/map/named|/tiles/template)'
-    // Base url for the Detached Maps API
-    // "maps" is the the new API,
-    // "tiles/layergroup" is for compatibility with versions up to 1.6.x
-    ,base_url_detached: '(?:/api/v1/map|/user/:user/api/v1/map|/tiles/layergroup)'
+    // See https://github.com/CartoDB/Windshaft-cartodb/wiki/Unified-Map-API
+    ,routes: {
+        v1: {
+            paths: [
+                '/api/v1',
+                '/user/:user/api/v1',
+            ],
+            // Base url for the Detached Maps API
+            // "/api/v1/map" is the new API,
+            map: {
+                paths: [
+                    '/map',
+                ]
+            },
+            // Base url for the Templated Maps API
+            // "/api/v1/map/named" is the new API,
+            template: {
+                paths: [
+                    '/map/named'
+                ]
+            }
+        },
+        // For compatibility with versions up to 1.6.x
+        v0: {
+            paths: [
+                '/tiles'
+            ],
+            // Base url for the Detached Maps API
+            // "/tiles/layergroup" is for compatibility with versions up to 1.6.x
+            map: {
+                paths: [
+                    '/layergroup'
+                ]
+            },
+            // Base url for the Templated Maps API
+            // "/tiles/template" is for compatibility with versions up to 1.6.x
+            template: {
+                paths: [
+                    '/template'
+                ]
+            }
+        }
+    }
 
     // Resource URLs expose endpoints to request/retrieve metadata associated to Maps: dataviews, analysis node status.
     //
-    // This URLs depend on how `base_url_detached` and `user_from_host` are configured: the application can be
+    // This URLs depend on how `routes` and `user_from_host` are configured: the application can be
     // configured to accept request with the {user} in the header host or in the request path.
     // It also might depend on the configured cdn_url via `serverMetadata.cdn_url`.
     //
     // This template allows to make the endpoints generation more flexible, the template exposes the following params:
     //  1. {{=it.cdn_url}}: will be used when `serverMetadata.cdn_url` exists.
-    //  2. {{=it.user}}: will use the username as extraced from `user_from_host` or `base_url_detached`.
+    //  2. {{=it.user}}: will use the username as extraced from `user_from_host` or `routes`.
     //  3. {{=it.port}}: will use the `port` from this very same configuration file.
     ,resources_url_templates: {
         http: 'http://{{=it.cdn_url}}/{{=it.user}}/api/v1/map',
@@ -52,7 +88,7 @@ var config = {
     ,socket_timeout: 600000
     ,enable_cors: true
     ,cache_enabled: true
-    ,log_format: ':req[X-Real-IP] :method :req[Host]:url :status :response-time ms -> :res[Content-Type] (:res[X-Tiler-Profiler])'
+    ,log_format: ':req[X-Real-IP] :method :req[Host]:url :status :response-time ms -> :res[Content-Type] (:res[X-Tiler-Profiler]) (:res[X-Tiler-Errors])'
     // If log_filename is given logs will be written
     // there, in append mode. Otherwise stdout is used (default).
     // Log file will be re-opened on receiving the HUP signal
@@ -64,26 +100,18 @@ var config = {
     // Supported labels: 'user_id', 'user_password' (both read from redis)
     ,postgres_auth_pass: '<%= user_password %>'
     ,postgres: {
-        // Parameters to pass to datasource plugin of mapnik
-        // See http://github.com/mapnik/mapnik/wiki/PostGIS
         user: "publicuser",
         password: "public",
         host: '127.0.0.1',
-        port: 6432,
-        extent: "-20037508.3,-20037508.3,20037508.3,20037508.3",
-        // max number of rows to return when querying data, 0 means no limit
-        row_limit: 65535,
-        /*
-         * Set persist_connection to false if you want
-         * database connections to be closed on renderer
-         * expiration (1 minute after last use).
-         * Setting to true (the default) would never
-         * close any connection for the server's lifetime
-         */
-        persist_connection: false,
-        simplify_geometries: true,
-        use_overviews: true, // use overviews to retrieve raster
-        max_size: 500
+        port: 5432,
+        pool: {
+            // maximum number of resources to create at any given time
+            size: 16,
+            // max milliseconds a resource can go unused before it should be destroyed
+            idleTimeout: 3000,
+            // frequency to check for idle resources
+            reapInterval: 1000
+        }
     }
     ,mapnik_version: undefined
     ,mapnik_tile_format: 'png8:m=h'
@@ -98,6 +126,12 @@ var config = {
       // Milliseconds since last access before renderer cache item expires
       cache_ttl: 60000,
       statsInterval: 5000, // milliseconds between each report to statsd about number of renderers and mapnik pool status
+      mvt: {
+        //If enabled, MVTs will be generated with PostGIS directly, instead of using Mapnik,
+        //PostGIS 2.4 is required for this to work
+        //If disabled it will use Mapnik MVT generation
+        usePostGIS: false
+      },
       mapnik: {
           // The size of the pool of internal mapnik backend
           // This pool size is per mapnik renderer created in Windshaft's RendererFactory
@@ -150,6 +184,30 @@ var config = {
           // It will only work if snapToGrid is enabled
           clipByBox2d: false, // this requires postgis >=2.2 and geos >=3.5
 
+          postgis: {
+              // Parameters to pass to datasource plugin of mapnik
+              // See http://github.com/mapnik/mapnik/wiki/PostGIS
+              user: "publicuser",
+              password: "public",
+              host: '127.0.0.1',
+              port: 5432,
+              extent: "-20037508.3,-20037508.3,20037508.3,20037508.3",
+              // max number of rows to return when querying data, 0 means no limit
+              row_limit: 65535,
+              /*
+               * Set persist_connection to false if you want
+               * database connections to be closed on renderer
+               * expiration (1 minute after last use).
+               * Setting to true (the default) would never
+               * close any connection for the server's lifetime
+               */
+               persist_connection: false,
+               simplify_geometries: true,
+               use_overviews: true, // use overviews to retrieve raster
+               max_size: 500,
+               twkb_encoding: true
+          },
+
           limits: {
               // Time in milliseconds a render request can take before it fails, some notes:
               //  - 0 means no render limit
@@ -163,26 +221,17 @@ var config = {
               cacheOnTimeout: true
           },
 
-          geojson: {
-                dbPoolParams: {
-                      // maximum number of resources to create at any given time
-                      size: 16,
-                      // max milliseconds a resource can go unused before it should be destroyed
-                      idleTimeout: 3000,
-                      // frequency to check for idle resources
-                      reapInterval: 1000
-                },
+          // If enabled Mapnik will reuse the features retrieved from the database
+          // instead of requesting them once per style inside a layer
+          'cache-features': true,
 
-              // SQL queries will be wrapped with ST_ClipByBox2D
-              // Returning the portion of a geometry falling within a rectangle
-              // It will only work if snapToGrid is enabled
-              clipByBox2d: false, // this requires postgis >=2.2 and geos >=3.5
-              // geometries will be simplified using ST_RemoveRepeatedPoints
-              // which cost is no more expensive than snapping and results are
-              // much closer to the original geometry
-              removeRepeatedPoints: false // this requires postgis >=2.2
+          // Require metrics to the renderer
+          metrics: false,
+
+          // Options for markers attributes, ellipses and images caches
+          markers_symbolizer_caches: {
+              disabled: false
           }
-
       },
       http: {
           timeout: 2000, // the timeout in ms for a http tile request
@@ -198,16 +247,7 @@ var config = {
               src: __dirname + '/../../assets/default-placeholder.png'
           }
       },
-      torque: {
-          dbPoolParams: {
-              // maximum number of resources to create at any given time
-              size: 16,
-              // max milliseconds a resource can go unused before it should be destroyed
-              idleTimeout: 3000,
-              // frequency to check for idle resources
-              reapInterval: 1000
-          }
-      }
+      torque: {}
     }
     // anything analyses related
     ,analysis: {
@@ -228,7 +268,7 @@ var config = {
             // If filename is given logs comming from analysis client  will be written
             // there, in append mode. Otherwise 'log_filename' is used. Otherwise stdout is used (default).
             // Log file will be re-opened on receiving the HUP signal
-            filename: 'logs/analysis.log'
+            filename: 'logs/node-windshaft-analysis.log'
         },
         // Define max execution time in ms for analyses or tags
         // If analysis or tag are not found in redis this values will be used as default.
@@ -321,7 +361,28 @@ var config = {
         // whether the affected tables for a given SQL must query directly postgresql or use the SQL API
         cdbQueryTablesFromPostgres: true,
         // whether in mapconfig is available stats & metadata for each layer
-        layerMetadata: false
+        layerStats: false,
+        // whether it should rate limit endpoints (global configuration)
+        rateLimitsEnabled: false,
+        // whether it should rate limit one or more endpoints (only if rateLimitsEnabled = true)
+        rateLimitsByEndpoint: {
+            anonymous: false,
+            static: false,
+            static_named: false,
+            dataview: false,
+            dataview_search: false,
+            analysis: false,
+            analysis_catalog: false,
+            tile: false,
+            attributes: false,
+            named_list: false,
+            named_create: false,
+            named_get: false,
+            named: false,
+            named_update: false,
+            named_delete: false,
+            named_tiles: false
+        }
     }
 };
 

config/environments/staging.js.example

@@ -6,35 +6,71 @@ var config = {
     // Its default size is 4, but it can be changed at startup time (the absolute maximum is 128).
     // See http://docs.libuv.org/en/latest/threadpool.html
     ,uv_threadpool_size: undefined
+    // Time in milliseconds to force GC cycle.
+    // Disable by using <=0 value.
+    ,gc_interval: 10000
     // Regular expression pattern to extract username
     // from hostname. Must have a single grabbing block.
     ,user_from_host: '^(.*)\\.cartodb\\.com$'
 
     // Base URLs for the APIs
     //
-    // See http://github.com/CartoDB/Windshaft-cartodb/wiki/Unified-Map-API
-    //
-    // Base url for the Templated Maps API
-    // "/api/v1/maps/named" is the new API,
-    // "/tiles/template" is for compatibility with versions up to 1.6.x
-    ,base_url_templated: '(?:/api/v1/map/named|/user/:user/api/v1/map/named|/tiles/template)'
-    // Base url for the Detached Maps API
-    // "/api/v1/maps" is the the new API,
-    // "/tiles/layergroup" is for compatibility with versions up to 1.6.x
-    ,base_url_detached: '(?:/api/v1/map|/user/:user/api/v1/map|/tiles/layergroup)'
+    // See https://github.com/CartoDB/Windshaft-cartodb/wiki/Unified-Map-API
+    ,routes: {
+        v1: {
+            paths: [
+                '/api/v1',
+                '/user/:user/api/v1',
+            ],
+            // Base url for the Detached Maps API
+            // "/api/v1/map" is the new API,
+            map: {
+                paths: [
+                    '/map',
+                ]
+            },
+            // Base url for the Templated Maps API
+            // "/api/v1/map/named" is the new API,
+            template: {
+                paths: [
+                    '/map/named'
+                ]
+            }
+        },
+        // For compatibility with versions up to 1.6.x
+        v0: {
+            paths: [
+                '/tiles'
+            ],
+            // Base url for the Detached Maps API
+            // "/tiles/layergroup" is for compatibility with versions up to 1.6.x
+            map: {
+                paths: [
+                    '/layergroup'
+                ]
+            },
+            // Base url for the Templated Maps API
+            // "/tiles/template" is for compatibility with versions up to 1.6.x
+            template: {
+                paths: [
+                    '/template'
+                ]
+            }
+        }
+    }
 
     // Resource URLs expose endpoints to request/retrieve metadata associated to Maps: dataviews, analysis node status.
     //
-    // This URLs depend on how `base_url_detached` and `user_from_host` are configured: the application can be
+    // This URLs depend on how `routes` and `user_from_host` are configured: the application can be
     // configured to accept request with the {user} in the header host or in the request path.
     // It also might depend on the configured cdn_url via `serverMetadata.cdn_url`.
     //
     // This template allows to make the endpoints generation more flexible, the template exposes the following params:
     //  1. {{=it.cdn_url}}: will be used when `serverMetadata.cdn_url` exists.
-    //  2. {{=it.user}}: will use the username as extraced from `user_from_host` or `base_url_detached`.
+    //  2. {{=it.user}}: will use the username as extraced from `user_from_host` or `routes`.
     //  3. {{=it.port}}: will use the `port` from this very same configuration file.
     ,resources_url_templates: {
-        http: 'http://{{=it.user}}.localhost.lan:{{=it.port}}/api/v1/map',
+        http: 'http://{{=it.cdn_url}}/{{=it.user}}/api/v1/map',
         https: 'https://{{=it.cdn_url}}/{{=it.user}}/api/v1/map'
     }
 
@@ -52,7 +88,7 @@ var config = {
     ,socket_timeout: 600000
     ,enable_cors: true
     ,cache_enabled: true
-    ,log_format: ':req[X-Real-IP] :method :req[Host]:url :status :response-time ms (:res[X-Tiler-Profiler]) -> :res[Content-Type]'
+    ,log_format: ':req[X-Real-IP] :method :req[Host]:url :status :response-time ms -> :res[Content-Type] (:res[X-Tiler-Profiler]) (:res[X-Tiler-Errors])'
     // If log_filename is given logs will be written
     // there, in append mode. Otherwise stdout is used (default).
     // Log file will be re-opened on receiving the HUP signal
@@ -64,33 +100,25 @@ var config = {
     // Supported labels: 'user_id', 'user_password' (both read from redis)
     ,postgres_auth_pass: '<%= user_password %>'
     ,postgres: {
-        // Parameters to pass to datasource plugin of mapnik
-        // See http://github.com/mapnik/mapnik/wiki/PostGIS
         user: "publicuser",
         password: "public",
         host: '127.0.0.1',
-        port: 6432,
-        extent: "-20037508.3,-20037508.3,20037508.3,20037508.3",
-        // max number of rows to return when querying data, 0 means no limit
-        row_limit: 65535,
-        simplify_geometries: true,
-        use_overviews: true, // use overviews to retrieve raster
-        /*
-         * Set persist_connection to false if you want
-         * database connections to be closed on renderer
-         * expiration (1 minute after last use).
-         * Setting to true (the default) would never
-         * close any connection for the server's lifetime
-         */
-        persist_connection: false,
-        max_size: 500
+        port: 5432,
+        pool: {
+            // maximum number of resources to create at any given time
+            size: 16,
+            // max milliseconds a resource can go unused before it should be destroyed
+            idleTimeout: 3000,
+            // frequency to check for idle resources
+            reapInterval: 1000
+        }
     }
     ,mapnik_version: undefined
     ,mapnik_tile_format: 'png8:m=h'
     ,statsd: {
         host: 'localhost',
         port: 8125,
-        prefix: 'stage.:host.',
+        prefix: 'stage.:host.', // could be hostname, better not containing dots
         cacheDns: true
         // support all allowed node-statsd options
     }
@@ -98,6 +126,12 @@ var config = {
       // Milliseconds since last access before renderer cache item expires
       cache_ttl: 60000,
       statsInterval: 5000, // milliseconds between each report to statsd about number of renderers and mapnik pool status
+      mvt: {
+        //If enabled, MVTs will be generated with PostGIS directly, instead of using Mapnik,
+        //PostGIS 2.4 is required for this to work
+        //If disabled it will use Mapnik MVT generation
+        usePostGIS: false
+      },
       mapnik: {
           // The size of the pool of internal mapnik backend
           // This pool size is per mapnik renderer created in Windshaft's RendererFactory
@@ -150,6 +184,30 @@ var config = {
           // It will only work if snapToGrid is enabled
           clipByBox2d: false, // this requires postgis >=2.2 and geos >=3.5
 
+          postgis: {
+              // Parameters to pass to datasource plugin of mapnik
+              // See http://github.com/mapnik/mapnik/wiki/PostGIS
+              user: "publicuser",
+              password: "public",
+              host: '127.0.0.1',
+              port: 5432,
+              extent: "-20037508.3,-20037508.3,20037508.3,20037508.3",
+              // max number of rows to return when querying data, 0 means no limit
+              row_limit: 65535,
+              /*
+               * Set persist_connection to false if you want
+               * database connections to be closed on renderer
+               * expiration (1 minute after last use).
+               * Setting to true (the default) would never
+               * close any connection for the server's lifetime
+               */
+               persist_connection: false,
+               simplify_geometries: true,
+               use_overviews: true, // use overviews to retrieve raster
+               max_size: 500,
+               twkb_encoding: true
+          },
+
           limits: {
               // Time in milliseconds a render request can take before it fails, some notes:
               //  - 0 means no render limit
@@ -163,26 +221,17 @@ var config = {
               cacheOnTimeout: true
           },
 
-          geojson: {
-                dbPoolParams: {
-                      // maximum number of resources to create at any given time
-                      size: 16,
-                      // max milliseconds a resource can go unused before it should be destroyed
-                      idleTimeout: 3000,
-                      // frequency to check for idle resources
-                      reapInterval: 1000
-                },
+          // If enabled Mapnik will reuse the features retrieved from the database
+          // instead of requesting them once per style inside a layer
+          'cache-features': true,
 
-              // SQL queries will be wrapped with ST_ClipByBox2D
-              // Returning the portion of a geometry falling within a rectangle
-              // It will only work if snapToGrid is enabled
-              clipByBox2d: false, // this requires postgis >=2.2 and geos >=3.5
-              // geometries will be simplified using ST_RemoveRepeatedPoints
-              // which cost is no more expensive than snapping and results are
-              // much closer to the original geometry
-              removeRepeatedPoints: false // this requires postgis >=2.2
+          // Require metrics to the renderer
+          metrics: false,
+
+          // Options for markers attributes, ellipses and images caches
+          markers_symbolizer_caches: {
+              disabled: false
           }
-
       },
       http: {
           timeout: 2000, // the timeout in ms for a http tile request
@@ -198,16 +247,7 @@ var config = {
               src: __dirname + '/../../assets/default-placeholder.png'
           }
       },
-      torque: {
-          dbPoolParams: {
-              // maximum number of resources to create at any given time
-              size: 16,
-              // max milliseconds a resource can go unused before it should be destroyed
-              idleTimeout: 3000,
-              // frequency to check for idle resources
-              reapInterval: 1000
-          }
-      }
+      torque: {}
     }
     // anything analyses related
     ,analysis: {
@@ -228,7 +268,7 @@ var config = {
             // If filename is given logs comming from analysis client  will be written
             // there, in append mode. Otherwise 'log_filename' is used. Otherwise stdout is used (default).
             // Log file will be re-opened on receiving the HUP signal
-            filename: 'logs/analysis.log'
+            filename: 'logs/node-windshaft-analysis.log'
         },
         // Define max execution time in ms for analyses or tags
         // If analysis or tag are not found in redis this values will be used as default.
@@ -306,7 +346,7 @@ var config = {
     }
     // Settings for the health check available at /health
     ,health: {
-      enabled: false,
+      enabled: true,
       username: 'localhost',
       z: 0,
       x: 0,
@@ -321,7 +361,28 @@ var config = {
         // whether the affected tables for a given SQL must query directly postgresql or use the SQL API
         cdbQueryTablesFromPostgres: true,
         // whether in mapconfig is available stats & metadata for each layer
-        layerMetadata: true
+        layerStats: true,
+        // whether it should rate limit endpoints (global configuration)
+        rateLimitsEnabled: false,
+        // whether it should rate limit one or more endpoints (only if rateLimitsEnabled = true)
+        rateLimitsByEndpoint: {
+            anonymous: false,
+            static: false,
+            static_named: false,
+            dataview: false,
+            dataview_search: false,
+            analysis: false,
+            analysis_catalog: false,
+            tile: false,
+            attributes: false,
+            named_list: false,
+            named_create: false,
+            named_get: false,
+            named: false,
+            named_update: false,
+            named_delete: false,
+            named_tiles: false
+        }
     }
 };
 

config/environments/test.js.example

@@ -6,6 +6,9 @@ var config = {
     // Its default size is 4, but it can be changed at startup time (the absolute maximum is 128).
     // See http://docs.libuv.org/en/latest/threadpool.html
     ,uv_threadpool_size: undefined
+    // Time in milliseconds to force GC cycle.
+    // Disable by using <=0 value.
+    ,gc_interval: 10000
     // Regular expression pattern to extract username
     // from hostname. Must have a single grabbing block.
     ,user_from_host: '(.*)'
@@ -13,28 +16,62 @@ var config = {
     // Base URLs for the APIs
     //
     // See https://github.com/CartoDB/Windshaft-cartodb/wiki/Unified-Map-API
-    //
-    // Base url for the Templated Maps API
-    // "/api/v1/map/named" is the new API,
-    // "/tiles/template" is for compatibility with versions up to 1.6.x
-    ,base_url_templated: '(?:/api/v1/map/named|/user/:user/api/v1/map/named|/tiles/template)'
-    // Base url for the Detached Maps API
-    // "maps" is the the new API,
-    // "tiles/layergroup" is for compatibility with versions up to 1.6.x
-    ,base_url_detached: '(?:/api/v1/map|/user/:user/api/v1/map|/tiles/layergroup)'
+    ,routes: {
+        v1: {
+            paths: [
+                '/api/v1',
+                '/user/:user/api/v1',
+            ],
+            // Base url for the Detached Maps API
+            // "/api/v1/map" is the new API,
+            map: {
+                paths: [
+                    '/map',
+                ]
+            },
+            // Base url for the Templated Maps API
+            // "/api/v1/map/named" is the new API,
+            template: {
+                paths: [
+                    '/map/named'
+                ]
+            }
+        },
+        // For compatibility with versions up to 1.6.x
+        v0: {
+            paths: [
+                '/tiles'
+            ],
+            // Base url for the Detached Maps API
+            // "/tiles/layergroup" is for compatibility with versions up to 1.6.x
+            map: {
+                paths: [
+                    '/layergroup'
+                ]
+            },
+            // Base url for the Templated Maps API
+            // "/tiles/template" is for compatibility with versions up to 1.6.x
+            template: {
+                paths: [
+                    '/template'
+                ]
+            }
+        }
+    }
 
     // Resource URLs expose endpoints to request/retrieve metadata associated to Maps: dataviews, analysis node status.
     //
-    // This URLs depend on how `base_url_detached` and `user_from_host` are configured: the application can be
+    // This URLs depend on how `routes` and `user_from_host` are configured: the application can be
     // configured to accept request with the {user} in the header host or in the request path.
     // It also might depend on the configured cdn_url via `serverMetadata.cdn_url`.
     //
     // This template allows to make the endpoints generation more flexible, the template exposes the following params:
     //  1. {{=it.cdn_url}}: will be used when `serverMetadata.cdn_url` exists.
-    //  2. {{=it.user}}: will use the username as extraced from `user_from_host` or `base_url_detached`.
+    //  2. {{=it.user}}: will use the username as extraced from `user_from_host` or `routes`.
     //  3. {{=it.port}}: will use the `port` from this very same configuration file.
     ,resources_url_templates: {
-        http: 'http://{{=it.user}}.localhost.lan:{{=it.port}}/api/v1/map'
+        http: 'http://{{=it.user}}.localhost.lan:{{=it.port}}/api/v1/map',
+        https: 'https://{{=it.user}}.localhost.lan:{{=it.port}}/api/v1/map'
     }
 
     // Maximum number of connections for one process
@@ -51,11 +88,11 @@ var config = {
     ,socket_timeout: 600000
     ,enable_cors: true
     ,cache_enabled: false
-    ,log_format: '[:date] :req[X-Real-IP] :method :req[Host]:url :status :response-time ms -> :res[Content-Type] (:res[X-Tiler-Profiler])'
+    ,log_format: ':req[X-Real-IP] :method :req[Host]:url :status :response-time ms -> :res[Content-Type] (:res[X-Tiler-Profiler]) (:res[X-Tiler-Errors])'
     // If log_filename is given logs will be written
     // there, in append mode. Otherwise stdout is used (default).
     // Log file will be re-opened on receiving the HUP signal
-    //,log_filename: 'logs/node-windshaft.log'
+    ,log_filename: '/tmp/node-windshaft.log'
     // Templated database username for authorized user
     // Supported labels: 'user_id' (read from redis)
     ,postgres_auth_user: 'test_windshaft_cartodb_user_<%= user_id %>'
@@ -63,33 +100,25 @@ var config = {
     // Supported labels: 'user_id', 'user_password' (both read from redis)
     ,postgres_auth_pass: 'test_windshaft_cartodb_user_<%= user_id %>_pass'
     ,postgres: {
-        // Parameters to pass to datasource plugin of mapnik
-        // See http://github.com/mapnik/mapnik/wiki/PostGIS
         user: "test_windshaft_publicuser",
         password: "public",
         host: '127.0.0.1',
         port: 5432,
-        extent: "-20037508.3,-20037508.3,20037508.3,20037508.3",
-        // max number of rows to return when querying data, 0 means no limit
-        row_limit: 65535,
-        simplify_geometries: true,
-        use_overviews: true, // use overviews to retrieve raster
-        /*
-         * Set persist_connection to false if you want
-         * database connections to be closed on renderer
-         * expiration (1 minute after last use).
-         * Setting to true (the default) would never
-         * close any connection for the server's lifetime
-         */
-        persist_connection: false,
-        max_size: 500
+        pool: {
+            // maximum number of resources to create at any given time
+            size: 16,
+            // max milliseconds a resource can go unused before it should be destroyed
+            idleTimeout: 3000,
+            // frequency to check for idle resources
+            reapInterval: 1000
+        }
     }
-    ,mapnik_version: ''
+    ,mapnik_version: undefined
     ,mapnik_tile_format: 'png8:m=h'
     ,statsd: {
         host: 'localhost',
         port: 8125,
-        prefix: 'test.:host.',
+        prefix: 'test.:host.', // could be hostname, better not containing dots
         cacheDns: true
         // support all allowed node-statsd options
     }
@@ -97,6 +126,12 @@ var config = {
       // Milliseconds since last access before renderer cache item expires
       cache_ttl: 60000,
       statsInterval: 5000, // milliseconds between each report to statsd about number of renderers and mapnik pool status
+      mvt: {
+        //If enabled, MVTs will be generated with PostGIS directly, instead of using Mapnik,
+        //PostGIS 2.4 is required for this to work
+        //If disabled it will use Mapnik MVT generation
+        usePostGIS: false
+      },
       mapnik: {
           // The size of the pool of internal mapnik backend
           // This pool size is per mapnik renderer created in Windshaft's RendererFactory
@@ -149,6 +184,30 @@ var config = {
           // It will only work if snapToGrid is enabled
           clipByBox2d: false, // this requires postgis >=2.2 and geos >=3.5
 
+          postgis: {
+              // Parameters to pass to datasource plugin of mapnik
+              // See http://github.com/mapnik/mapnik/wiki/PostGIS
+              user: "publicuser",
+              password: "public",
+              host: '127.0.0.1',
+              port: 5432,
+              extent: "-20037508.3,-20037508.3,20037508.3,20037508.3",
+              // max number of rows to return when querying data, 0 means no limit
+              row_limit: 65535,
+              /*
+               * Set persist_connection to false if you want
+               * database connections to be closed on renderer
+               * expiration (1 minute after last use).
+               * Setting to true (the default) would never
+               * close any connection for the server's lifetime
+               */
+               persist_connection: false,
+               simplify_geometries: true,
+               use_overviews: true, // use overviews to retrieve raster
+               max_size: 500,
+               twkb_encoding: false
+          },
+
           limits: {
               // Time in milliseconds a render request can take before it fails, some notes:
               //  - 0 means no render limit
@@ -162,24 +221,16 @@ var config = {
               cacheOnTimeout: true
           },
 
-          geojson: {
-                dbPoolParams: {
-                      // maximum number of resources to create at any given time
-                      size: 16,
-                      // max milliseconds a resource can go unused before it should be destroyed
-                      idleTimeout: 3000,
-                      // frequency to check for idle resources
-                      reapInterval: 1000
-                },
+          // If enabled Mapnik will reuse the features retrieved from the database
+          // instead of requesting them once per style inside a layer
+          'cache-features': false,
 
-              // SQL queries will be wrapped with ST_ClipByBox2D
-              // Returning the portion of a geometry falling within a rectangle
-              // It will only work if snapToGrid is enabled
-              clipByBox2d: false, // this requires postgis >=2.2 and geos >=3.5
-              // geometries will be simplified using ST_RemoveRepeatedPoints
-              // which cost is no more expensive than snapping and results are
-              // much closer to the original geometry
-              removeRepeatedPoints: false // this requires postgis >=2.2
+          // Require metrics to the renderer
+          metrics: false,
+
+          // Options for markers attributes, ellipses and images caches
+          markers_symbolizer_caches: {
+              disabled: false
           }
       },
       http: {
@@ -198,16 +249,7 @@ var config = {
               src: __dirname + '/../../assets/default-placeholder.png'
           }
       },
-      torque: {
-          dbPoolParams: {
-              // maximum number of resources to create at any given time
-              size: 16,
-              // max milliseconds a resource can go unused before it should be destroyed
-              idleTimeout: 3000,
-              // frequency to check for idle resources
-              reapInterval: 1000
-          }
-      }
+      torque: {}
     }
     // anything analyses related
     ,analysis: {
@@ -228,7 +270,7 @@ var config = {
             // If filename is given logs comming from analysis client  will be written
             // there, in append mode. Otherwise 'log_filename' is used. Otherwise stdout is used (default).
             // Log file will be re-opened on receiving the HUP signal
-            filename: 'node-windshaft.log'
+            filename: '/tmp/node-windshaft-analysis.log'
         },
         // Define max execution time in ms for analyses or tags
         // If analysis or tag are not found in redis this values will be used as default.
@@ -298,6 +340,12 @@ var config = {
     // X-Tiler-Profile header containing elapsed timing for various
     // steps taken for producing the response.
     ,useProfiler:true
+    ,serverMetadata: {
+      cdn_url: {
+        http: undefined,
+        https: undefined
+      }
+    }
     // Settings for the health check available at /health
     ,health: {
       enabled: false,
@@ -315,7 +363,28 @@ var config = {
         // whether the affected tables for a given SQL must query directly postgresql or use the SQL API
         cdbQueryTablesFromPostgres: true,
         // whether in mapconfig is available stats & metadata for each layer
-        layerMetadata: true
+        layerStats: true,
+        // whether it should rate limit endpoints (global configuration)
+        rateLimitsEnabled: false,
+        // whether it should rate limit one or more endpoints (only if rateLimitsEnabled = true)
+        rateLimitsByEndpoint: {
+            anonymous: false,
+            static: false,
+            static_named: false,
+            dataview: false,
+            dataview_search: false,
+            analysis: false,
+            analysis_catalog: false,
+            tile: false,
+            attributes: false,
+            named_list: false,
+            named_create: false,
+            named_get: false,
+            named: false,
+            named_update: false,
+            named_delete: false,
+            named_tiles: false
+        }
     }
 };
 

docker/Dockerfile-nodejs6-xenial-pg101

@@ -0,0 +1,89 @@
+FROM ubuntu:xenial
+
+# Use UTF8 to avoid encoding problems with pgsql
+ENV LANG C.UTF-8
+ENV NPROCS 1
+ENV JOBS 1
+ENV CXX g++-4.9
+ENV PGUSER postgres
+
+# Add external repos
+RUN set -ex \
+    && apt-get update \
+    && apt-get install -y \
+        curl \
+        software-properties-common \
+        locales \
+    && add-apt-repository -y ppa:ubuntu-toolchain-r/test \
+    && add-apt-repository -y ppa:cartodb/postgresql-10 \
+    && add-apt-repository -y ppa:cartodb/gis \
+    && curl -sL https://deb.nodesource.com/setup_6.x | bash \
+    && locale-gen en_US.UTF-8 \
+    && update-locale LANG=en_US.UTF-8
+
+# Install dependencies and PostGIS 2.4 from sources
+RUN set -ex \
+    && apt-get update \
+    && apt-get install -y \
+        g++-4.9 \
+        gcc-4.9 \
+        git \
+        libcairo2-dev \
+        libgdal-dev \
+        libgdal1i \
+        libgdal20 \
+        libgeos-dev \
+        libgif-dev \
+        libjpeg8-dev \
+        libjson-c-dev \
+        libpango1.0-dev \
+        libpixman-1-dev \
+        libproj-dev \
+        libprotobuf-c-dev \
+        libxml2-dev \
+        gdal-bin \
+        make \
+        nodejs \
+        protobuf-c-compiler \
+        pkg-config \
+        wget \
+        zip \
+        postgresql-10 \
+        postgresql-10-plproxy \
+        postgresql-10-postgis-2.4 \
+        postgresql-10-postgis-2.4-scripts \
+        postgresql-10-postgis-scripts \
+        postgresql-client-10 \
+        postgresql-client-common \
+        postgresql-common \
+        postgresql-contrib \
+        postgresql-plpython-10 \
+        postgresql-server-dev-10 \
+        postgis \
+    && wget http://download.redis.io/releases/redis-4.0.8.tar.gz \
+    && tar xvzf redis-4.0.8.tar.gz \
+    && cd redis-4.0.8 \
+    && make \
+    && make install \
+    && cd .. \
+    && rm redis-4.0.8.tar.gz \
+    && rm -R redis-4.0.8 \
+    && apt-get purge -y wget protobuf-c-compiler \
+    && apt-get autoremove -y 
+    
+# Configure PostgreSQL
+RUN set -ex \
+    && echo "listen_addresses='*'" >> /etc/postgresql/10/main/postgresql.conf \
+    && echo "local     all       all                     trust" >  /etc/postgresql/10/main/pg_hba.conf \
+    && echo "host      all       all       0.0.0.0/0     trust" >> /etc/postgresql/10/main/pg_hba.conf \
+    && echo "host      all       all       ::1/128       trust" >> /etc/postgresql/10/main/pg_hba.conf \
+    && /etc/init.d/postgresql start \
+    && createdb template_postgis \
+    && createuser publicuser \
+    && psql -c "CREATE EXTENSION postgis" template_postgis \
+    && /etc/init.d/postgresql stop
+
+WORKDIR /srv
+EXPOSE 5858
+
+CMD /etc/init.d/postgresql start

docker/reference.md

@@ -0,0 +1,23 @@
+After running the tests with docker, you will need Docker installed and the docker image downloaded.
+
+## Install docker
+`sudo apt install docker.io && sudo usermod -aG docker $(whoami)`
+
+## Download image
+`docker pull carto/IMAGE`
+
+## Carto account
+https://hub.docker.com/r/carto/
+
+## Update image
+- Edit the docker image file with your desired changes
+- Build image: 
+  - `docker build -t carto/IMAGE -f docker/DOCKER_FILE docker/`
+
+- Upload to docker hub:
+  - Login into docker hub: 
+    - `docker login`
+  - Create tag: 
+    - `docker tag carto/IMAGE carto/IMAGE`
+  - Upload: 
+    - `docker push carto/IMAGE`

docs/Map-API.md

@@ -17,3 +17,4 @@ You can create two types of maps with the Maps API:
 * [Anonymous Maps](anonymous_maps.md)
 * [Named Maps](named_maps.md)
 * [Static Maps API](static_maps_api.md)
+* [MapConfig File Format]([local file in the docs repo](https://github.com/CartoDB/docs/blob/master/_app/_mapsapi/06-mapconfig.md))

docs/MapConfig-Aggregation-extension.md

@@ -0,0 +1,62 @@
+# 1. Purpose
+
+This specification describes an extension for
+[MapConfig 1.7.0](https://github.com/CartoDB/Windshaft/blob/master/doc/MapConfig-1.7.0.md) version.
+
+
+# 2. Changes over specification
+
+This extension introduces a new layer options for aggregated data tile generation.
+
+## 2.1 Aggregation options
+
+The layer options attribute is extended with a new optional `aggregation` attribute.
+The value of this attribute can be `false` to explicitly disable aggregation for the layer.
+
+```javascript
+{
+    aggregation: {
+
+        // OPTIONAL
+        // string, defines the placement of aggregated geometries. Can be one of:
+        // * "point-sample", the default places geometries at a sample point (one of the aggregated geometries)
+        // * "point-grid" places geometries at the center of the aggregation grid cells
+        // * "centroid" places geometriea at the average position of the aggregated points
+        // See https://github.com/CartoDB/Windshaft-cartodb/blob/master/docs/aggregation.md#placement for more details
+        placement: "point-sample",
+
+        // OPTIONAL
+        // object, defines the columns of the aggregated datasets. Each property corresponds to a columns name and
+        // should contain an object with two properties: "aggregate_function" (one of "sum", "max", "min", "avg", "mode" or "count"),
+        // and "aggregated_column" (the name of a column of the original layer query or "*")
+        // A column defined as `"_cdb_feature_count": {"aggregate_function": "count", aggregated_column: "*"}`
+        // is always generated in addition to the defined columns.
+        // The column names `cartodb_id`, `the_geom`, `the_geom_webmercator` and `_cdb_feature_count` cannot be used
+        // for aggregated columns, as they correspond to columns always present in the result.
+        // See https://github.com/CartoDB/Windshaft-cartodb/blob/master/docs/aggregation.md#columns for more details
+        columns: {
+            "aggregated_column_1": {
+                "aggregate_function": "sum",
+                "aggregated_column": "original_column_1"
+            }
+        },
+
+        // OPTIONAL
+        // Number, defines the cell-size of the spatial aggregation grid as a pixel resolution power of two (1/4, 1/2,... 2, 4, 16)
+        // to scale from 256x256 pixels; the default is 1 corresponding to 256x256 cells per tile.
+        // See https://github.com/CartoDB/Windshaft-cartodb/blob/master/docs/aggregation.md#resolution for more details
+        resolution: 1,
+
+        // OPTIONAL
+        // Number, the minimum number of (estimated) rows in the dataset (query results) for aggregation to be applied.
+        // See https://github.com/CartoDB/Windshaft-cartodb/blob/master/docs/aggregation.md#threshold for more details
+        threshold: 500000
+    }
+}
+```
+
+# History
+
+## 1.0.0
+
+ - Initial version

docs/MapConfig-Dataviews-extension.md

@@ -8,50 +8,13 @@ This specification describes an extension for
 
 This extension depends on Analyses extension. It extends MapConfig with a new attribute: `dataviews`.
 
-It makes possible to get tabular data from analysis nodes: lists, aggregated lists, aggregations, and histograms.
+It makes possible to get tabular data from analysis nodes: aggregated lists, aggregations, and histograms.
 
 ## 2.1. Dataview types
 
-### List
-
-A list is a simple result set per row where is possible to retrieve several columns from the original layer query.
-
-Definition
-```
-{
-    // REQUIRED
-    // string, `type` the list type
-    “type”: “list”,
-    // REQUIRED
-    // object, `options` dataview params
-    “options”: {
-        // REQUIRED
-        // array, `columns` to select for the list
-        “columns”: [“name”, “description”]
-    }
-}
-```
-
-Expected output
-```
-{
-  "type": "list",
-  "rows": [
-    {
-      "{columnName1}": "val1",
-      "{columnName2}": 100
-    },
-    {
-      "{columnName1}": "val2",
-      "{columnName2}": 200
-    }
-  ]
-}
-```
-
 ### Aggregation
 
-An aggregation is very similar to a list but results are aggregated by a column and a given aggregation function.
+An aggregation is a list with aggregated results by a column and a given aggregation function.
 
 Definition
 ```

docs/aggregation.md

@@ -0,0 +1,264 @@
+# Tile Aggregation
+
+To be able to represent a large amount of data (say, hundred of thousands to millions of points) in a tile. This can be useful both for raster tiles (where the aggregation reduces the number of features to be rendered) and vector tiles (the tile contais less features).
+
+Aggregation is available only for point geometries. During aggregation the points are grouped using a grid; all the points laying in the same cell of the grid are summarized in a single aggregated result point.
+ - The position of the aggregated point is controlled by the `placement` parameter.
+ - The aggregated rows always contain at least a column, named `_cdb_feature_count`, which contains the number of the original points that the aggregated point represents.
+
+### Special default aggregation
+
+When no placement or columns are specified a special default aggregation is performed.
+
+This special mode performs only spatial aggregation (using a grid defined by the requested tile and the resolution, parameter, as all the other cases), and returns a _random_ record from each group (grid cell) with all its columns and an additional `_cdb_feature_count` with the number of features in the group.
+
+Regarding the randomness of the sample: currently we use the row with the minimum `cartodb_id` value in each group.
+
+The rationale behind having this special aggregation with all the original columns is to provide a mostly transparent way to handle large datasets without having to provide special map configurations for those cases (i.e. preserving the logic used to produce the maps with smaller datasets). [Overviews have been used so far with this intent](https://carto.com/docs/tips-and-tricks/back-end-data-performance/), but they are inflexible.
+
+### User defined aggregations
+
+When either a explicit placement or columns are requested we no longer use the special, query; we use one determined by the placement (which will default to "centroid"), and it will have as columns only the aggregated columns specified, in addition to `_cdb_feature_count`, which is always present.
+
+We might decide in the future to allow sampling column values for any of the different placement modes.
+
+### Behaviour for raster and vector tiles
+
+The vector tiles from a vector-only map will be aggregated by default.
+However, Raster tiles (or vector tiles from a map which defines CartoCSS styles) will be aggregated only upon request.
+
+Aggregation that would otherwise occur can be disabled by passing an `aggregation=false` parameter to the map instantiation HTTP call.
+
+To control how aggregation is performed, an aggregation option can be added to the layer:
+
+```json
+{
+    "layers": [
+        {
+            "options": {
+                "sql": "SELECT * FROM data",
+                "aggregation": {
+                    "placement": "centroid",
+                    "columns": {
+                        "value": {
+                            "aggregate_function": "sum",
+                            "aggregated_column": "value"
+                        }
+                    }
+                }
+            }
+        }
+    ]
+}
+```
+
+Even if aggregation is explicitly requested it may not be activated, e.g., if the geometries are not points
+or the whole dataset is too small. The map instantiation response contains metadata that informs if any particular
+layer will be aggregated when tiles are requested, both for vector (mvt) and raster (png) tiles.
+
+```json
+{
+  "layergroupid": "7b97b6e76590fef889b63edd2efb1c79:1513608333045",
+  "metadata": {
+    "layers": [
+      {
+        "type": "mapnik",
+        "id": "layer0",
+        "meta": {
+          "stats": {
+            "estimatedFeatureCount": 6232136
+          },
+          "aggregation": {
+            "png": true,
+            "mvt": true
+          }
+        }
+      }
+    ]
+  }
+}
+```
+
+## Aggregation parameters
+
+The aggregation parameters for a layer are defined inside an `aggregation` option of the layer:
+
+```json
+{
+    "layers": [
+        {
+            "options": {
+                "sql": "SELECT * FROM data",
+                "aggregation": {"...": "..."}
+            }
+        }
+    ]
+}
+```
+
+### `placement`
+
+Determines the kind of aggregated geometry generated:
+
+#### `point-sample`
+
+This is the default placement. It will place the aggregated point at a random sample of the grouped points,
+like the default aggregation does. No other attribute is sampled, though, the point will contain the aggregated attributes determined by the `columns` parameter.
+
+#### `point-grid`
+
+Generates points at the center of the aggregation grid cells (squares).
+
+#### `centroid`
+
+Generates points with the averaged coordinated of the grouped points (i.e. the points inside each grid cell).
+
+### `columns`
+
+The aggregated attributes defined by `columns` are computed by a applying an _aggregate function_ to all the points in each group.
+Valid aggregate functions are `sum`, `avg` (average), `min` (minimum), `max` (maximum) and `mode` (the most frequent value in the group).
+The values to be aggregated are defined by the _aggregated column_ of the source data. The column keys define the name of the resulting column in the aggregated dataset.
+
+For example here we define three aggregate attributes named `total`, `max_price` and `price` which are all computed with the same column, `price`,
+of the original dataset applying three different aggregate functions.
+
+```json
+{
+    "columns": {
+        "total": { "aggregate_function": "sum", "aggregated_column": "price" },
+        "max_price": { "aggregate_function": "max", "aggregated_column": "price" },
+        "price": { "aggregate_function": "avg", "aggregated_column": "price" }
+    }
+}
+```
+
+> Note that you can use the original column names as names of the result, but all the result column names must be unique.  In particular, the names `cartodb_id`, `the_geom`, `the_geom_webmercator` and `_cdb_feature_count` cannot be used for aggregated columns, as they correspond to columns always present in the result.
+
+### `resolution`
+
+Defines the cell-size of the spatial aggregation grid. This is equivalent to the [CartoCSS `-torque-resolution`](https://carto.com/docs/carto-engine/cartocss/properties-for-torque/#-torque-resolution-float) property of Torque maps.
+
+The aggregation cells are `resolution`×`resolution` pixels in size, where pixels here are defined to be 1/256 of the (linear) size of a tile.
+The default value is 1, so that aggregation coincides with raster pixels. A value of 2 would make each cell to be 4 (2×2) pixels, and a value of
+0.5 would yield 4 cells per pixel. In teneral values less than 1 produce sub-pixel precision.
+
+> Note that is independent of the number of pixels for raster tile or the coordinate resolution (mvt_extent) of vector tiles.
+
+
+### `threshold`
+
+This is the minimum number of (estimated) rows in the dataset (query results) for aggregation to be applied. If the number of rows estimate is less than the threshold aggregation will be disabled for the layer; the instantiation response will reflect that and tiles will be generated without aggregation.
+
+### Example
+
+```json
+{
+    "version": "1.7.0",
+    "extent": [-20037508.5, -20037508.5, 20037508.5, 20037508.5],
+    "srid": 3857,
+    "maxzoom": 18,
+    "minzoom": 3,
+    "layers": [
+        {
+            "type": "mapnik",
+            "options": {
+                "sql": "select * from table",
+                "cartocss": "#table { marker-width: [total]; marker-fill: ramp(value, (red, green, blue), jenks); }",
+                "cartocss_version": "2.3.0",
+                "aggregation": {
+                    "placement": "centroid",
+                    "columns": {
+                        "value": {
+                            "aggregate_function": "avg",
+                            "aggregated_column": "value"
+                        },
+                        "total": {
+                            "aggregate_function": "sum",
+                            "aggregated_column": "value"
+                        }
+                    },
+                    "resolution": 2,
+                    "threshold": 500000
+                }
+            }
+        }
+    ]
+}
+```
+
+### `filters`
+
+Aggregated data can be filtered by imposing filtering conditions on the aggregated columns.
+
+Each condition is represented by one or more parameters:
+
+* `{ "equal": V }` selects an specific value of the aggregated column.
+* `{ "not_equal": V }` selects values different from the one specified.
+* `{ "in": [v1, v2, v3] }` selects any value from a list.
+* `{ "not_in": [v1, v2, v3] }` selects any value not in a list.
+* `{ "less_than": v }` selects values strictly less than the one given.
+* `{ "less_than_or_equal_to": v }` selects values less than or equal to the one given.
+* `{ "greater_than": v }` selects values strictly greater than the one given.
+* `{ "greater_than_or_equal_to": v }` selects values  greater than or equal to the one given.
+
+One of the *less* conditions can be combined with one of the *greater* conditions to select a range of values, for example:
+* `{ "greater_than": v1, "less_than": v2 }`
+* `{ "greater_than_or_equal_to": v1, "less_than": v2 }`
+* `{ "greater_than": v1, "less_than_or_equal_to": v2 }`
+* `{ "greater_than_or_equal_to": v1, "less_than_or_equal_to": v2 }`
+
+For a given column, multiple conditions can be passed in an array; the conditions will logically ORed (any of the conditions have to be verifid for the value to be selected):
+
+* `"myvalue": [ { "equal": 10 }, { "less_than": 0 }]` will select values of the column `myvalue` which are equal to 10 **or** less than 0.
+
+In addition, the filters applied to different columns are logically combined with AND (all the conditions have to be satisfied for an element to be selected); for example with the following `filters` parameter we'll select aggregated records which have a `total_value` > 100 **and** a category equal to "a".
+
+```json
+{
+    "total_value": { "greater_than": 100 },
+    "category":    { "equal": "a" }
+}
+```
+
+Note that the filtered columns have to be defined with the `columns` parameter, except for `_cdb_feature_count`, which is always implicitly defined and can be filtered too.
+
+#### Example
+
+```json
+{
+    "version": "1.7.0",
+    "extent": [-20037508.5, -20037508.5, 20037508.5, 20037508.5],
+    "srid": 3857,
+    "maxzoom": 18,
+    "minzoom": 3,
+    "layers": [
+        {
+            "type": "mapnik",
+            "options": {
+                "sql": "select * from table",
+                "cartocss": "#table { marker-width: [total]; marker-fill: ramp(value, (red, green, blue), jenks); }",
+                "cartocss_version": "2.3.0",
+                "aggregation": {
+                    "placement": "centroid",
+                    "columns": {
+                        "total_value": {
+                            "aggregate_function": "sum",
+                            "aggregated_column": "value"
+                        },
+                        "category": {
+                            "aggregate_function": "mode",
+                            "aggregated_column": "category"
+                        }
+                    },
+                    "filters" : {
+                        "total_value": { "greater_than": 100 },
+                        "category":   { "equal": "a" }
+                    },
+                    "resolution": 2,
+                    "threshold": 500000
+                }
+            }
+        }
+    ]
+}
+```

docs/anonymous_maps.md

@@ -1,6 +1,7 @@
 # Anonymous Maps
 
-Anonymous Maps allows you to instantiate a map given SQL and CartoCSS. It also allows you to add interaction capabilities using [UTF Grid.](https://github.com/mapbox/utfgrid-spec)
+Anonymous Maps allows you to instantiate a map given SQL and CartoCSS. It also allows you to add interaction capabilities using [UTF Grid.](https://github.com/mapbox/utfgrid-spec).
+Alternatively, you can get the data for the map (geometry and attributes for each layer) using vector tiles (in which case CartoCSS is not required).
 
 
 ## Instantiate
@@ -41,6 +42,13 @@ updated_at | The ISO date of the last time the data involved in the query was up
 metadata | Includes information about the layers.
 cdn_url | URLs to fetch the data using the best CDN for your zone.
 
+**Improved response metadata**
+
+Originally, you needed to concantenate the `layergroupid` with the correct domain and the path for the tiles.
+Now, for convenience, the layergroup includes the final URLs in two formats:
+1. Leaflet's urlTemplate alike: useful when working with raster tiles or with libraries with an API similar to Leaflet's one.
+1. [TileJSON spec](https://github.com/mapbox/tilejson-spec): useful when working with Mapbox GL or any other library that supports TileJSON.
+
 ### Example
 
 #### Call
@@ -61,30 +69,231 @@ curl 'https://{username}.carto.com/api/v1/map' -H 'Content-Type: application/jso
         "type": "mapnik",
         "meta": {}
       }
-    ]
+    ],
+    "tilejson": {
+        "raster": {
+            "tilejson": "2.2.0",
+            "tiles": [
+                "http://a.cdb.com/c01a54877c62831bb51720263f91fb33/{z}/{x}/{y}.png",
+                "http://b.cdb.com/c01a54877c62831bb51720263f91fb33/{z}/{x}/{y}.png"
+            ]
+        }
+    },
+    "url": {
+        "raster": {
+            "urlTemplate": "http://{s}.cdb.com/c01a54877c62831bb51720263f91fb33/{z}/{x}/{y}.png",
+            "subdomains": ["a", "b"]
+        }
+    }
   },
   "cdn_url": {
     "http": "http://cdb.com",
-    "https": "https://cdb.com"
+    "https": "https://cdb.com",
+    "templates": {
+         "http": { "subdomains": ["a","b"], "url": "http://{s}.cdb.com" },
+         "https": { "subdomains": ["a","b"], "url": "https://{s}.example.com" },
+    }
   }
 }
 ```
 
-### Retrieve resources from the layergroup
+## Map Tile Rendering
+
+Map tiles are used to create the graphic representation of your map in a web browser. Tiles can be requested either as pre-rendered *raster* tiles (images) or as *vector* map data to be rendered by the client (browser).
+
+- **Raster**: If a tile is requested as a raster image format, like PNG, the map will be rendered on the server, using the CartoCSS styles defined in the layers of the map. It is necessary that all the layers of a map define CartoCSS styles in order to obtain raster tiles. Raster tiles are made up of 256x256 pixels; to avoid graphic quality issues tiles should be used unscaled to represent the zoom level (Z) for which they are requested. In order to render tiles, data will be retrieved from the database (in vector format) on the server-side.
+
+- **Vector**: Tiles can also be requested as MVT (Mapbox Vector Tiles). In this case, only the geospatial vector data, without any styling, is returned. These tiles should be processed in the client-side to render the map.  In this case layers do not need to define CartoCSS, as any rendering and styling will be performed on the client side. The vector data of a tile represents real-world geometries by defining the vertices of points, lines or polygons in a tile-specific coordinate system.
+
+## Retrieve resources from the layergroup
 
 When you have a layergroup, there are several resources for retrieving layergoup details such as, accessing Mapnik tiles, getting individual layers, accessing defined Attributes, and blending and layer selection.
 
-#### Mapnik tiles
+### Raster tiles
 
-These tiles will get just the Mapnik layers. To get individual layers, see the following section.
+These raster tiles are PNG images that represent only the Mapnik layers of a map. See [individual layers](#individual-layers) for details about how to retrieve other layers.
 
 ```bash
 https://{username}.carto.com/api/v1/map/{layergroupid}/{z}/{x}/{y}.png
 ```
 
-#### Individual layers
+### Mapbox Vector Tiles (MVT)
 
-The MapConfig specification holds the layers definition in a 0-based index. Layers can be requested individually in different formats depending on the layer type.
+[Mapbox Vector Tiles (MVT)](https://www.mapbox.com/vector-tiles/specification/) are map tiles that transfer geographic vector data to the client-side. Browser performance is fast since you can pan and zoom without having to query the server.
+
+CARTO uses Web Graphics Library (WebGL) to process MVT files on the browser. This is useful since WebGL is compatible with most web browsers, include support for multiple client-side mapping engines, and do not require additional information from the server; which makes it more efficient for rendering map tiles. However, you can use any implementation tool for processing MVT files.
+
+The following examples describe how to fetch MVT tiles with a cURL request.
+
+#### MVT and Windshaft
+
+CARTO uses Windshaft as the map tiler library to render multilayer maps with the Maps API. You can use Windshaft to request MVT using the same layer type that is used for requesting raster tiles (Mapnik layer). Simply change the file format `.mvt` in the URL.
+
+
+```bash
+https://{username}.cartodb.com/api/v1/map/HASH/:layer/{z}/{x}/{y}.mvt
+```
+
+The following example instantiates an anonymous map with layer options:
+
+```bash
+{
+  user_name: 'mycartodbuser',
+  sublayers: [{
+    sql: "SELECT * FROM table_name";
+    cartocss: '#layer { marker-fill: #F0F0F0; }'
+  }],
+  maps_api_template: 'https://{user}.cartodb.com' // Optional
+}
+```
+
+**Note**: If no layer type is specified, Mapnik tiles are used by default. To access MVT tiles, specify `https://{username}.cartodb.com/api/v1/map/HASH/{z}/{x}/{y}.mvt` as the `maps_api_template` variable.
+
+**Tip:** If you are using [Named Maps](https://carto.com/docs/carto-engine/maps-api/named-maps/) to instantiate a layer, indicate the MVT file format and layer in the response:
+
+```bash
+https://{username}.cartodb.com/api/v1/map/named/:templateId/:layer/{z}/{x}/{y}.mvt
+```
+
+For all layers in a Named Map, you must indicate Mapnik as the layer filter:
+
+```bash
+https://{username}.cartodb.com/api/v1/map/named/:templateId/mapnik/{z}/{x}/{y}.mvt
+```
+
+#### Layergroup Filter for MVT Tiles
+
+To filter layers using Windshaft, use the following request where layers are numbered:
+
+```bash
+https://{username}.cartodb.com/api/v1/map/HASH/0,1,2/{z}/{x}/{y}.mvt
+```
+
+To request all layers, remove the layergroup filter parameter:
+
+```bash
+https://{username}.cartodb.com/api/v1/map/HASH/{z}/{x}/{y}.mvt
+```
+
+To filter a specific layer:
+
+```bash
+https://{username}.cartodb.com/api/v1/map/HASH/2/{z}/{x}/{y}.mvt
+```
+
+#### Example 1: MVT Tiles with Windshaft, CARTO.js, and MapboxGL
+
+1) Import the required libraries:
+
+```bash
+<script src='https://api.tiles.mapbox.com/mapbox-gl-js/v0.9.0/mapbox-gl.js'></script>
+<link href='https://api.tiles.mapbox.com/mapbox-gl-js/v0.9.0/mapbox-gl.css' rel='stylesheet' />
+<script src="http://libs.cartocdn.com/cartodb.js/v3/3.15/cartodb.core.js"></script>
+```
+
+2) Configure Map Client:
+
+```bash
+mapboxgl.accessToken = '{yourMapboxToken}';
+```
+
+3) Create Map Object (Mapbox):
+
+```bash
+var map = new mapboxgl.Map({
+container: 'map',
+zoom: 1,
+minZoom: 0,
+maxZoom: 18,
+center: [30, 0]
+});
+```
+
+4) Define Layer Options (CARTO):
+
+```bash
+var layerOptions = {
+user_name: "{username}",
+sublayers: [{
+sql: "SELECT * FROM {table_name}",
+cartocss: "...",
+     }]
+};
+```
+
+5) Request Tiles (from CARTO) and Set to Map Object (Mapbox):
+
+**Note:** By default, [CARTO core functions](https://carto.com/docs/carto-engine/carto-js/core-api/) retrieve URLs for fully rendered tiles. You must replace the default format (.png) with the MVT format (.mvt).
+
+
+```bash
+cartodb.Tiles.getTiles(layerOptions, function(result, err) {
+var tiles = result.tiles.map(function(tileUrl) {
+return tileUrl
+.replace('{s}', 'a')
+.replace(/\.png/, '.mvt');
+});
+map.setStyle(simpleStyle(tiles));
+});
+```
+
+#### Example 2: MVT Libraries with Windshaft and MapboxGL
+
+When you are not including CARTO.js to implement MVT tiles, you must use the `map.setStyle` parameter to specify vector map rendering.
+
+1) Import the required libraries:
+
+```bash
+<script src='https://api.tiles.mapbox.com/mapbox-gl-js/v0.9.0/mapbox-gl.js'></script>
+<link href='https://api.tiles.mapbox.com/mapbox-gl-js/v0.9.0/mapbox-gl.css' rel='stylesheet'/>
+```
+
+2) Configure Map Client:
+
+```bash
+mapboxgl.accessToken = '{yourMapboxToken}';
+```
+
+3) Create Map Object (Mapbox):
+
+```bash
+var map = new mapboxgl.Map({
+container: 'map',
+zoom: 1,
+minZoom: 0,
+maxZoom: 18,
+center: [30, 0]
+});
+```
+
+4) Set the Style
+
+```bash
+map.setStyle({
+    "version": 7,
+    "glyphs": "...",
+    "constants": {...},
+    "sources": {
+      "cartodb": {
+        "type": "vector",
+        "tiles": [ "http://{username}.cartodb.com/api/v1/map/named/templateId/mapnik/{z}/{x}/{y}.mvt"
+        ],
+        "maxzoom": 18
+      }
+    },
+    "layers": [{...}]
+});
+```
+
+**Tip:** If you are using MapboxGL, see the following resource for additional information.
+
+- [MapboxGL API Reference](https://www.mapbox.com/mapbox-gl-js/api/)
+- [MapboxGL Style Specifications](https://www.mapbox.com/mapbox-gl-js/style-spec/)
+- [Example of MapboxGL Implementation](https://www.mapbox.com/mapbox-gl-js/examples/)
+
+### Individual layers
+
+The MapConfig specification holds the layers definition in a 0-based index. Layers can be requested individually, in different formats, depending on the layer type.
 
 Individual layers can be accessed using that 0-based index. For UTF grid tiles:
 
@@ -100,19 +309,19 @@ If the MapConfig had a Torque layer at index 1 it could be possible to request i
 https://{username}.carto.com/api/v1/map/{layergroupid}/1/{z}/{x}/{y}.torque.json
 ```
 
-#### Attributes defined in `attributes` section
+### Attributes defined in `attributes` section
 
 ```bash
 https://{username}.carto.com/api/v1/map/{layergroupid}/{layer}/attributes/{feature_id}
 ```
 
-Which returns JSON with the attributes defined, like:
+Which returns JSON with the attributes defined, such as:
 
 ```javascript
 { "c": 1, "d": 2 }
 ```
 
-#### Blending and layer selection
+### Blending and layer selection
 
 ```bash
 https://{username}.carto.com/api/v1/map/{layergroupid}/{layer_filter}/{z}/{x}/{y}.png
@@ -141,10 +350,7 @@ https://{username}.carto.com/api/v1/map/{layergroupid}/0,3,4/{z}/{x}/{y}.png
 Some notes about filtering:
 
   - Invalid index values or out of bounds indexes will end in `Invalid layer filtering` errors.
-  - Ordering is not considered. So right now filtering layers 0,3,4 is the very same thing as filtering 3,4,0. As this
-  may change in the future **it is recommended** to always select the layers in ascending order so you will get a
-  consistent behavior in the future.
-
+  - Ordering is not considered. So right now filtering layers 0,3,4 is the very same thing as filtering 3,4,0. As this may change in the future, **it is recommended** to always select the layers in ascending order so that you will always get consistent behavior.
 
 ## Create JSONP
 
@@ -185,7 +391,6 @@ callback({
 })
 ```
 
-
 ## Remove
 
 Anonymous Maps cannot be removed by an API call. They will expire after about five minutes, or sometimes longer. If an Anonymous Map expires and tiles are requested from it, an error will be raised. This could happen if a user leaves a map open and after time, returns to the map and attempts to interact with it in a way that requires new tiles (e.g. zoom). The client will need to go through the steps of creating the map again to fix the problem.

docs/general_concepts.md

@@ -22,6 +22,6 @@ Errors are reported using standard HTTP codes and extended information encoded i
 
 If you use JSONP, the 200 HTTP code is always returned so the JavaScript client can receive errors from the JSON object.
 
-## CORS support
+## CORS Support
 
 All the endpoints, which might be accessed using a web browser, add CORS headers and allow OPTIONS method.

docs/static_maps_api.md

@@ -11,7 +11,7 @@ Begin by instantiating either a Named or Anonymous Map using the `layergroupid t
 #### Definition
 
 ```bash
-GET /api/v1/map/static/center/{token}/{z}/{lat}/{lng}/{width}/{height}.{format}
+GET /api/v1/map/static/center/{token}/{z}/{lat}/{lng}/{width}/{height}.{format}{{?}extra_options}
 ```
 
 #### Params
@@ -58,6 +58,9 @@ Note: you can see this endpoint as
 GET /api/v1/map/static/bbox/{token}/{west},{south},{east},{north}/{width}/{height}.{format}`
 ```
 
+#### Extra options
+ * Layer: List of layers to be shown in the image (by default `all`), for example `?layer=0,1`.
+
 ### Named Map
 
 #### Definition
@@ -150,6 +153,11 @@ It is important to note that generated images are cached from the live data refe
 * Image resolution is set to 72 DPI
 * JPEG quality is 85%
 * Timeout limits for generating static maps are the same across CARTO Builder and CARTO Engine. It is important to ensure timely processing of queries.
+* If you are publishing your map as a static image with the API, you must manually add [attributions](https://carto.com/attribution) for your static map image. For example, add the following attribution code:
+
+{% highlight javascript %}
+attribution: '&copy; <a href="http://www.openstreetmap.org/copyright">OpenStreetMap</a> contributors, &copy; <a href="https://carto.com/attributions">CARTO</a>
+{% endhighlight %}
 
 ## Examples
 

lib/cartodb/api/api-router.js

@@ -0,0 +1,321 @@
+const { Router: router } = require('express');
+
+const RedisPool = require('redis-mpool');
+const cartodbRedis = require('cartodb-redis');
+
+const windshaft = require('windshaft');
+
+const PgConnection = require('../backends/pg_connection');
+const AnalysisBackend = require('../backends/analysis');
+const AnalysisStatusBackend = require('../backends/analysis-status');
+const DataviewBackend = require('../backends/dataview');
+const TemplateMaps = require('../backends/template_maps.js');
+const PgQueryRunner = require('../backends/pg_query_runner');
+const StatsBackend = require('../backends/stats');
+const AuthBackend = require('../backends/auth');
+
+const UserLimitsBackend = require('../backends/user-limits');
+const OverviewsMetadataBackend = require('../backends/overviews-metadata');
+const FilterStatsApi = require('../backends/filter-stats');
+const TablesExtentBackend = require('../backends/tables-extent');
+
+const LayergroupAffectedTablesCache = require('../cache/layergroup_affected_tables');
+const SurrogateKeysCache = require('../cache/surrogate_keys_cache');
+const VarnishHttpCacheBackend = require('../cache/backend/varnish_http');
+const FastlyCacheBackend = require('../cache/backend/fastly');
+const NamedMapProviderCache = require('../cache/named_map_provider_cache');
+const NamedMapsCacheEntry = require('../cache/model/named_maps_entry');
+
+const SqlWrapMapConfigAdapter = require('../models/mapconfig/adapter/sql-wrap-mapconfig-adapter');
+const MapConfigNamedLayersAdapter = require('../models/mapconfig/adapter/mapconfig-named-layers-adapter');
+const MapConfigBufferSizeAdapter = require('../models/mapconfig/adapter/mapconfig-buffer-size-adapter');
+const AnalysisMapConfigAdapter = require('../models/mapconfig/adapter/analysis-mapconfig-adapter');
+const MapConfigOverviewsAdapter = require('../models/mapconfig/adapter/mapconfig-overviews-adapter');
+const TurboCartoAdapter = require('../models/mapconfig/adapter/turbo-carto-adapter');
+const DataviewsWidgetsAdapter = require('../models/mapconfig/adapter/dataviews-widgets-adapter');
+const AggregationMapConfigAdapter = require('../models/mapconfig/adapter/aggregation-mapconfig-adapter');
+const MapConfigAdapter = require('../models/mapconfig/adapter');
+const VectorMapConfigAdapter = require('../models/mapconfig/adapter/vector-mapconfig-adapter');
+
+const ResourceLocator = require('../models/resource-locator');
+const LayergroupMetadata = require('../utils/layergroup-metadata');
+const RendererStatsReporter = require('../stats/reporter/renderer');
+
+const initializeStatusCode = require('./middlewares/initialize-status-code');
+const logger = require('./middlewares/logger');
+const bodyParser = require('body-parser');
+const servedByHostHeader = require('./middlewares/served-by-host-header');
+const stats = require('./middlewares/stats');
+const lzmaMiddleware = require('./middlewares/lzma');
+const cors = require('./middlewares/cors');
+const user = require('./middlewares/user');
+const sendResponse = require('./middlewares/send-response');
+const syntaxError = require('./middlewares/syntax-error');
+const errorMiddleware = require('./middlewares/error-middleware');
+
+const MapRouter = require('./map/map-router');
+const TemplateRouter = require('./template/template-router');
+
+module.exports = class ApiRouter {
+    constructor ({ serverOptions, environmentOptions }) {
+        this.serverOptions = serverOptions;
+
+        const redisOptions = Object.assign({
+            name: 'windshaft-server',
+            unwatchOnRelease: false,
+            noReadyCheck: true
+        }, environmentOptions.redis);
+
+        const redisPool = new RedisPool(redisOptions);
+
+        redisPool.on('status', function (status) {
+            var keyPrefix = 'windshaft.redis-pool.' + status.name + '.db' + status.db + '.';
+            global.statsClient.gauge(keyPrefix + 'count', status.count);
+            global.statsClient.gauge(keyPrefix + 'unused', status.unused);
+            global.statsClient.gauge(keyPrefix + 'waiting', status.waiting);
+        });
+
+        const metadataBackend = cartodbRedis({ pool: redisPool });
+        const pgConnection = new PgConnection(metadataBackend);
+
+        const mapStore = new windshaft.storage.MapStore({
+            pool: redisPool,
+            expire_time: serverOptions.grainstore.default_layergroup_ttl
+        });
+
+        const rendererFactory = createRendererFactory({ redisPool, serverOptions, environmentOptions });
+
+        const rendererCacheOpts = Object.assign({
+            ttl: 60000, // 60 seconds TTL by default
+            statsInterval: 60000 // reports stats every milliseconds defined here
+        }, serverOptions.renderCache || {});
+
+        const rendererCache = new windshaft.cache.RendererCache(rendererFactory, rendererCacheOpts);
+        const rendererStatsReporter = new RendererStatsReporter(rendererCache, rendererCacheOpts.statsInterval);
+        rendererStatsReporter.start();
+
+        const tileBackend = new windshaft.backend.Tile(rendererCache);
+        const attributesBackend = new windshaft.backend.Attributes();
+        const previewBackend = new windshaft.backend.Preview(rendererCache);
+        const mapValidatorBackend = new windshaft.backend.MapValidator(tileBackend, attributesBackend);
+        const mapBackend = new windshaft.backend.Map(rendererCache, mapStore, mapValidatorBackend);
+
+        const surrogateKeysCacheBackends = createSurrogateKeysCacheBackends(serverOptions);
+        const surrogateKeysCache = new SurrogateKeysCache(surrogateKeysCacheBackends);
+        const templateMaps = createTemplateMaps({ redisPool, surrogateKeysCache });
+
+        const analysisStatusBackend = new AnalysisStatusBackend();
+        const analysisBackend = new AnalysisBackend(metadataBackend, serverOptions.analysis);
+        const dataviewBackend = new DataviewBackend(analysisBackend);
+        const statsBackend = new StatsBackend();
+
+        const userLimitsBackend = new UserLimitsBackend(metadataBackend, {
+            limits: {
+                cacheOnTimeout: serverOptions.renderer.mapnik.limits.cacheOnTimeout || false,
+                render: serverOptions.renderer.mapnik.limits.render || 0,
+                rateLimitsEnabled: global.environment.enabledFeatures.rateLimitsEnabled
+            }
+        });
+        const authBackend = new AuthBackend(pgConnection, metadataBackend, mapStore, templateMaps);
+
+        const layergroupAffectedTablesCache = new LayergroupAffectedTablesCache();
+
+        if (process.env.NODE_ENV === 'test') {
+            this.layergroupAffectedTablesCache = layergroupAffectedTablesCache;
+        }
+
+        const pgQueryRunner = new PgQueryRunner(pgConnection);
+        const overviewsMetadataBackend = new OverviewsMetadataBackend(pgQueryRunner);
+
+        const filterStatsBackend = new FilterStatsApi(pgQueryRunner);
+        const tablesExtentBackend = new TablesExtentBackend(pgQueryRunner);
+
+        const mapConfigAdapter = new MapConfigAdapter(
+            new MapConfigNamedLayersAdapter(templateMaps, pgConnection),
+            new MapConfigBufferSizeAdapter(),
+            new SqlWrapMapConfigAdapter(),
+            new DataviewsWidgetsAdapter(),
+            new AnalysisMapConfigAdapter(analysisBackend),
+            new VectorMapConfigAdapter(pgConnection),
+            new AggregationMapConfigAdapter(pgConnection),
+            new MapConfigOverviewsAdapter(overviewsMetadataBackend, filterStatsBackend),
+            new TurboCartoAdapter()
+        );
+
+        const resourceLocator = new ResourceLocator(global.environment);
+        const layergroupMetadata = new LayergroupMetadata(resourceLocator);
+
+        const namedMapProviderCache = new NamedMapProviderCache(
+            templateMaps,
+            pgConnection,
+            metadataBackend,
+            userLimitsBackend,
+            mapConfigAdapter,
+            layergroupAffectedTablesCache
+        );
+
+        ['update', 'delete'].forEach(function(eventType) {
+            templateMaps.on(eventType, namedMapProviderCache.invalidate.bind(namedMapProviderCache));
+        });
+
+        const collaborators = {
+            analysisStatusBackend,
+            attributesBackend,
+            dataviewBackend,
+            previewBackend,
+            tileBackend,
+            pgConnection,
+            mapStore,
+            userLimitsBackend,
+            layergroupAffectedTablesCache,
+            authBackend,
+            surrogateKeysCache,
+            templateMaps,
+            mapBackend,
+            metadataBackend,
+            mapConfigAdapter,
+            statsBackend,
+            layergroupMetadata,
+            namedMapProviderCache,
+            tablesExtentBackend
+        };
+
+        this.mapRouter = new MapRouter({ collaborators });
+        this.templateRouter = new TemplateRouter({ collaborators });
+    }
+
+    register (app) {
+        // FIXME: we need a better way to reset cache while running tests
+        if (process.env.NODE_ENV === 'test') {
+            app.layergroupAffectedTablesCache = this.layergroupAffectedTablesCache;
+        }
+
+        Object.keys(this.serverOptions.routes).forEach(apiVersion => {
+            const routes = this.serverOptions.routes[apiVersion];
+
+            const apiRouter = router({ mergeParams: true });
+
+            apiRouter.use(logger(this.serverOptions));
+            apiRouter.use(initializeStatusCode());
+            apiRouter.use(bodyParser.json());
+            apiRouter.use(servedByHostHeader());
+            apiRouter.use(stats({
+                enabled: this.serverOptions.useProfiler,
+                statsClient: global.statsClient
+            }));
+            apiRouter.use(lzmaMiddleware());
+            apiRouter.use(cors());
+            apiRouter.use(user());
+
+            this.templateRouter.register(apiRouter, routes.template.paths);
+            this.mapRouter.register(apiRouter, routes.map.paths);
+
+            apiRouter.use(sendResponse());
+            apiRouter.use(syntaxError());
+            apiRouter.use(errorMiddleware());
+
+            const apiPaths = routes.paths;
+
+            apiPaths.forEach(path => app.use(path, apiRouter));
+        });
+    }
+};
+
+
+function createTemplateMaps ({ redisPool, surrogateKeysCache }) {
+    const templateMaps = new TemplateMaps(redisPool, {
+        max_user_templates: global.environment.maxUserTemplates
+    });
+
+    function invalidateNamedMap (owner, templateName) {
+        var startTime = Date.now();
+        surrogateKeysCache.invalidate(new NamedMapsCacheEntry(owner, templateName), function(err) {
+            var logMessage = JSON.stringify({
+                username: owner,
+                type: 'named_map_invalidation',
+                elapsed: Date.now() - startTime,
+                error: !!err ? JSON.stringify(err.message) : undefined
+            });
+            if (err) {
+                global.logger.warn(logMessage);
+            } else {
+                global.logger.info(logMessage);
+            }
+        });
+    }
+
+
+    ['update', 'delete'].forEach(function(eventType) {
+        templateMaps.on(eventType, invalidateNamedMap);
+    });
+
+    return templateMaps;
+}
+
+function createSurrogateKeysCacheBackends(serverOptions) {
+    var cacheBackends = [];
+
+    if (serverOptions.varnish_purge_enabled) {
+        cacheBackends.push(
+            new VarnishHttpCacheBackend(serverOptions.varnish_host, serverOptions.varnish_http_port)
+        );
+    }
+
+    if (serverOptions.fastly &&
+        !!serverOptions.fastly.enabled && !!serverOptions.fastly.apiKey && !!serverOptions.fastly.serviceId) {
+        cacheBackends.push(
+            new FastlyCacheBackend(serverOptions.fastly.apiKey, serverOptions.fastly.serviceId)
+        );
+    }
+
+    return cacheBackends;
+}
+
+const timeoutErrorTilePath = __dirname + '/../../../assets/render-timeout-fallback.png';
+const timeoutErrorTile = require('fs').readFileSync(timeoutErrorTilePath, {encoding: null});
+
+function createRendererFactory ({ redisPool, serverOptions, environmentOptions }) {
+    var onTileErrorStrategy;
+    if (environmentOptions.enabledFeatures.onTileErrorStrategy !== false) {
+        onTileErrorStrategy = function onTileErrorStrategy$TimeoutTile(err, tile, headers, stats, format, callback) {
+
+            function isRenderTimeoutError (err) {
+                return err.message === 'Render timed out';
+            }
+
+            function isDatasourceTimeoutError (err) {
+                return err.message && err.message.match(/canceling statement due to statement timeout/i);
+            }
+
+            function isTimeoutError (err) {
+                return isRenderTimeoutError(err) || isDatasourceTimeoutError(err);
+            }
+
+            function isRasterFormat (format) {
+                return format === 'png' || format === 'jpg';
+            }
+
+            if (isTimeoutError(err) && isRasterFormat(format)) {
+                return callback(null, timeoutErrorTile, {
+                    'Content-Type': 'image/png',
+                }, {});
+            } else {
+                return callback(err, tile, headers, stats);
+            }
+        };
+    }
+
+    const rendererFactory = new windshaft.renderer.Factory({
+        onTileErrorStrategy: onTileErrorStrategy,
+        mapnik: {
+            redisPool: redisPool,
+            grainstore: serverOptions.grainstore,
+            mapnik: serverOptions.renderer.mapnik
+        },
+        http: serverOptions.renderer.http,
+        mvt: serverOptions.renderer.mvt,
+        torque: serverOptions.renderer.torque
+    });
+
+    return rendererFactory;
+}

lib/cartodb/api/auth_api.js

@@ -1,137 +0,0 @@
-var assert = require('assert');
-var step = require('step');
-
-/**
- *
- * @param {PgConnection} pgConnection
- * @param metadataBackend
- * @param {MapStore} mapStore
- * @param {TemplateMaps} templateMaps
- * @constructor
- * @type {AuthApi}
- */
-function AuthApi(pgConnection, metadataBackend, mapStore, templateMaps) {
-    this.pgConnection = pgConnection;
-    this.metadataBackend = metadataBackend;
-    this.mapStore = mapStore;
-    this.templateMaps = templateMaps;
-}
-
-module.exports = AuthApi;
-
-// Check if a request is authorized by a signer
-//
-// @param req express request object
-// @param callback function(err, signed_by) signed_by will be
-//                 null if the request is not signed by anyone
-//                 or will be a string cartodb username otherwise.
-//
-AuthApi.prototype.authorizedBySigner = function(req, callback) {
-    if ( ! req.params.token || ! req.params.signer ) {
-        return callback(null, false); // no signer requested
-    }
-
-    var self = this;
-
-    var layergroup_id = req.params.token;
-    var auth_token = req.params.auth_token;
-
-    this.mapStore.load(layergroup_id, function(err, mapConfig) {
-        if (err) {
-            return callback(err);
-        }
-
-        var authorized = self.templateMaps.isAuthorized(mapConfig.obj().template, auth_token);
-
-        return callback(null, authorized);
-    });
-};
-
-// Check if a request is authorized by api_key
-//
-// @param user
-// @param req express request object
-// @param callback function(err, authorized)
-//        NOTE: authorized is expected to be 0 or 1 (integer)
-//
-AuthApi.prototype.authorizedByAPIKey = function(user, req, callback) {
-    var givenKey = req.query.api_key || req.query.map_key;
-    if ( ! givenKey && req.body ) {
-        // check also in request body
-        givenKey = req.body.api_key || req.body.map_key;
-    }
-    if ( ! givenKey ) {
-        return callback(null, 0); // no api key, no authorization...
-    }
-
-    var self = this;
-
-    step(
-        function () {
-            self.metadataBackend.getUserMapKey(user, this);
-        },
-        function checkApiKey(err, val){
-            assert.ifError(err);
-            return val && givenKey === val;
-        },
-        function finish(err, authorized) {
-            callback(err, authorized);
-        }
-    );
-};
-
-/**
- * Check access authorization
- *
- * @param req - standard req object. Importantly contains table and host information
- * @param callback function(err, allowed) is access allowed not?
- */
-AuthApi.prototype.authorize = function(req, callback) {
-    var self = this;
-    var user = req.context.user;
-
-    step(
-        function () {
-            self.authorizedByAPIKey(user, req, this);
-        },
-        function checkApiKey(err, authorized){
-            req.profiler.done('authorizedByAPIKey');
-            assert.ifError(err);
-
-            // if not authorized by api_key, continue
-            if (!authorized)  {
-                // not authorized by api_key, check if authorized by signer
-                return self.authorizedBySigner(req, this);
-            }
-
-            // authorized by api key, login as the given username and stop
-            self.pgConnection.setDBAuth(user, req.params, function(err) {
-                callback(err, true); // authorized (or error)
-            });
-        },
-        function checkSignAuthorized(err, authorized) {
-            if (err) {
-                return callback(err);
-            }
-
-            if ( ! authorized ) {
-                // request not authorized by signer.
-
-                // if no signer name was given, let dbparams and
-                // PostgreSQL do the rest.
-                //
-                if ( ! req.params.signer ) {
-                    return callback(null, true); // authorized so far
-                }
-
-                // if signer name was given, return no authorization
-                return callback(null, false);
-            }
-
-            self.pgConnection.setDBAuth(user, req.params, function(err) {
-                req.profiler.done('setDBAuth');
-                callback(err, true); // authorized (or error)
-            });
-        }
-    );
-};

lib/cartodb/api/map/analyses-catalog-controller.js

@@ -0,0 +1,144 @@
+const PSQL = require('cartodb-psql');
+const cleanUpQueryParams = require('../middlewares/clean-up-query-params');
+const credentials = require('../middlewares/credentials');
+const authorize = require('../middlewares/authorize');
+const dbConnSetup = require('../middlewares/db-conn-setup');
+const rateLimit = require('../middlewares/rate-limit');
+const { RATE_LIMIT_ENDPOINTS_GROUPS } = rateLimit;
+const cacheControlHeader = require('../middlewares/cache-control-header');
+const dbParamsFromResLocals = require('../../utils/database-params');
+
+module.exports = class AnalysesController {
+    constructor (pgConnection, authBackend, userLimitsBackend) {
+        this.pgConnection = pgConnection;
+        this.authBackend = authBackend;
+        this.userLimitsBackend = userLimitsBackend;
+    }
+
+    register (mapRouter) {
+        mapRouter.get('/analyses/catalog', this.middlewares());
+    }
+
+    middlewares () {
+        return [
+            credentials(),
+            authorize(this.authBackend),
+            dbConnSetup(this.pgConnection),
+            rateLimit(this.userLimitsBackend, RATE_LIMIT_ENDPOINTS_GROUPS.ANALYSIS_CATALOG),
+            cleanUpQueryParams(),
+            createPGClient(),
+            getDataFromQuery({ queryTemplate: catalogQueryTpl, key: 'catalog' }),
+            getDataFromQuery({ queryTemplate: tablesQueryTpl, key: 'tables' }),
+            prepareResponse(),
+            cacheControlHeader({ ttl: 10, revalidate: true }),
+            unauthorizedError()
+        ];
+    }
+};
+
+function createPGClient () {
+    return function createPGClientMiddleware (req, res, next) {
+        const dbParams = dbParamsFromResLocals(res.locals);
+
+        res.locals.pg = new PSQL(dbParams);
+
+        next();
+    };
+}
+
+function getDataFromQuery({ queryTemplate, key }) {
+    const readOnlyTransactionOn = true;
+
+    return function getCatalogMiddleware(req, res, next) {
+        const { pg, user } = res.locals;
+        const sql = queryTemplate({ _username: user });
+
+        pg.query(sql, (err, resultSet = {}) => {
+            if (err) {
+                return next(err);
+            }
+
+            res.locals[key] = resultSet.rows || [];
+
+            next();
+        }, readOnlyTransactionOn);
+    };
+}
+
+function prepareResponse () {
+    return function prepareResponseMiddleware (req, res, next) {
+        const { catalog, tables } = res.locals;
+
+        const analysisIdToTable = tables.reduce((analysisIdToTable, table) => {
+            const analysisId = table.relname.split('_')[2];
+
+            if (analysisId && analysisId.length === 40) {
+                analysisIdToTable[analysisId] = table;
+            }
+
+            return analysisIdToTable;
+        }, {});
+
+        const analysisCatalog = catalog.map(analysis => {
+            if (analysisIdToTable.hasOwnProperty(analysis.node_id)) {
+                analysis.table = analysisIdToTable[analysis.node_id];
+            }
+
+            return analysis;
+        })
+        .sort((analysisA, analysisB) => {
+            if (!!analysisA.table && !!analysisB.table) {
+                return analysisB.table.size - analysisA.table.size;
+            }
+
+            if (!!analysisA.table) {
+                return -1;
+            }
+
+            if (!!analysisB.table) {
+                return 1;
+            }
+
+            return -1;
+        });
+
+        res.statusCode = 200;
+        res.body = { catalog: analysisCatalog };
+
+        next();
+    };
+}
+
+function unauthorizedError () {
+    return function unathorizedErrorMiddleware(err, req, res, next) {
+        if (err.message.match(/permission\sdenied/)) {
+            err = new Error('Unauthorized');
+            err.http_status = 401;
+        }
+
+        next(err);
+    };
+}
+
+const catalogQueryTpl = ctx => `
+    SELECT analysis_def->>'type' as type, * FROM cdb_analysis_catalog WHERE username = '${ctx._username}'
+`;
+
+var tablesQueryTpl = ctx => `
+    WITH analysis_tables AS (
+        SELECT
+            n.nspname AS nspname,
+            c.relname AS relname,
+            pg_total_relation_size(
+                format('%s.%s', pg_catalog.quote_ident(n.nspname), pg_catalog.quote_ident(c.relname))
+            ) AS size,
+            format('%s.%s', pg_catalog.quote_ident(nspname), pg_catalog.quote_ident(relname)) AS fully_qualified_name
+        FROM pg_catalog.pg_class c, pg_catalog.pg_namespace n
+        WHERE c.relnamespace = n.oid
+        AND pg_catalog.quote_ident(c.relname) ~ '^analysis_[a-z0-9]{10}_[a-z0-9]{40}$'
+        AND n.nspname IN ('${ctx._username}', 'public')
+    )
+    SELECT *, pg_size_pretty(size) as size_pretty
+    FROM analysis_tables
+    ORDER BY size DESC
+`;

lib/cartodb/api/map/analysis-layergroup-controller.js

@@ -0,0 +1,59 @@
+const layergroupToken = require('../middlewares/layergroup-token');
+const cleanUpQueryParams = require('../middlewares/clean-up-query-params');
+const credentials = require('../middlewares/credentials');
+const dbConnSetup = require('../middlewares/db-conn-setup');
+const authorize = require('../middlewares/authorize');
+const rateLimit = require('../middlewares/rate-limit');
+const { RATE_LIMIT_ENDPOINTS_GROUPS } = rateLimit;
+const dbParamsFromResLocals = require('../../utils/database-params');
+
+module.exports = class AnalysisLayergroupController {
+    constructor (analysisStatusBackend, pgConnection, userLimitsBackend, authBackend) {
+        this.analysisStatusBackend = analysisStatusBackend;
+        this.pgConnection = pgConnection;
+        this.userLimitsBackend = userLimitsBackend;
+        this.authBackend = authBackend;
+    }
+
+    register (mapRouter) {
+        mapRouter.get('/:token/analysis/node/:nodeId', this.middlewares());
+    }
+
+    middlewares () {
+        return [
+            layergroupToken(),
+            credentials(),
+            authorize(this.authBackend),
+            dbConnSetup(this.pgConnection),
+            rateLimit(this.userLimitsBackend, RATE_LIMIT_ENDPOINTS_GROUPS.ANALYSIS),
+            cleanUpQueryParams(),
+            analysisNodeStatus(this.analysisStatusBackend)
+        ];
+    }
+};
+
+function analysisNodeStatus (analysisStatusBackend) {
+    return function analysisNodeStatusMiddleware(req, res, next) {
+        const { nodeId } = req.params;
+        const dbParams = dbParamsFromResLocals(res.locals);
+
+        analysisStatusBackend.getNodeStatus(nodeId, dbParams, (err, nodeStatus, stats = {}) => {
+            req.profiler.add(stats);
+
+            if (err) {
+                err.label = 'GET NODE STATUS';
+                return next(err);
+            }
+
+            res.set({
+                'Cache-Control': 'public,max-age=5',
+                'Last-Modified': new Date().toUTCString()
+            });
+
+            res.statusCode = 200;
+            res.body = nodeStatus;
+
+            next();
+        });
+    };
+}

lib/cartodb/api/map/anonymous-map-controller.js

@@ -0,0 +1,213 @@
+const windshaft = require('windshaft');
+const MapConfig = windshaft.model.MapConfig;
+const Datasource = windshaft.model.Datasource;
+const cleanUpQueryParams = require('../middlewares/clean-up-query-params');
+const credentials = require('../middlewares/credentials');
+const dbConnSetup = require('../middlewares/db-conn-setup');
+const authorize = require('../middlewares/authorize');
+const initProfiler = require('../middlewares/init-profiler');
+const checkJsonContentType = require('../middlewares/check-json-content-type');
+const incrementMapViewCount = require('../middlewares/increment-map-view-count');
+const augmentLayergroupData = require('../middlewares/augment-layergroup-data');
+const cacheControlHeader = require('../middlewares/cache-control-header');
+const cacheChannelHeader = require('../middlewares/cache-channel-header');
+const surrogateKeyHeader = require('../middlewares/surrogate-key-header');
+const lastModifiedHeader = require('../middlewares/last-modified-header');
+const lastUpdatedTimeLayergroup = require('../middlewares/last-updated-time-layergroup');
+const layerStats = require('../middlewares/layer-stats');
+const layergroupIdHeader = require('../middlewares/layergroup-id-header');
+const layergroupMetadata = require('../middlewares/layergroup-metadata');
+const mapError = require('../middlewares/map-error');
+const CreateLayergroupMapConfigProvider = require('../../models/mapconfig/provider/create-layergroup-provider');
+const rateLimit = require('../middlewares/rate-limit');
+const { RATE_LIMIT_ENDPOINTS_GROUPS } = rateLimit;
+
+module.exports = class AnonymousMapController {
+    /**
+     * @param {AuthBackend} authBackend
+     * @param {PgConnection} pgConnection
+     * @param {TemplateMaps} templateMaps
+     * @param {MapBackend} mapBackend
+     * @param metadataBackend
+     * @param {SurrogateKeysCache} surrogateKeysCache
+     * @param {UserLimitsBackend} userLimitsBackend
+     * @param {LayergroupAffectedTables} layergroupAffectedTables
+     * @param {MapConfigAdapter} mapConfigAdapter
+     * @param {StatsBackend} statsBackend
+     * @constructor
+     */
+    constructor (
+        pgConnection,
+        templateMaps,
+        mapBackend,
+        metadataBackend,
+        surrogateKeysCache,
+        userLimitsBackend,
+        layergroupAffectedTables,
+        mapConfigAdapter,
+        statsBackend,
+        authBackend,
+        layergroupMetadata
+    ) {
+        this.pgConnection = pgConnection;
+        this.templateMaps = templateMaps;
+        this.mapBackend = mapBackend;
+        this.metadataBackend = metadataBackend;
+        this.surrogateKeysCache = surrogateKeysCache;
+        this.userLimitsBackend = userLimitsBackend;
+        this.layergroupAffectedTables = layergroupAffectedTables;
+        this.mapConfigAdapter = mapConfigAdapter;
+        this.statsBackend = statsBackend;
+        this.authBackend = authBackend;
+        this.layergroupMetadata = layergroupMetadata;
+    }
+
+    register (mapRouter) {
+        mapRouter.options('/');
+        mapRouter.get('/', this.middlewares());
+        mapRouter.post('/', this.middlewares());
+    }
+
+    middlewares () {
+        const isTemplateInstantiation = false;
+        const useTemplateHash = false;
+        const includeQuery = true;
+        const label = 'ANONYMOUS LAYERGROUP';
+        const addContext = true;
+
+        return [
+            credentials(),
+            authorize(this.authBackend),
+            dbConnSetup(this.pgConnection),
+            rateLimit(this.userLimitsBackend, RATE_LIMIT_ENDPOINTS_GROUPS.ANONYMOUS),
+            cleanUpQueryParams(['aggregation']),
+            initProfiler(isTemplateInstantiation),
+            checkJsonContentType(),
+            checkCreateLayergroup(),
+            prepareAdapterMapConfig(this.mapConfigAdapter),
+            createLayergroup (
+                this.mapBackend,
+                this.userLimitsBackend,
+                this.pgConnection,
+                this.layergroupAffectedTables
+            ),
+            incrementMapViewCount(this.metadataBackend),
+            augmentLayergroupData(),
+            cacheControlHeader({ ttl: global.environment.varnish.layergroupTtl || 86400, revalidate: true }),
+            cacheChannelHeader(),
+            surrogateKeyHeader({ surrogateKeysCache: this.surrogateKeysCache }),
+            lastModifiedHeader(),
+            lastUpdatedTimeLayergroup(),
+            layerStats(this.pgConnection, this.statsBackend),
+            layergroupIdHeader(this.templateMaps, useTemplateHash),
+            layergroupMetadata(this.layergroupMetadata, includeQuery),
+            mapError({ label, addContext })
+        ];
+    }
+};
+
+function checkCreateLayergroup () {
+    return function checkCreateLayergroupMiddleware (req, res, next) {
+        if (req.method === 'GET') {
+            const { config } = req.query;
+
+            if (!config) {
+                return next(new Error('layergroup GET needs a "config" parameter'));
+            }
+
+            try {
+                req.body = JSON.parse(config);
+            } catch (err) {
+                return next(err);
+            }
+        }
+
+        req.profiler.done('checkCreateLayergroup');
+        return next();
+    };
+}
+
+function prepareAdapterMapConfig (mapConfigAdapter) {
+    return function prepareAdapterMapConfigMiddleware(req, res, next) {
+        const requestMapConfig = req.body;
+
+        const { user, api_key } = res.locals;
+        const { dbuser, dbname, dbpassword, dbhost, dbport } = res.locals;
+        const params = Object.assign({ dbuser, dbname, dbpassword, dbhost, dbport }, req.query);
+
+        const context = {
+            analysisConfiguration: {
+                user,
+                db: {
+                    host: dbhost,
+                    port: dbport,
+                    dbname: dbname,
+                    user: dbuser,
+                    pass: dbpassword
+                },
+                batch: {
+                    username: user,
+                    apiKey: api_key
+                }
+            }
+        };
+
+        mapConfigAdapter.getMapConfig(user, requestMapConfig, params, context, (err, requestMapConfig) => {
+            req.profiler.done('anonymous.getMapConfig');
+            if (err) {
+                return next(err);
+            }
+
+            req.body = requestMapConfig;
+            res.locals.context = context;
+
+            next();
+        });
+    };
+}
+
+function createLayergroup (mapBackend, userLimitsBackend, pgConnection, affectedTablesCache) {
+    return function createLayergroupMiddleware (req, res, next) {
+        const requestMapConfig = req.body;
+
+        const { context } = res.locals;
+        const { user, cache_buster, api_key } = res.locals;
+        const { dbuser, dbname, dbpassword, dbhost, dbport } = res.locals;
+
+        const params = {
+            cache_buster, api_key,
+            dbuser, dbname, dbpassword, dbhost, dbport
+        };
+
+        const datasource = context.datasource || Datasource.EmptyDatasource();
+        const mapConfig = new MapConfig(requestMapConfig, datasource);
+
+        const mapConfigProvider = new CreateLayergroupMapConfigProvider(
+            mapConfig,
+            user,
+            userLimitsBackend,
+            pgConnection,
+            affectedTablesCache,
+            params
+        );
+
+        res.locals.mapConfig = mapConfig;
+        res.locals.analysesResults = context.analysesResults;
+
+        const mapParams = { dbuser, dbname, dbpassword, dbhost, dbport };
+
+        mapBackend.createLayergroup(mapConfig, mapParams, mapConfigProvider, (err, layergroup, stats = {}) => {
+            req.profiler.add(stats);
+
+            if (err) {
+                return next(err);
+            }
+
+            res.statusCode = 200;
+            res.body = layergroup;
+            res.locals.mapConfigProvider = mapConfigProvider;
+
+            next();
+        });
+    };
+}

lib/cartodb/api/map/attributes-layergroup-controller.js

@@ -0,0 +1,89 @@
+const layergroupToken = require('../middlewares/layergroup-token');
+const cleanUpQueryParams = require('../middlewares/clean-up-query-params');
+const credentials = require('../middlewares/credentials');
+const dbConnSetup = require('../middlewares/db-conn-setup');
+const authorize = require('../middlewares/authorize');
+const rateLimit = require('../middlewares/rate-limit');
+const { RATE_LIMIT_ENDPOINTS_GROUPS } = rateLimit;
+const createMapStoreMapConfigProvider = require('../middlewares/map-store-map-config-provider');
+const cacheControlHeader = require('../middlewares/cache-control-header');
+const cacheChannelHeader = require('../middlewares/cache-channel-header');
+const surrogateKeyHeader = require('../middlewares/surrogate-key-header');
+const lastModifiedHeader = require('../middlewares/last-modified-header');
+
+module.exports = class AttributesLayergroupController {
+    constructor (
+        attributesBackend,
+        pgConnection,
+        mapStore,
+        userLimitsBackend,
+        layergroupAffectedTablesCache,
+        authBackend,
+        surrogateKeysCache
+    ) {
+        this.attributesBackend = attributesBackend;
+        this.pgConnection = pgConnection;
+        this.mapStore = mapStore;
+        this.userLimitsBackend = userLimitsBackend;
+        this.layergroupAffectedTablesCache = layergroupAffectedTablesCache;
+        this.authBackend = authBackend;
+        this.surrogateKeysCache = surrogateKeysCache;
+    }
+
+    register (mapRouter) {
+        mapRouter.get('/:token/:layer/attributes/:fid', this.middlewares());
+    }
+
+    middlewares () {
+        return [
+            layergroupToken(),
+            credentials(),
+            authorize(this.authBackend),
+            dbConnSetup(this.pgConnection),
+            rateLimit(this.userLimitsBackend, RATE_LIMIT_ENDPOINTS_GROUPS.ATTRIBUTES),
+            cleanUpQueryParams(),
+            createMapStoreMapConfigProvider(
+                this.mapStore,
+                this.userLimitsBackend,
+                this.pgConnection,
+                this.layergroupAffectedTablesCache
+            ),
+            getFeatureAttributes(this.attributesBackend),
+            cacheControlHeader(),
+            cacheChannelHeader(),
+            surrogateKeyHeader({ surrogateKeysCache: this.surrogateKeysCache }),
+            lastModifiedHeader()
+        ];
+    }
+};
+
+function getFeatureAttributes (attributesBackend) {
+    return function getFeatureAttributesMiddleware (req, res, next) {
+        req.profiler.start('windshaft.maplayer_attribute');
+
+        const { mapConfigProvider } = res.locals;
+        const { token } = res.locals;
+        const { dbuser, dbname, dbpassword, dbhost, dbport } = res.locals;
+        const { layer, fid } = req.params;
+
+        const params = {
+            token,
+            dbuser, dbname, dbpassword, dbhost, dbport,
+            layer, fid
+        };
+
+        attributesBackend.getFeatureAttributes(mapConfigProvider, params, false, (err, tile, stats = {}) => {
+            req.profiler.add(stats);
+
+            if (err) {
+                err.label = 'GET ATTRIBUTES';
+                return next(err);
+            }
+
+            res.statusCode = 200;
+            res.body = tile;
+
+            next();
+        });
+    };
+}

lib/cartodb/api/map/dataview-layergroup-controller.js

@@ -0,0 +1,142 @@
+const layergroupToken = require('../middlewares/layergroup-token');
+const cleanUpQueryParams = require('../middlewares/clean-up-query-params');
+const credentials = require('../middlewares/credentials');
+const dbConnSetup = require('../middlewares/db-conn-setup');
+const authorize = require('../middlewares/authorize');
+const rateLimit = require('../middlewares/rate-limit');
+const { RATE_LIMIT_ENDPOINTS_GROUPS } = rateLimit;
+const createMapStoreMapConfigProvider = require('../middlewares/map-store-map-config-provider');
+const cacheControlHeader = require('../middlewares/cache-control-header');
+const cacheChannelHeader = require('../middlewares/cache-channel-header');
+const surrogateKeyHeader = require('../middlewares/surrogate-key-header');
+const lastModifiedHeader = require('../middlewares/last-modified-header');
+
+const ALLOWED_DATAVIEW_QUERY_PARAMS = [
+    'filters', // json
+    'own_filter', // 0, 1
+    'no_filters', // 0, 1
+    'bbox', // w,s,e,n
+    'start', // number
+    'end', // number
+    'column_type', // string
+    'bins', // number
+    'aggregation', //string
+    'offset', // number
+    'q', // widgets search
+    'categories', // number
+];
+
+module.exports = class DataviewLayergroupController {
+    constructor (
+        dataviewBackend,
+        pgConnection,
+        mapStore,
+        userLimitsBackend,
+        layergroupAffectedTablesCache,
+        authBackend,
+        surrogateKeysCache
+    ) {
+        this.dataviewBackend = dataviewBackend;
+        this.pgConnection = pgConnection;
+        this.mapStore = mapStore;
+        this.userLimitsBackend = userLimitsBackend;
+        this.layergroupAffectedTablesCache = layergroupAffectedTablesCache;
+        this.authBackend = authBackend;
+        this.surrogateKeysCache = surrogateKeysCache;
+    }
+
+    register (mapRouter) {
+        // Undocumented/non-supported API endpoint methods.
+        // Use at your own peril.
+
+        mapRouter.get('/:token/dataview/:dataviewName', this.middlewares({
+            action: 'get',
+            rateLimitGroup: RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW
+        }));
+
+        mapRouter.get('/:token/:layer/widget/:dataviewName', this.middlewares({
+            action: 'get',
+            rateLimitGroup: RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW
+        }));
+
+        mapRouter.get('/:token/dataview/:dataviewName/search', this.middlewares({
+            action: 'search',
+            rateLimitGroup: RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW_SEARCH
+        }));
+
+        mapRouter.get('/:token/:layer/widget/:dataviewName/search', this.middlewares({
+            action: 'search',
+            rateLimitGroup: RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW_SEARCH
+        }));
+    }
+
+    middlewares ({ action, rateLimitGroup }) {
+        return [
+            layergroupToken(),
+            credentials(),
+            authorize(this.authBackend),
+            dbConnSetup(this.pgConnection),
+            rateLimit(this.userLimitsBackend, rateLimitGroup),
+            cleanUpQueryParams(ALLOWED_DATAVIEW_QUERY_PARAMS),
+            createMapStoreMapConfigProvider(
+                this.mapStore,
+                this.userLimitsBackend,
+                this.pgConnection,
+                this.layergroupAffectedTablesCache
+            ),
+            action === 'search' ? dataviewSearch(this.dataviewBackend) : getDataview(this.dataviewBackend),
+            cacheControlHeader(),
+            cacheChannelHeader(),
+            surrogateKeyHeader({ surrogateKeysCache: this.surrogateKeysCache }),
+            lastModifiedHeader()
+        ];
+    }
+};
+
+function getDataview (dataviewBackend) {
+    return function getDataviewMiddleware (req, res, next) {
+        const { user, mapConfigProvider } = res.locals;
+        const { dataviewName } = req.params;
+        const { dbuser, dbname, dbpassword, dbhost, dbport } = res.locals;
+
+        const params = Object.assign({ dataviewName, dbuser, dbname, dbpassword, dbhost, dbport }, req.query);
+
+        dataviewBackend.getDataview(mapConfigProvider, user, params, (err, dataview, stats = {}) => {
+            req.profiler.add(stats);
+
+            if (err) {
+                err.label = 'GET DATAVIEW';
+                return next(err);
+            }
+
+            res.statusCode = 200;
+            res.body = dataview;
+
+            next();
+        });
+    };
+}
+
+function dataviewSearch (dataviewBackend) {
+    return function dataviewSearchMiddleware (req, res, next) {
+        const { user, mapConfigProvider } = res.locals;
+        const { dataviewName } = req.params;
+        const { dbuser, dbname, dbpassword, dbhost, dbport } = res.locals;
+
+        const params = Object.assign({ dbuser, dbname, dbpassword, dbhost, dbport }, req.query);
+
+        dataviewBackend.search(mapConfigProvider, user, dataviewName, params, (err, searchResult, stats = {}) => {
+            req.profiler.add(stats);
+
+            if (err) {
+                err.label = 'GET DATAVIEW SEARCH';
+                return next(err);
+            }
+
+            res.statusCode = 200;
+            res.body = searchResult;
+
+            next();
+        });
+    };
+}

lib/cartodb/api/map/map-router.js

@@ -0,0 +1,129 @@
+const { Router: router } = require('express');
+
+const AnalysisLayergroupController = require('./analysis-layergroup-controller');
+const AttributesLayergroupController = require('./attributes-layergroup-controller');
+const DataviewLayergroupController = require('./dataview-layergroup-controller');
+const PreviewLayergroupController = require('./preview-layergroup-controller');
+const TileLayergroupController = require('./tile-layergroup-controller');
+const AnonymousMapController = require('./anonymous-map-controller');
+const PreviewTemplateController = require('./preview-template-controller');
+const AnalysesCatalogController = require('./analyses-catalog-controller');
+
+module.exports = class MapRouter {
+    constructor ({ collaborators }) {
+        const {
+            analysisStatusBackend,
+            attributesBackend,
+            dataviewBackend,
+            previewBackend,
+            tileBackend,
+            pgConnection,
+            mapStore,
+            userLimitsBackend,
+            layergroupAffectedTablesCache,
+            authBackend,
+            surrogateKeysCache,
+            templateMaps,
+            mapBackend,
+            metadataBackend,
+            mapConfigAdapter,
+            statsBackend,
+            layergroupMetadata,
+            namedMapProviderCache,
+            tablesExtentBackend
+        } = collaborators;
+
+        this.analysisLayergroupController = new AnalysisLayergroupController(
+            analysisStatusBackend,
+            pgConnection,
+            userLimitsBackend,
+            authBackend
+        );
+
+        this.attributesLayergroupController = new AttributesLayergroupController(
+            attributesBackend,
+            pgConnection,
+            mapStore,
+            userLimitsBackend,
+            layergroupAffectedTablesCache,
+            authBackend,
+            surrogateKeysCache
+        );
+
+        this.dataviewLayergroupController = new DataviewLayergroupController(
+            dataviewBackend,
+            pgConnection,
+            mapStore,
+            userLimitsBackend,
+            layergroupAffectedTablesCache,
+            authBackend,
+            surrogateKeysCache
+        );
+
+        this.previewLayergroupController = new PreviewLayergroupController(
+            previewBackend,
+            pgConnection,
+            mapStore,
+            userLimitsBackend,
+            layergroupAffectedTablesCache,
+            authBackend,
+            surrogateKeysCache
+        );
+
+        this.tileLayergroupController = new TileLayergroupController(
+            tileBackend,
+            pgConnection,
+            mapStore,
+            userLimitsBackend,
+            layergroupAffectedTablesCache,
+            authBackend,
+            surrogateKeysCache
+        );
+
+        this.anonymousMapController = new AnonymousMapController(
+            pgConnection,
+            templateMaps,
+            mapBackend,
+            metadataBackend,
+            surrogateKeysCache,
+            userLimitsBackend,
+            layergroupAffectedTablesCache,
+            mapConfigAdapter,
+            statsBackend,
+            authBackend,
+            layergroupMetadata
+        );
+
+        this.previewTemplateController = new PreviewTemplateController(
+            namedMapProviderCache,
+            previewBackend,
+            surrogateKeysCache,
+            tablesExtentBackend,
+            metadataBackend,
+            pgConnection,
+            authBackend,
+            userLimitsBackend
+        );
+
+        this.analysesController = new AnalysesCatalogController(
+            pgConnection,
+            authBackend,
+            userLimitsBackend
+        );
+    }
+
+    register (apiRouter, mapPaths) {
+        const mapRouter = router({ mergeParams: true });
+
+        this.analysisLayergroupController.register(mapRouter);
+        this.attributesLayergroupController.register(mapRouter);
+        this.dataviewLayergroupController.register(mapRouter);
+        this.previewLayergroupController.register(mapRouter);
+        this.tileLayergroupController.register(mapRouter);
+        this.anonymousMapController.register(mapRouter);
+        this.previewTemplateController.register(mapRouter);
+        this.analysesController.register(mapRouter);
+
+        mapPaths.forEach(path => apiRouter.use(path, mapRouter));
+    }
+};

lib/cartodb/api/map/preview-layergroup-controller.js

@@ -0,0 +1,156 @@
+const layergroupToken = require('../middlewares/layergroup-token');
+const coordinates = require('../middlewares/coordinates');
+const cleanUpQueryParams = require('../middlewares/clean-up-query-params');
+const credentials = require('../middlewares/credentials');
+const noop = require('../middlewares/noop');
+const dbConnSetup = require('../middlewares/db-conn-setup');
+const authorize = require('../middlewares/authorize');
+const rateLimit = require('../middlewares/rate-limit');
+const { RATE_LIMIT_ENDPOINTS_GROUPS } = rateLimit;
+const createMapStoreMapConfigProvider = require('../middlewares/map-store-map-config-provider');
+const cacheControlHeader = require('../middlewares/cache-control-header');
+const cacheChannelHeader = require('../middlewares/cache-channel-header');
+const surrogateKeyHeader = require('../middlewares/surrogate-key-header');
+const lastModifiedHeader = require('../middlewares/last-modified-header');
+const checkStaticImageFormat = require('../middlewares/check-static-image-format');
+
+module.exports = class PreviewLayergroupController {
+    constructor (
+        previewBackend,
+        pgConnection,
+        mapStore,
+        userLimitsBackend,
+        layergroupAffectedTablesCache,
+        authBackend,
+        surrogateKeysCache
+    ) {
+        this.previewBackend = previewBackend;
+        this.pgConnection = pgConnection;
+        this.mapStore = mapStore;
+        this.userLimitsBackend = userLimitsBackend;
+        this.layergroupAffectedTablesCache = layergroupAffectedTablesCache;
+        this.authBackend = authBackend;
+        this.surrogateKeysCache = surrogateKeysCache;
+    }
+
+    register (mapRouter) {
+        mapRouter.get('/static/center/:token/:z/:lat/:lng/:width/:height.:format', this.middlewares({
+            validateZoom: true,
+            previewType: 'centered'
+        }));
+
+        mapRouter.get('/static/bbox/:token/:west,:south,:east,:north/:width/:height.:format', this.middlewares({
+            validateZoom: false,
+            previewType: 'bbox'
+        }));
+    }
+
+    middlewares ({ validateZoom, previewType }) {
+        const forcedFormat = 'png';
+
+        let getPreviewImage;
+
+        if (previewType === 'centered') {
+            getPreviewImage = getPreviewImageByCenter;
+        }
+
+        if (previewType === 'bbox') {
+            getPreviewImage = getPreviewImageByBoundingBox;
+        }
+
+        return [
+            layergroupToken(),
+            validateZoom ? coordinates({ z: true, x: false, y: false }) : noop(),
+            credentials(),
+            authorize(this.authBackend),
+            dbConnSetup(this.pgConnection),
+            rateLimit(this.userLimitsBackend, RATE_LIMIT_ENDPOINTS_GROUPS.STATIC),
+            cleanUpQueryParams(['layer']),
+            checkStaticImageFormat(),
+            createMapStoreMapConfigProvider(
+                this.mapStore,
+                this.userLimitsBackend,
+                this.pgConnection,
+                this.layergroupAffectedTablesCache,
+                forcedFormat
+            ),
+            getPreviewImage(this.previewBackend),
+            cacheControlHeader(),
+            cacheChannelHeader(),
+            surrogateKeyHeader({ surrogateKeysCache: this.surrogateKeysCache }),
+            lastModifiedHeader()
+        ];
+    }
+};
+
+function getPreviewImageByCenter (previewBackend) {
+    return function getPreviewImageByCenterMiddleware (req, res, next) {
+        const width = +req.params.width;
+        const height = +req.params.height;
+        const zoom = +req.params.z;
+        const center = {
+            lng: +req.params.lng,
+            lat: +req.params.lat
+        };
+
+        const format = req.params.format === 'jpg' ? 'jpeg' : 'png';
+        const { mapConfigProvider: provider } = res.locals;
+
+        previewBackend.getImage(provider, format, width, height, zoom, center, (err, image, headers, stats = {}) => {
+            req.profiler.done(`render-${format}`);
+            req.profiler.add(stats);
+
+            if (err) {
+                err.label = 'STATIC_MAP';
+                return next(err);
+            }
+
+            if (headers) {
+                res.set(headers);
+            }
+
+            res.set('Content-Type', headers['Content-Type'] || `image/${format}`);
+
+            res.statusCode = 200;
+            res.body = image;
+
+            next();
+        });
+    };
+}
+
+function getPreviewImageByBoundingBox (previewBackend) {
+    return function getPreviewImageByBoundingBoxMiddleware (req, res, next) {
+        const width = +req.params.width;
+        const height = +req.params.height;
+        const bounds = {
+            west: +req.params.west,
+            north: +req.params.north,
+            east: +req.params.east,
+            south: +req.params.south
+        };
+        const format = req.params.format === 'jpg' ? 'jpeg' : 'png';
+        const { mapConfigProvider: provider } = res.locals;
+
+        previewBackend.getImage(provider, format, width, height, bounds, (err, image, headers, stats = {}) => {
+            req.profiler.done(`render-${format}`);
+            req.profiler.add(stats);
+
+            if (err) {
+                err.label = 'STATIC_MAP';
+                return next(err);
+            }
+
+            if (headers) {
+                res.set(headers);
+            }
+
+            res.set('Content-Type', headers['Content-Type'] || `image/${format}`);
+
+            res.statusCode = 200;
+            res.body = image;
+
+            next();
+        });
+    };
+}

lib/cartodb/api/map/preview-template-controller.js

@@ -0,0 +1,367 @@
+const cleanUpQueryParams = require('../middlewares/clean-up-query-params');
+const credentials = require('../middlewares/credentials');
+const dbConnSetup = require('../middlewares/db-conn-setup');
+const authorize = require('../middlewares/authorize');
+const namedMapProvider = require('../middlewares/named-map-provider');
+const cacheControlHeader = require('../middlewares/cache-control-header');
+const cacheChannelHeader = require('../middlewares/cache-channel-header');
+const surrogateKeyHeader = require('../middlewares/surrogate-key-header');
+const lastModifiedHeader = require('../middlewares/last-modified-header');
+const checkStaticImageFormat = require('../middlewares/check-static-image-format');
+const rateLimit = require('../middlewares/rate-limit');
+const { RATE_LIMIT_ENDPOINTS_GROUPS } = rateLimit;
+
+const DEFAULT_ZOOM_CENTER = {
+    zoom: 1,
+    center: {
+        lng: 0,
+        lat: 0
+    }
+};
+
+function numMapper(n) {
+    return +n;
+}
+
+module.exports = class PreviewTemplateController {
+    constructor (
+        namedMapProviderCache,
+        previewBackend,
+        surrogateKeysCache,
+        tablesExtentBackend,
+        metadataBackend,
+        pgConnection,
+        authBackend,
+        userLimitsBackend
+    ) {
+        this.namedMapProviderCache = namedMapProviderCache;
+        this.previewBackend = previewBackend;
+        this.surrogateKeysCache = surrogateKeysCache;
+        this.tablesExtentBackend = tablesExtentBackend;
+        this.metadataBackend = metadataBackend;
+        this.pgConnection = pgConnection;
+        this.authBackend = authBackend;
+        this.userLimitsBackend = userLimitsBackend;
+    }
+
+    register (mapRouter) {
+        mapRouter.get('/static/named/:template_id/:width/:height.:format', this.middlewares());
+    }
+
+    middlewares () {
+        return [
+            credentials(),
+            authorize(this.authBackend),
+            dbConnSetup(this.pgConnection),
+            rateLimit(this.userLimitsBackend, RATE_LIMIT_ENDPOINTS_GROUPS.STATIC_NAMED),
+            cleanUpQueryParams(['layer', 'zoom', 'lon', 'lat', 'bbox']),
+            checkStaticImageFormat(),
+            namedMapProvider({
+                namedMapProviderCache: this.namedMapProviderCache,
+                label: 'STATIC_VIZ_MAP', forcedFormat: 'png'
+            }),
+            getTemplate({ label: 'STATIC_VIZ_MAP' }),
+            prepareLayerFilterFromPreviewLayers({
+                namedMapProviderCache: this.namedMapProviderCache,
+                label: 'STATIC_VIZ_MAP'
+            }),
+            getStaticImageOptions({ tablesExtentBackend: this.tablesExtentBackend }),
+            getImage({ previewBackend: this.previewBackend, label: 'STATIC_VIZ_MAP' }),
+            setContentTypeHeader(),
+            incrementMapViews({ metadataBackend: this.metadataBackend }),
+            cacheControlHeader(),
+            cacheChannelHeader(),
+            surrogateKeyHeader({ surrogateKeysCache: this.surrogateKeysCache }),
+            lastModifiedHeader()
+        ];
+    }
+};
+
+function getTemplate ({ label }) {
+    return function getTemplateMiddleware (req, res, next) {
+        const { mapConfigProvider } = res.locals;
+
+        mapConfigProvider.getTemplate((err, template) => {
+            if (err) {
+                err.label = label;
+                return next(err);
+            }
+
+            res.locals.template = template;
+
+            next();
+        });
+    };
+}
+
+function prepareLayerFilterFromPreviewLayers ({ namedMapProviderCache, label }) {
+    return function prepareLayerFilterFromPreviewLayersMiddleware (req, res, next) {
+        const { template } = res.locals;
+        const { config, auth_token } = req.query;
+
+        if (!template || !template.view || !template.view.preview_layers) {
+            return next();
+        }
+
+        var previewLayers = template.view.preview_layers;
+        var layerVisibilityFilter = [];
+
+        template.layergroup.layers.forEach((layer, index) => {
+            if (previewLayers[''+index] !== false && previewLayers[layer.id] !== false) {
+                layerVisibilityFilter.push(''+index);
+            }
+        });
+
+        if (!layerVisibilityFilter.length) {
+            return next();
+        }
+
+        const { user, token, cache_buster, api_key } = res.locals;
+        const { dbuser, dbname, dbpassword, dbhost, dbport } = res.locals;
+        const { template_id, format } = req.params;
+
+        const params = {
+            user, token, cache_buster, api_key,
+            dbuser, dbname, dbpassword, dbhost, dbport,
+            template_id, format
+        };
+
+        // overwrites 'all' default filter
+        params.layer = layerVisibilityFilter.join(',');
+
+        // recreates the provider
+        namedMapProviderCache.get(user, template_id, config, auth_token, params, (err, provider) => {
+            if (err) {
+                err.label = label;
+                return next(err);
+            }
+
+            res.locals.mapConfigProvider = provider;
+
+            next();
+        });
+    };
+}
+
+function getStaticImageOptions ({ tablesExtentBackend }) {
+    return function getStaticImageOptionsMiddleware(req, res, next) {
+        const { user, mapConfigProvider, template } = res.locals;
+        const { zoom, lon, lat, bbox } = req.query;
+        const params = { zoom, lon, lat, bbox };
+
+        const imageOpts = getImageOptions(params, template);
+
+        if (imageOpts) {
+            res.locals.imageOpts = imageOpts;
+            return next();
+        }
+
+        res.locals.imageOpts = DEFAULT_ZOOM_CENTER;
+
+        mapConfigProvider.createAffectedTables((err, affectedTables) => {
+            if (err) {
+                return next();
+            }
+
+            var tables = affectedTables.tables || [];
+
+            if (tables.length === 0) {
+                return next();
+            }
+
+            tablesExtentBackend.getBounds(user, tables, (err, bounds) => {
+                if (err) {
+                    return next();
+                }
+
+                res.locals.imageOpts = bounds;
+
+                return next();
+            });
+        });
+    };
+}
+
+function getImageOptions (params, template) {
+    const { zoom, lon, lat, bbox } = params;
+
+    let imageOpts = getImageOptionsFromCoordinates(zoom, lon, lat);
+    if (imageOpts) {
+        return imageOpts;
+    }
+
+    imageOpts = getImageOptionsFromBoundingBox(bbox);
+    if (imageOpts) {
+        return imageOpts;
+    }
+
+    imageOpts = getImageOptionsFromTemplate(template, zoom);
+    if (imageOpts) {
+        return imageOpts;
+    }
+}
+
+function getImageOptionsFromCoordinates (zoom, lon, lat) {
+    if ([zoom, lon, lat].map(numMapper).every(Number.isFinite)) {
+        return {
+            zoom: zoom,
+            center: {
+                lng: lon,
+                lat: lat
+            }
+        };
+    }
+}
+
+
+function getImageOptionsFromTemplate (template, zoom) {
+    if (template.view) {
+        var zoomCenter = templateZoomCenter(template.view);
+        if (zoomCenter) {
+            if (Number.isFinite(+zoom)) {
+                zoomCenter.zoom = +zoom;
+            }
+
+            return zoomCenter;
+        }
+
+        var bounds = templateBounds(template.view);
+        if (bounds) {
+            return bounds;
+        }
+    }
+}
+
+function getImageOptionsFromBoundingBox (bbox = '') {
+    var _bbox = bbox.split(',').map(numMapper);
+
+    if (_bbox.length === 4 && _bbox.every(Number.isFinite)) {
+        return {
+            bounds: {
+                west: _bbox[0],
+                south: _bbox[1],
+                east: _bbox[2],
+                north: _bbox[3]
+            }
+        };
+    }
+}
+
+function getImage({ previewBackend, label }) {
+    return function getImageMiddleware (req, res, next) {
+        const { imageOpts, mapConfigProvider } = res.locals;
+        const { zoom, center, bounds } = imageOpts;
+
+        let { width, height } = req.params;
+
+        width = +width;
+        height = +height;
+
+        const format = req.params.format === 'jpg' ? 'jpeg' : 'png';
+
+        if (zoom !== undefined && center) {
+            return previewBackend.getImage(mapConfigProvider, format, width, height, zoom, center,
+                (err, image, headers, stats) => {
+                req.profiler.add(stats);
+
+                if (err) {
+                    err.label = label;
+                    return next(err);
+                }
+
+                if (headers) {
+                    res.set(headers);
+                }
+
+                res.statusCode = 200;
+                res.body = image;
+
+                next();
+            });
+        }
+
+        previewBackend.getImage(mapConfigProvider, format, width, height, bounds, (err, image, headers, stats) => {
+            req.profiler.add(stats);
+            req.profiler.done('render-' + format);
+
+            if (err) {
+                err.label = label;
+                return next(err);
+            }
+
+            if (headers) {
+                res.set(headers);
+            }
+
+            res.statusCode = 200;
+            res.body = image;
+
+            next();
+        });
+    };
+}
+
+function setContentTypeHeader () {
+    return function setContentTypeHeaderMiddleware(req, res, next) {
+        res.set('Content-Type', res.get('content-type') || res.get('Content-Type') || 'image/png');
+
+        next();
+    };
+}
+
+function incrementMapViewsError (ctx) {
+    return `ERROR: failed to increment mapview count for user '${ctx.user}': ${ctx.err}`;
+}
+
+function incrementMapViews ({ metadataBackend }) {
+    return function incrementMapViewsMiddleware(req, res, next) {
+        const { user, mapConfigProvider } = res.locals;
+
+        mapConfigProvider.getMapConfig((err, mapConfig) => {
+            if (err) {
+                global.logger.log(incrementMapViewsError({ user, err }));
+                return next();
+            }
+
+            const statTag = mapConfig.obj().stat_tag;
+
+            metadataBackend.incMapviewCount(user, statTag, (err) => {
+                if (err) {
+                    global.logger.log(incrementMapViewsError({ user, err }));
+                }
+
+                next();
+            });
+        });
+    };
+}
+
+function templateZoomCenter(view) {
+    if (view.zoom !== undefined && view.center) {
+        return {
+            zoom: view.zoom,
+            center: view.center
+        };
+    }
+    return false;
+}
+
+function templateBounds(view) {
+    if (view.bounds) {
+        var hasAllBounds = ['west', 'south', 'east', 'north'].every(prop => Number.isFinite(view.bounds[prop]));
+
+        if (hasAllBounds) {
+            return {
+                bounds: {
+                    west: view.bounds.west,
+                    south: view.bounds.south,
+                    east: view.bounds.east,
+                    north: view.bounds.north
+                }
+            };
+        } else {
+            return false;
+        }
+    }
+    return false;
+}

lib/cartodb/api/map/tile-layergroup-controller.js

@@ -0,0 +1,170 @@
+const layergroupToken = require('../middlewares/layergroup-token');
+const coordinates = require('../middlewares/coordinates');
+const cleanUpQueryParams = require('../middlewares/clean-up-query-params');
+const credentials = require('../middlewares/credentials');
+const dbConnSetup = require('../middlewares/db-conn-setup');
+const authorize = require('../middlewares/authorize');
+const rateLimit = require('../middlewares/rate-limit');
+const { RATE_LIMIT_ENDPOINTS_GROUPS } = rateLimit;
+const createMapStoreMapConfigProvider = require('../middlewares/map-store-map-config-provider');
+const cacheControlHeader = require('../middlewares/cache-control-header');
+const cacheChannelHeader = require('../middlewares/cache-channel-header');
+const surrogateKeyHeader = require('../middlewares/surrogate-key-header');
+const lastModifiedHeader = require('../middlewares/last-modified-header');
+const vectorError = require('../middlewares/vector-error');
+
+const SUPPORTED_FORMATS = {
+    grid_json: true,
+    json_torque: true,
+    torque_json: true,
+    png: true,
+    png32: true,
+    mvt: true
+};
+
+module.exports = class TileLayergroupController {
+    constructor (
+        tileBackend,
+        pgConnection,
+        mapStore,
+        userLimitsBackend,
+        layergroupAffectedTablesCache,
+        authBackend,
+        surrogateKeysCache
+    ) {
+        this.tileBackend = tileBackend;
+        this.pgConnection = pgConnection;
+        this.mapStore = mapStore;
+        this.userLimitsBackend = userLimitsBackend;
+        this.layergroupAffectedTablesCache = layergroupAffectedTablesCache;
+        this.authBackend = authBackend;
+        this.surrogateKeysCache = surrogateKeysCache;
+    }
+
+    register (mapRouter) {
+        // REGEXP: doesn't match with `val`
+        const not = (val) => `(?!${val})([^\/]+?)`;
+
+        // Sadly the path that matches 1 also matches with 2 so we need to tell to express
+        // that performs only the middlewares of the first path that matches
+        // for that we use one array to group all paths.
+        mapRouter.get([
+            `/:token/:z/:x/:y@:scale_factor?x.:format`, // 1
+            `/:token/:z/:x/:y.:format`, // 2
+            `/:token${not('static')}/:layer/:z/:x/:y.(:format)`
+        ], this.middlewares());
+    }
+
+    middlewares () {
+        return [
+            layergroupToken(),
+            coordinates(),
+            credentials(),
+            authorize(this.authBackend),
+            dbConnSetup(this.pgConnection),
+            rateLimit(this.userLimitsBackend, RATE_LIMIT_ENDPOINTS_GROUPS.TILE),
+            cleanUpQueryParams(),
+            createMapStoreMapConfigProvider(
+                this.mapStore,
+                this.userLimitsBackend,
+                this.pgConnection,
+                this.layergroupAffectedTablesCache
+            ),
+            getTile(this.tileBackend),
+            cacheControlHeader(),
+            cacheChannelHeader(),
+            surrogateKeyHeader({ surrogateKeysCache: this.surrogateKeysCache }),
+            lastModifiedHeader(),
+            incrementSuccessMetrics(global.statsClient),
+            incrementErrorMetrics(global.statsClient),
+            tileError(),
+            vectorError()
+        ];
+    }
+};
+
+function parseFormat (format = '') {
+    const prettyFormat = format.replace('.', '_');
+    return SUPPORTED_FORMATS[prettyFormat] ? prettyFormat : 'invalid';
+}
+
+function getStatusCode(tile, format){
+    return tile.length === 0 && format === 'mvt' ? 204 : 200;
+}
+
+function getTile (tileBackend) {
+    return function getTileMiddleware (req, res, next) {
+        req.profiler.start(`windshaft.${req.params.layer ? 'maplayer_tile' : 'map_tile'}`);
+
+        const { mapConfigProvider } = res.locals;
+        const { token } = res.locals;
+        const { layer, z, x, y, format } = req.params;
+
+        const params = { token, layer, z, x, y, format };
+
+        tileBackend.getTile(mapConfigProvider, params, (err, tile, headers, stats = {}) => {
+            req.profiler.add(stats);
+
+            if (err) {
+                return next(err);
+            }
+
+            if (headers) {
+                res.set(headers);
+            }
+
+            const formatStat = parseFormat(req.params.format);
+
+            res.statusCode = getStatusCode(tile, formatStat);
+            res.body = tile;
+
+            next();
+        });
+    };
+}
+
+function incrementSuccessMetrics (statsClient) {
+    return function incrementSuccessMetricsMiddleware (req, res, next) {
+        const formatStat = parseFormat(req.params.format);
+
+        statsClient.increment('windshaft.tiles.success');
+        statsClient.increment(`windshaft.tiles.${formatStat}.success`);
+
+        next();
+    };
+}
+
+function incrementErrorMetrics (statsClient) {
+    return function incrementErrorMetricsMiddleware (err, req, res, next) {
+        const formatStat = parseFormat(req.params.format);
+
+        statsClient.increment('windshaft.tiles.error');
+        statsClient.increment(`windshaft.tiles.${formatStat}.error`);
+
+        next(err);
+    };
+}
+
+function tileError () {
+    return function tileErrorMiddleware (err, req, res, next) {
+        if (err.message === 'Tile does not exist' && req.params.format === 'mvt') {
+            res.statusCode = 204;
+            return next();
+        }
+
+        // See https://github.com/Vizzuality/Windshaft-cartodb/issues/68
+        let errMsg = err.message ? ( '' + err.message ) : ( '' + err );
+
+        // Rewrite mapnik parsing errors to start with layer number
+        const matches = errMsg.match("(.*) in style 'layer([0-9]+)'");
+
+        if (matches) {
+            errMsg = `style${matches[2]}: ${matches[1]}`;
+        }
+
+        err.message = errMsg;
+        err.label = 'TILE RENDER';
+
+        next(err);
+    };
+}

lib/cartodb/api/middlewares/augment-layergroup-data.js

@@ -0,0 +1,14 @@
+const _ = require('underscore');
+
+module.exports = function augmentLayergroupData () {
+    return function augmentLayergroupDataMiddleware (req, res, next) {
+        const layergroup = res.body;
+
+        // include in layergroup response the variables in serverMedata
+        // those variables are useful to send to the client information
+        // about how to reach this server or information about it
+        _.extend(layergroup, global.environment.serverMetadata);
+
+        next();
+    };
+};

lib/cartodb/api/middlewares/authorize.js

@@ -0,0 +1,19 @@
+module.exports = function authorize (authBackend) {
+    return function authorizeMiddleware (req, res, next) {
+        authBackend.authorize(req, res, (err, authorized) => {
+            req.profiler.done('authorize');
+
+            if (err) {
+                return next(err);
+            }
+
+            if(!authorized) {
+                err = new Error("Sorry, you are unauthorized (permission denied)");
+                err.http_status = 403;
+                return next(err);
+            }
+
+            return next();
+        });
+    };
+};

lib/cartodb/api/middlewares/cache-channel-header.js

@@ -0,0 +1,24 @@
+module.exports = function setCacheChannelHeader () {
+    return function setCacheChannelHeaderMiddleware (req, res, next) {
+        if (req.method !== 'GET') {
+            return next();
+        }
+
+        const { mapConfigProvider } = res.locals;
+
+        mapConfigProvider.getAffectedTables((err, affectedTables) => {
+            if (err) {
+                global.logger.warn('ERROR generating Cache Channel Header:', err);
+                return next();
+            }
+
+            if (!affectedTables) {
+                return next();
+            }
+
+            res.set('X-Cache-Channel', affectedTables.getCacheChannel());
+
+            next();
+        });
+    };
+};

lib/cartodb/api/middlewares/cache-control-header.js

@@ -0,0 +1,19 @@
+const ONE_YEAR_IN_SECONDS = 60 * 60 * 24 * 365;
+
+module.exports = function setCacheControlHeader ({ ttl = ONE_YEAR_IN_SECONDS, revalidate = false } = {}) {
+    return function setCacheControlHeaderMiddleware (req, res, next) {
+        if (req.method !== 'GET') {
+            return next();
+        }
+
+        const directives = [ 'public', `max-age=${ttl}` ];
+
+        if (revalidate) {
+            directives.push('must-revalidate');
+        }
+
+        res.set('Cache-Control', directives.join(','));
+
+        next();
+    };
+};

lib/cartodb/api/middlewares/check-json-content-type.js

@@ -0,0 +1,11 @@
+module.exports = function checkJsonContentType () {
+    return function checkJsonContentTypeMiddleware(req, res, next) {
+        if (req.method === 'POST' && !req.is('application/json')) {
+            return next(new Error('POST data must be of type application/json'));
+        }
+
+        req.profiler.done('checkJsonContentTypeMiddleware');
+
+        next();
+    };
+};

lib/cartodb/api/middlewares/check-static-image-format.js

@@ -0,0 +1,11 @@
+const VALID_IMAGE_FORMATS = ['png', 'jpg'];
+
+module.exports = function checkStaticImageFormat () {
+    return function checkStaticImageFormatMiddleware (req, res, next) {
+        if(!VALID_IMAGE_FORMATS.includes(req.params.format)) {
+            return next(new Error(`Unsupported image format "${req.params.format}"`));
+        }
+
+        next();
+    };
+};

lib/cartodb/api/middlewares/clean-up-query-params.js

@@ -0,0 +1,29 @@
+const _ = require('underscore');
+
+// Whitelist query parameters and attach format
+const REQUEST_QUERY_PARAMS_WHITELIST = [
+    'config',
+    'map_key',
+    'api_key',
+    'auth_token',
+    'callback',
+    'zoom',
+    'lon',
+    'lat',
+    // analysis
+    'filters' // json
+];
+
+module.exports = function cleanUpQueryParamsMiddleware (customQueryParams = []) {
+    if (!Array.isArray(customQueryParams)) {
+        throw new Error('customQueryParams must receive an Array of params');
+    }
+
+    return function cleanUpQueryParams (req, res, next) {
+        const allowedQueryParams = [...REQUEST_QUERY_PARAMS_WHITELIST, ...customQueryParams];
+
+        req.query = _.pick(req.query, allowedQueryParams);
+
+        next();
+    };
+};

lib/cartodb/api/middlewares/coordinates.js

@@ -0,0 +1,41 @@
+const positiveIntegerNumberRegExp = /^\d+$/;
+const integerNumberRegExp = /^-?\d+$/;
+const invalidZoomMessage = function (zoom) {
+    return `Invalid zoom value (${zoom}). It should be an integer number greather than or equal to 0`;
+};
+const invalidCoordXMessage = function (x) {
+    return `Invalid coodinate 'x' value (${x}). It should be an integer number`;
+};
+const invalidCoordYMessage = function (y) {
+    return `Invalid coodinate 'y' value (${y}). It should be an integer number greather than or equal to 0`;
+};
+
+module.exports = function coordinates (validate = { z: true, x: true, y: true }) {
+    return function coordinatesMiddleware (req, res, next) {
+        const { z, x, y } = req.params;
+
+        if (validate.z && !positiveIntegerNumberRegExp.test(z)) {
+            const err = new Error(invalidZoomMessage(z));
+            err.http_status = 400;
+
+            return next(err);
+        }
+
+        // Negative values for x param are valid. The x param is wrapped
+        if (validate.x && !integerNumberRegExp.test(x)) {
+            const err = new Error(invalidCoordXMessage(x));
+            err.http_status = 400;
+
+            return next(err);
+        }
+
+        if (validate.y && !positiveIntegerNumberRegExp.test(y)) {
+            const err = new Error(invalidCoordYMessage(y));
+            err.http_status = 400;
+
+            return next(err);
+        }
+
+        next();
+    };
+};

lib/cartodb/api/middlewares/cors.js

@@ -0,0 +1,18 @@
+module.exports = function cors () {
+    return function corsMiddleware (req, res, next) {
+        const headers = [
+            'X-Requested-With',
+            'X-Prototype-Version',
+            'X-CSRF-Token'
+        ];
+
+        if (req.method === 'OPTIONS') {
+            headers.push('Content-Type');
+        }
+
+        res.set("Access-Control-Allow-Origin", "*");
+        res.set("Access-Control-Allow-Headers", headers.join(', '));
+
+        next();
+    };
+};

lib/cartodb/api/middlewares/credentials.js

@@ -0,0 +1,85 @@
+const basicAuth = require('basic-auth');
+
+module.exports = function credentials () {
+    return function credentialsMiddleware(req, res, next) {
+        const apikeyCredentials = getApikeyCredentialsFromRequest(req);
+
+        res.locals.api_key = apikeyCredentials.token;
+        res.locals.basicAuthUsername = apikeyCredentials.username;
+        res.set('vary', 'Authorization'); //Honor Authorization header when caching.
+
+        return next();
+    };
+};
+
+function getApikeyCredentialsFromRequest(req) {
+    let apikeyCredentials = {
+        token: null,
+        username: null,
+    };
+
+    for (let getter of apikeyGetters) {
+        apikeyCredentials = getter(req);
+        if (apikeyTokenFound(apikeyCredentials)) {
+            break;
+        }
+    }
+
+    return apikeyCredentials;
+}
+
+const apikeyGetters = [
+    getApikeyTokenFromHeaderAuthorization,
+    getApikeyTokenFromRequestQueryString,
+    getApikeyTokenFromRequestBody,
+];
+
+function getApikeyTokenFromHeaderAuthorization(req) {
+    const credentials = basicAuth(req);
+
+    if (credentials) {
+        return {
+            username: credentials.username,
+            token: credentials.pass
+        };
+    } else {
+        return {
+            username: null,
+            token: null,
+        };
+    }
+}
+
+function getApikeyTokenFromRequestQueryString(req) {
+    let token = null;
+
+    if (req.query && req.query.api_key) {
+        token = req.query.api_key;
+    } else if (req.query && req.query.map_key) {
+        token = req.query.map_key;
+    }
+
+    return {
+        username: null,
+        token: token,
+    };
+}
+
+function getApikeyTokenFromRequestBody(req) {
+    let token = null;
+
+    if (req.body && req.body.api_key) {
+        token = req.body.api_key;
+    } else if (req.body && req.body.map_key) {
+        token = req.body.map_key;
+    }
+
+    return {
+        username: null,
+        token: token,
+    };
+}
+
+function apikeyTokenFound(apikey) {
+    return !!apikey && !!apikey.token;
+}

lib/cartodb/api/middlewares/db-conn-setup.js

@@ -0,0 +1,30 @@
+const _ = require('underscore');
+
+module.exports = function dbConnSetup (pgConnection) {
+    return function dbConnSetupMiddleware (req, res, next) {
+        const { user } = res.locals;
+
+        pgConnection.setDBConn(user, res.locals, (err) => {
+            req.profiler.done('dbConnSetup');
+
+            if (err) {
+                if (err.message && -1 !== err.message.indexOf('name not found')) {
+                    err.http_status = 404;
+                }
+
+                return next(err);
+            }
+
+            _.defaults(res.locals, {
+                dbuser: global.environment.postgres.user,
+                dbpassword: global.environment.postgres.password,
+                dbhost: global.environment.postgres.host,
+                dbport: global.environment.postgres.port
+            });
+
+            res.set('X-Served-By-DB-Host', res.locals.dbhost);
+
+            next();
+        });
+    };
+};

lib/cartodb/api/middlewares/error-middleware.js

@@ -0,0 +1,222 @@
+const _ = require('underscore');
+const debug = require('debug')('windshaft:cartodb:error-middleware');
+
+module.exports = function errorMiddleware (/* options */) {
+    return function error (err, req, res, next) {
+        // jshint unused:false
+        // jshint maxcomplexity:9
+        var allErrors = Array.isArray(err) ? err : [err];
+
+        allErrors = populateTimeoutErrors(allErrors);
+
+        const label = err.label || 'UNKNOWN';
+        err = allErrors[0] || new Error(label);
+        allErrors[0] = err;
+
+        var statusCode = findStatusCode(err);
+
+        setErrorHeader(allErrors, statusCode, res);
+        debug('[%s ERROR] -- %d: %s, %s', label, statusCode, err, err.stack);
+
+        // If a callback was requested, force status to 200
+        if (req.query && req.query.callback) {
+            statusCode = 200;
+        }
+
+        var errorResponseBody = {
+            errors: allErrors.map(errorMessage),
+            errors_with_context: allErrors.map(errorMessageWithContext)
+        };
+
+        res.status(statusCode);
+
+        if (req.query && req.query.callback) {
+            res.jsonp(errorResponseBody);
+        } else {
+            res.json(errorResponseBody);
+        }
+    };
+};
+
+function isRenderTimeoutError (err) {
+    return err.message === 'Render timed out';
+}
+
+function isDatasourceTimeoutError (err) {
+    return err.message && err.message.match(/canceling statement due to statement timeout/i);
+}
+
+function isTimeoutError (errorTypes) {
+    return errorTypes.renderTimeoutError || errorTypes.datasourceTimeoutError;
+}
+
+function getErrorTypes(error) {
+    return {
+        renderTimeoutError: isRenderTimeoutError(error),
+        datasourceTimeoutError: isDatasourceTimeoutError(error),
+    };
+}
+
+function populateTimeoutErrors (errors) {
+    return errors.map(function (error) {
+        const errorTypes = getErrorTypes(error);
+
+        if (isTimeoutError(errorTypes)) {
+            error.message = 'You are over platform\'s limits. Please contact us to know more details';
+            error.type = 'limit';
+            error.http_status = 429;
+        }
+
+        if (errorTypes.datasourceTimeoutError) {
+            error.subtype = 'datasource';
+            error.message = 'You are over platform\'s limits: SQL query timeout error.' +
+                ' Refactor your query before running again or contact CARTO support for more details.';
+        }
+
+        if (errorTypes.renderTimeoutError) {
+            error.subtype = 'render';
+            error.message = 'You are over platform\'s limits: Render timeout error.' +
+                ' Contact CARTO support for more details.';
+        }
+
+        return error;
+    });
+}
+
+function findStatusCode(err) {
+    var statusCode;
+    if ( err.http_status ) {
+        statusCode = err.http_status;
+    } else {
+        statusCode = statusFromErrorMessage('' + err);
+    }
+    return statusCode;
+}
+
+module.exports.findStatusCode = findStatusCode;
+
+function statusFromErrorMessage(errMsg) {
+    // Find an appropriate statusCode based on message
+    // jshint maxcomplexity:7
+    var statusCode = 400;
+    if ( -1 !== errMsg.indexOf('permission denied') ) {
+        statusCode = 403;
+    }
+    else if ( -1 !== errMsg.indexOf('authentication failed') ) {
+        statusCode = 403;
+    }
+    else if (errMsg.match(/Postgis Plugin.*[\s|\n].*column.*does not exist/)) {
+        statusCode = 400;
+    }
+    else if ( -1 !== errMsg.indexOf('does not exist') ) {
+        if ( -1 !== errMsg.indexOf(' role ') ) {
+            statusCode = 403; // role 'xxx' does not exist
+        } else if ( errMsg.match(/function .* does not exist/) ) {
+            statusCode = 400; // invalid SQL (SQL function does not exist)
+        } else {
+            statusCode = 404;
+        }
+    }
+
+
+    return statusCode;
+}
+
+function errorMessage(err) {
+    // See https://github.com/Vizzuality/Windshaft-cartodb/issues/68
+    var message = (_.isString(err) ? err : err.message) || 'Unknown error';
+
+    return stripConnectionInfo(message);
+}
+
+module.exports.errorMessage = errorMessage;
+
+function stripConnectionInfo(message) {
+    // Strip connection info, if any
+    return message
+        // See https://github.com/CartoDB/Windshaft/issues/173
+        .replace(/Connection string: '[^']*'\n\s/im, '')
+        // See https://travis-ci.org/CartoDB/Windshaft/jobs/20703062#L1644
+        .replace(/is the server.*encountered/im, 'encountered');
+}
+
+var ERROR_INFO_TO_EXPOSE = {
+    message: true,
+    layer: true,
+    type: true,
+    analysis: true,
+    subtype: true
+};
+
+function shouldBeExposed (prop) {
+    return !!ERROR_INFO_TO_EXPOSE[prop];
+}
+
+function errorMessageWithContext(err) {
+    // See https://github.com/Vizzuality/Windshaft-cartodb/issues/68
+    var message = (_.isString(err) ? err : err.message) || 'Unknown error';
+
+    var error = {
+        type: err.type || 'unknown',
+        message: stripConnectionInfo(message),
+    };
+
+    for (var prop in err) {
+        // type & message are properties from Error's prototype and will be skipped
+        if (err.hasOwnProperty(prop) && shouldBeExposed(prop)) {
+            error[prop] = err[prop];
+        }
+    }
+
+    return error;
+}
+
+function setErrorHeader(errors, statusCode, res) {
+    let errorsCopy = errors.slice(0);
+    const mainError = errorsCopy.shift();
+
+    let errorsLog = {
+        mainError: {
+            statusCode: statusCode || 200,
+            message:    mainError.message,
+            name:       mainError.name,
+            label:      mainError.label,
+            type:       mainError.type,
+            subtype:    mainError.subtype
+        }
+    };
+
+    errorsLog.moreErrors = errorsCopy.map(error => {
+        return {
+            message: error.message,
+            name:    error.name,
+            label:   error.label,
+            type:    error.type,
+            subtype: error.subtype
+        };
+    });
+
+    res.set('X-Tiler-Errors', stringifyForLogs(errorsLog));
+}
+
+/**
+ * Remove problematic nested characters
+ * from object for logs RegEx
+ *
+ * @param {Object} object
+ */
+function stringifyForLogs(object) {
+    Object.keys(object).map(key => {
+        if(typeof object[key] === 'string') {
+            object[key] = object[key].replace(/[^a-zA-Z0-9]/g, ' ');
+        } else if (typeof object[key] === 'object') {
+            stringifyForLogs(object[key]);
+        } else if (object[key] instanceof Array) {
+            for (let element of object[key]) {
+                stringifyForLogs(element);
+            }
+        }
+    });
+
+    return JSON.stringify(object);
+}

lib/cartodb/api/middlewares/increment-map-view-count.js

@@ -0,0 +1,16 @@
+module.exports = function incrementMapViewCount (metadataBackend) {
+    return function incrementMapViewCountMiddleware(req, res, next) {
+        const { mapConfig, user } = res.locals;
+
+        // Error won't blow up, just be logged.
+        metadataBackend.incMapviewCount(user, mapConfig.obj().stat_tag, (err) => {
+            req.profiler.done('incMapviewCount');
+
+            if (err) {
+                global.logger.log(`ERROR: failed to increment mapview count for user '${user}': ${err.message}`);
+            }
+
+            next();
+        });
+    };
+};

lib/cartodb/api/middlewares/init-profiler.js

@@ -0,0 +1,9 @@
+module.exports = function initProfiler (isTemplateInstantiation) {
+    const operation = isTemplateInstantiation ? 'instance_template' : 'createmap';
+
+    return function initProfilerMiddleware (req, res, next) {
+        req.profiler.start(`windshaft-cartodb.${operation}_${req.method.toLowerCase()}`);
+        req.profiler.done(`${operation}.initProfilerMiddleware`);
+        next();
+    };
+};

lib/cartodb/api/middlewares/initialize-status-code.js

@@ -0,0 +1,9 @@
+module.exports = function initializeStatusCode () {
+    return function initializeStatusCodeMiddleware (req, res, next) {
+        if (req.method !== 'OPTIONS') {
+            res.statusCode = 404;
+        }
+
+        next();
+    };
+};

lib/cartodb/api/middlewares/last-modified-header.js

@@ -0,0 +1,38 @@
+module.exports = function setLastModifiedHeader () {
+    return function setLastModifiedHeaderMiddleware(req, res, next) {
+        if (req.method !== 'GET') {
+            return next();
+        }
+
+        const { mapConfigProvider, cache_buster } = res.locals;
+
+        if (cache_buster) {
+            const cacheBuster = parseInt(cache_buster, 10);
+            const lastModifiedDate = Number.isFinite(cacheBuster) ? new Date(cacheBuster) : new Date();
+
+            res.set('Last-Modified', lastModifiedDate.toUTCString());
+
+            return next();
+        }
+
+        mapConfigProvider.getAffectedTables((err, affectedTables) => {
+            if (err) {
+                global.logger.warn('ERROR generating Last Modified Header:', err);
+                return next();
+            }
+
+            if (!affectedTables) {
+                res.set('Last-Modified', new Date().toUTCString());
+
+                return next();
+            }
+
+            const lastUpdatedAt = affectedTables.getLastUpdatedAt();
+            const lastModifiedDate = Number.isFinite(lastUpdatedAt) ? new Date(lastUpdatedAt) : new Date();
+
+            res.set('Last-Modified', lastModifiedDate.toUTCString());
+
+            next();
+        });
+    };
+};

lib/cartodb/api/middlewares/last-updated-time-layergroup.js

@@ -0,0 +1,39 @@
+module.exports = function setLastUpdatedTimeToLayergroup () {
+    return function setLastUpdatedTimeToLayergroupMiddleware (req, res, next) {
+        const { mapConfigProvider, analysesResults } = res.locals;
+        const layergroup = res.body;
+
+        mapConfigProvider.createAffectedTables((err, affectedTables) => {
+            if (err) {
+                return next(err);
+            }
+
+            if (!affectedTables) {
+                return next();
+            }
+
+            var lastUpdateTime = affectedTables.getLastUpdatedAt();
+
+            lastUpdateTime = getLastUpdatedTime(analysesResults, lastUpdateTime) || lastUpdateTime;
+
+            // last update for layergroup cache buster
+            layergroup.layergroupid = layergroup.layergroupid + ':' + lastUpdateTime;
+            layergroup.last_updated = new Date(lastUpdateTime).toISOString();
+
+            next();
+        });
+    };
+};
+
+function getLastUpdatedTime(analysesResults, lastUpdateTime) {
+    if (!Array.isArray(analysesResults)) {
+        return lastUpdateTime;
+    }
+    return analysesResults.reduce(function(lastUpdateTime, analysis) {
+        return analysis.getNodes().reduce(function(lastNodeUpdatedAtTime, node) {
+            var nodeUpdatedAtDate = node.getUpdatedAt();
+            var nodeUpdatedTimeAt = (nodeUpdatedAtDate && nodeUpdatedAtDate.getTime()) || 0;
+            return nodeUpdatedTimeAt > lastNodeUpdatedAtTime ? nodeUpdatedTimeAt : lastNodeUpdatedAtTime;
+        }, lastUpdateTime);
+    }, lastUpdateTime);
+}

lib/cartodb/api/middlewares/layer-stats.js

@@ -0,0 +1,26 @@
+module.exports = function setLayerStats (pgConnection, statsBackend) {
+    return function setLayerStatsMiddleware(req, res, next) {
+        const { user, mapConfig } = res.locals;
+        const layergroup = res.body;
+
+        pgConnection.getConnection(user, (err, connection) => {
+            if (err) {
+                return next(err);
+            }
+
+            statsBackend.getStats(mapConfig, connection, function(err, layersStats) {
+                if (err) {
+                    return next(err);
+                }
+
+                if (layersStats.length > 0) {
+                    layergroup.metadata.layers.forEach(function (layer, index) {
+                        layer.meta.stats = layersStats[index];
+                    });
+                }
+
+                next();
+            });
+        });
+    };
+};

lib/cartodb/api/middlewares/layergroup-id-header.js

@@ -0,0 +1,15 @@
+module.exports = function setLayergroupIdHeader (templateMaps, useTemplateHash) {
+    return function setLayergroupIdHeaderMiddleware (req, res, next) {
+        const { user, template } = res.locals;
+        const layergroup = res.body;
+
+        if (useTemplateHash) {
+            var templateHash = templateMaps.fingerPrint(template).substring(0, 8);
+            layergroup.layergroupid = `${user}@${templateHash}@${layergroup.layergroupid}`;
+        }
+
+        res.set('X-Layergroup-Id', layergroup.layergroupid);
+
+        next();
+    };
+};

lib/cartodb/api/middlewares/layergroup-metadata.js

@@ -0,0 +1,15 @@
+module.exports = function setMetadataToLayergroup (layergroupMetadata, includeQuery) {
+    return function setMetadataToLayergroupMiddleware (req, res, next) {
+        const { user, mapConfig, analysesResults = [], context, api_key: userApiKey } = res.locals;
+        const layergroup = res.body;
+
+        layergroupMetadata.addDataviewsAndWidgetsUrls(user, layergroup, mapConfig.obj());
+        layergroupMetadata.addAnalysesMetadata(user, layergroup, analysesResults, includeQuery);
+        layergroupMetadata.addTurboCartoContextMetadata(layergroup, mapConfig.obj(), context);
+        layergroupMetadata.addAggregationContextMetadata(layergroup, mapConfig.obj(), context);
+        layergroupMetadata.addDateWrappingMetadata (layergroup, mapConfig.obj());
+        layergroupMetadata.addTileJsonMetadata(layergroup, user, mapConfig, userApiKey);
+
+        next();
+    };
+};

lib/cartodb/api/middlewares/layergroup-token.js

@@ -0,0 +1,28 @@
+const LayergroupToken = require('../../models/layergroup-token');
+const authErrorMessageTemplate = function (signer, user) {
+    return `Cannot use map signature of user "${signer}" on db of user "${user}"`;
+};
+
+module.exports = function layergroupToken () {
+    return function layergroupTokenMiddleware (req, res, next) {
+        const user = res.locals.user;
+        const layergroupToken = LayergroupToken.parse(req.params.token);
+
+        res.locals.token = layergroupToken.token;
+        res.locals.cache_buster = layergroupToken.cacheBuster;
+
+        if (layergroupToken.signer) {
+            res.locals.signer = layergroupToken.signer;
+
+            if (res.locals.signer !== user) {
+                const err = new Error(authErrorMessageTemplate(res.locals.signer, user));
+                err.type = 'auth';
+                err.http_status = (req.query && req.query.callback) ? 200: 403;
+
+                return next(err);
+            }
+        }
+
+        return next();
+    };
+};

lib/cartodb/api/middlewares/logger.js

@@ -0,0 +1,22 @@
+module.exports = function logger (options) {
+    if (!global.log4js || !options.log_format) {
+        return function dummyLoggerMiddleware (req, res, next) {
+            next();
+        };
+    }
+
+    const opts = {
+        level: 'info',
+        // Allowing for unbuffered logging is mainly
+        // used to avoid hanging during unit testing.
+        // TODO: provide an explicit teardown function instead,
+        //       releasing any event handler or timer set by
+        //       this component.
+        buffer: !options.unbuffered_logging,
+        // optional log format
+        format: options.log_format
+    };
+    const logger = global.log4js.getLogger();
+
+    return global.log4js.connectLogger(logger, opts);
+};

lib/cartodb/api/middlewares/lzma.js

@@ -0,0 +1,33 @@
+const LZMA = require('lzma').LZMA;
+
+module.exports = function lzma () {
+    const lzmaWorker = new LZMA();
+
+    return function lzmaMiddleware (req, res, next) {
+        if (!req.query.hasOwnProperty('lzma')) {
+            return next();
+        }
+
+        // Decode (from base64)
+        var lzma = new Buffer(req.query.lzma, 'base64')
+            .toString('binary')
+            .split('')
+            .map(function(c) {
+                return c.charCodeAt(0) - 128;
+            });
+
+        // Decompress
+        lzmaWorker.decompress(lzma, function(result) {
+            try {
+                delete req.query.lzma;
+                Object.assign(req.query, JSON.parse(result));
+
+                req.profiler.done('lzma');
+
+                next();
+            } catch (err) {
+                next(new Error('Error parsing lzma as JSON: ' + err));
+            }
+        });
+    };
+};

lib/cartodb/api/middlewares/map-error.js

@@ -0,0 +1,35 @@
+module.exports = function mapError (options) {
+    const { addContext = false, label = 'MAPS CONTROLLER' } = options;
+
+    return function mapErrorMiddleware (err, req, res, next) {
+        req.profiler.done('error');
+        const { mapConfig } = res.locals;
+
+        if (addContext) {
+            err = Number.isFinite(err.layerIndex) ? populateError(err, mapConfig) : err;
+        }
+
+        err.label = label;
+
+        next(err);
+    };
+};
+
+function populateError(err, mapConfig) {
+    var error = new Error(err.message);
+    error.http_status = err.http_status;
+
+    if (!err.http_status && err.message.indexOf('column "the_geom_webmercator" does not exist') >= 0) {
+        error.http_status = 400;
+    }
+
+    error.type = 'layer';
+    error.subtype = err.message.indexOf('Postgis Plugin') >= 0 ? 'query' : undefined;
+    error.layer = {
+        id: mapConfig.getLayerId(err.layerIndex),
+        index: err.layerIndex,
+        type: mapConfig.layerType(err.layerIndex)
+    };
+
+    return error;
+}

lib/cartodb/api/middlewares/map-store-map-config-provider.js

@@ -0,0 +1,38 @@
+const MapStoreMapConfigProvider = require('../../models/mapconfig/provider/map-store-provider');
+
+module.exports = function createMapStoreMapConfigProvider (
+    mapStore,
+    userLimitsBackend,
+    pgConnection,
+    affectedTablesCache,
+    forcedFormat = null
+) {
+    return function createMapStoreMapConfigProviderMiddleware (req, res, next) {
+        const { user, token, cache_buster, api_key } = res.locals;
+        const { dbuser, dbname, dbpassword, dbhost, dbport } = res.locals;
+        const { layer: layerFromParams, z, x, y, scale_factor, format } = req.params;
+        const { layer: layerFromQuery } = req.query;
+
+        const params = {
+            user, token, cache_buster, api_key,
+            dbuser, dbname, dbpassword, dbhost, dbport,
+            layer: (layerFromQuery || layerFromParams), z, x, y, scale_factor, format
+        };
+
+        if (forcedFormat) {
+            params.format = forcedFormat;
+            params.layer = params.layer || 'all';
+        }
+
+        res.locals.mapConfigProvider = new MapStoreMapConfigProvider(
+            mapStore,
+            user,
+            userLimitsBackend,
+            pgConnection,
+            affectedTablesCache,
+            params
+        );
+
+        next();
+    };
+};

lib/cartodb/api/middlewares/named-map-provider.js

@@ -0,0 +1,32 @@
+module.exports = function getNamedMapProvider ({ namedMapProviderCache, label, forcedFormat = null }) {
+    return function getNamedMapProviderMiddleware (req, res, next) {
+        const { user, token, cache_buster, api_key } = res.locals;
+        const { dbuser, dbname, dbpassword, dbhost, dbport } = res.locals;
+        const { template_id, layer: layerFromParams, z, x, y, format } = req.params;
+        const { layer: layerFromQuery } = req.query;
+
+        const params = {
+            user, token, cache_buster, api_key,
+            dbuser, dbname, dbpassword, dbhost, dbport,
+            template_id, layer: (layerFromQuery || layerFromParams), z, x, y, format
+        };
+
+        if (forcedFormat) {
+            params.format = forcedFormat;
+            params.layer = params.layer || 'all';
+        }
+
+        const { config, auth_token } = req.query;
+
+        namedMapProviderCache.get(user, template_id, config, auth_token, params, (err, namedMapProvider) => {
+            if (err) {
+                err.label = label;
+                return next(err);
+            }
+
+            res.locals.mapConfigProvider = namedMapProvider;
+
+            next();
+        });
+    };
+};

lib/cartodb/api/middlewares/noop.js

@@ -0,0 +1,5 @@
+module.exports = function noop () {
+    return function noopMiddleware (req, res, next) {
+        next();
+    };
+};

lib/cartodb/api/middlewares/rate-limit.js

@@ -0,0 +1,72 @@
+'use strict';
+
+const RATE_LIMIT_ENDPOINTS_GROUPS = {
+    ANONYMOUS: 'anonymous',
+    STATIC: 'static',
+    STATIC_NAMED: 'static_named',
+    DATAVIEW: 'dataview',
+    DATAVIEW_SEARCH: 'dataview_search',
+    ANALYSIS: 'analysis',
+    ANALYSIS_CATALOG: 'analysis_catalog',
+    TILE: 'tile',
+    ATTRIBUTES: 'attributes',
+    NAMED_LIST: 'named_list',
+    NAMED_CREATE: 'named_create',
+    NAMED_GET: 'named_get',
+    NAMED: 'named',
+    NAMED_UPDATE: 'named_update',
+    NAMED_DELETE: 'named_delete',
+    NAMED_TILES: 'named_tiles'
+};
+
+function rateLimit(userLimitsBackend, endpointGroup = null) {
+    if (!isRateLimitEnabled(endpointGroup)) {
+        return function rateLimitDisabledMiddleware(req, res, next) { next(); };
+    }
+
+    return function rateLimitMiddleware(req, res, next) {
+        userLimitsBackend.getRateLimit(res.locals.user, endpointGroup, function (err, userRateLimit) {
+            if (err) {
+                return next(err);
+            }
+
+            if (!userRateLimit) {
+                return next();
+            }
+
+            const [isBlocked, limit, remaining, retry, reset] = userRateLimit;
+
+            res.set({
+                'Carto-Rate-Limit-Limit': limit,
+                'Carto-Rate-Limit-Remaining': remaining,
+                'Carto-Rate-Limit-Reset': reset
+            });
+
+            if (isBlocked) {
+                // retry is floor rounded in seconds by redis-cell
+                res.set('Retry-After', retry + 1);
+
+                let rateLimitError = new Error(
+                    'You are over platform\'s limits: too many requests.' +
+                    ' Please contact us to know more details'
+                );
+                rateLimitError.http_status = 429;
+                rateLimitError.type = 'limit';
+                rateLimitError.subtype = 'rate-limit';
+                return next(rateLimitError);
+            }
+
+            return next();
+        });
+    };
+}
+
+
+function isRateLimitEnabled(endpointGroup) {
+    return global.environment.enabledFeatures.rateLimitsEnabled &&
+        endpointGroup &&
+        global.environment.enabledFeatures.rateLimitsByEndpoint[endpointGroup];
+}
+
+module.exports = rateLimit;
+module.exports.RATE_LIMIT_ENDPOINTS_GROUPS = RATE_LIMIT_ENDPOINTS_GROUPS;

lib/cartodb/api/middlewares/send-response.js

@@ -0,0 +1,17 @@
+module.exports = function sendResponse () {
+    return function sendResponseMiddleware (req, res) {
+        req.profiler.done('res');
+
+        res.status(res.statusCode);
+
+        if (Buffer.isBuffer(res.body)) {
+            return res.send(res.body);
+        }
+
+        if (req.query.callback) {
+            return res.jsonp(res.body);
+        }
+
+        res.json(res.body);
+    };
+};

lib/cartodb/api/middlewares/served-by-host-header.js

@@ -0,0 +1,11 @@
+const os = require('os');
+
+module.exports = function servedByHostHeader () {
+    const hostname = os.hostname().split('.')[0];
+
+    return function servedByHostHeaderMiddleware (req, res, next) {
+        res.set('X-Served-By-Host', hostname);
+
+        next();
+    };
+};

lib/cartodb/api/middlewares/stats.js

@@ -0,0 +1,27 @@
+const Profiler = require('../../stats/profiler_proxy');
+const debug = require('debug')('windshaft:cartodb:stats');
+const onHeaders = require('on-headers');
+
+module.exports = function stats (options) {
+    const { enabled = true, statsClient } = options;
+
+    return function statsMiddleware (req, res, next) {
+        req.profiler = new Profiler({
+            statsd_client: statsClient,
+            profile: enabled
+        });
+
+        onHeaders(res, () => res.set('X-Tiler-Profiler', req.profiler.toJSONString()));
+
+        res.on('finish', () => {
+            try {
+                // May throw due to dns, see: http://github.com/CartoDB/Windshaft/issues/166
+                req.profiler.sendStats();
+            } catch (err) {
+                debug("error sending profiling stats: " + err);
+            }
+        });
+
+        next();
+    };
+};

lib/cartodb/api/middlewares/surrogate-key-header.js

@@ -0,0 +1,31 @@
+const NamedMapsCacheEntry = require('../../cache/model/named_maps_entry');
+const NamedMapMapConfigProvider = require('../../models/mapconfig/provider/named-map-provider');
+
+module.exports = function setSurrogateKeyHeader ({ surrogateKeysCache }) {
+    return function setSurrogateKeyHeaderMiddleware(req, res, next) {
+        const { user, mapConfigProvider } = res.locals;
+
+        if (mapConfigProvider instanceof NamedMapMapConfigProvider) {
+            surrogateKeysCache.tag(res, new NamedMapsCacheEntry(user, mapConfigProvider.getTemplateName()));
+        }
+
+        if (req.method !== 'GET') {
+            return next();
+        }
+
+        mapConfigProvider.getAffectedTables((err, affectedTables) => {
+            if (err) {
+                global.logger.warn('ERROR generating Surrogate Key Header:', err);
+                return next();
+            }
+
+            if (!affectedTables || !affectedTables.tables || affectedTables.tables.length === 0) {
+                return next();
+            }
+
+            surrogateKeysCache.tag(res, affectedTables);
+
+            next();
+        });
+    };
+};

lib/cartodb/api/middlewares/syntax-error.js

@@ -0,0 +1,10 @@
+module.exports = function syntaxError () {
+    return function syntaxErrorMiddleware (err, req, res, next) {
+        if (err.name === 'SyntaxError') {
+            err.http_status = 400;
+            err.message = `${err.name}: ${err.message}`;
+        }
+
+        next(err);
+    };
+};

lib/cartodb/api/middlewares/user.js

@@ -0,0 +1,11 @@
+const CdbRequest = require('../../models/cdb_request');
+
+module.exports = function user () {
+    const cdbRequest = new CdbRequest();
+
+    return function userMiddleware(req, res, next) {
+        res.locals.user = cdbRequest.userByReq(req);
+
+        next();
+    };
+};

lib/cartodb/api/middlewares/vector-error.js

@@ -0,0 +1,33 @@
+const fs = require('fs');
+const timeoutErrorVectorTile = fs.readFileSync(__dirname + '/../../../../assets/render-timeout-fallback.mvt');
+
+module.exports = function vectorError() {
+    return function vectorErrorMiddleware(err, req, res, next) {
+        if(req.params.format === 'mvt') {
+
+            if (isTimeoutError(err) || isRateLimitError(err)) {
+                res.set('Content-Type', 'application/x-protobuf');
+                return res.status(429).send(timeoutErrorVectorTile);
+            }
+        }
+
+        next(err);
+    };
+};
+
+
+function isRenderTimeoutError (err) {
+    return err.message === 'Render timed out';
+}
+
+function isDatasourceTimeoutError (err) {
+    return err.message && err.message.match(/canceling statement due to statement timeout/i);
+}
+
+function isTimeoutError (err) {
+    return isRenderTimeoutError(err) || isDatasourceTimeoutError(err);
+}
+
+function isRateLimitError (err) {
+    return err.type === 'limit' && err.subtype === 'rate-limit';
+}

lib/cartodb/api/template/admin-template-controller.js

@@ -0,0 +1,231 @@
+const { templateName } = require('../../backends/template_maps');
+const credentials = require('../middlewares/credentials');
+const rateLimit = require('../middlewares/rate-limit');
+const { RATE_LIMIT_ENDPOINTS_GROUPS } = rateLimit;
+
+module.exports = class AdminTemplateController {
+    /**
+     * @param {AuthBackend} authBackend
+     * @param {PgConnection} pgConnection
+     * @param {TemplateMaps} templateMaps
+     * @constructor
+     */
+    constructor (authBackend, templateMaps, userLimitsBackend) {
+        this.authBackend = authBackend;
+        this.templateMaps = templateMaps;
+        this.userLimitsBackend = userLimitsBackend;
+    }
+
+    register (templateRouter) {
+        templateRouter.options(`/:template_id`);
+
+        templateRouter.post('/', this.middlewares({
+            action: 'create',
+            label: 'POST TEMPLATE',
+            rateLimitGroup: RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_CREATE
+        }));
+
+        templateRouter.put('/:template_id', this.middlewares({
+            action: 'update',
+            label: 'PUT TEMPLATE',
+            rateLimitGroup: RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_UPDATE
+        }));
+
+        templateRouter.get('/:template_id', this.middlewares({
+            action: 'get',
+            label: 'GET TEMPLATE',
+            rateLimitGroup: RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_GET
+        }));
+
+        templateRouter.delete('/:template_id', this.middlewares({
+            action: 'delete',
+            label: 'DELETE TEMPLATE',
+            rateLimitGroup: RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_DELETE
+        }));
+
+        templateRouter.get('/', this.middlewares({
+            action: 'list',
+            label: 'GET TEMPLATE LIST',
+            rateLimitGroup: RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_LIST
+        }));
+    }
+
+    middlewares ({ action, label, rateLimitGroup }) {
+        let template;
+
+        if (action === 'create') {
+            template = createTemplate;
+        }
+
+        if (action === 'update') {
+            template = updateTemplate;
+        }
+
+        if (action === 'get') {
+            template = retrieveTemplate;
+        }
+
+        if (action === 'delete') {
+            template = destroyTemplate;
+        }
+
+        if (action === 'list') {
+            template = listTemplates;
+        }
+
+        return [
+            credentials(),
+            authorizedByAPIKey({ authBackend: this.authBackend, action, label }),
+            rateLimit(this.userLimitsBackend, rateLimitGroup),
+            checkContentType({ action: 'POST', label: 'POST TEMPLATE' }),
+            template({ templateMaps: this.templateMaps })
+        ];
+    }
+};
+
+function checkContentType ({ label }) {
+    return function checkContentTypeMiddleware (req, res, next) {
+        if ((req.method === 'POST' || req.method === 'PUT') && !req.is('application/json')) {
+            const error = new Error(`${req.method} template data must be of type application/json`);
+            error.label = label;
+            return next(error);
+        }
+
+        next();
+    };
+}
+
+function authorizedByAPIKey ({ authBackend, action, label }) {
+    return function authorizedByAPIKeyMiddleware (req, res, next) {
+        const { user } = res.locals;
+
+        authBackend.authorizedByAPIKey(user, res, (err, authenticated, apikey) => {
+            if (err) {
+                return next(err);
+            }
+
+            if (!authenticated) {
+                const error = new Error(`Only authenticated users can ${action} templated maps`);
+                error.http_status = 403;
+                error.label = label;
+                return next(error);
+            }
+
+            if (apikey.type !== 'master') {
+                const error = new Error('Forbidden');
+                error.type = 'auth';
+                error.subtype = 'api-key-does-not-grant-access';
+                error.http_status = 403;
+
+                return next(error);
+            }
+
+            next();
+        });
+    };
+}
+
+function createTemplate ({ templateMaps }) {
+    return function createTemplateMiddleware (req, res, next) {
+        const { user } = res.locals;
+        const template = req.body;
+
+        templateMaps.addTemplate(user, template, (err, templateId) => {
+            if (err) {
+                return next(err);
+            }
+
+            res.statusCode = 200;
+            res.body = { template_id: templateId };
+
+            next();
+        });
+    };
+}
+
+function updateTemplate ({ templateMaps }) {
+    return function updateTemplateMiddleware (req, res, next) {
+        const { user } = res.locals;
+        const template = req.body;
+        const templateId = templateName(req.params.template_id);
+
+        templateMaps.updTemplate(user, templateId, template, (err) => {
+            if (err) {
+                return next(err);
+            }
+
+            res.statusCode = 200;
+            res.body = { template_id: templateId };
+
+            next();
+        });
+    };
+}
+
+function retrieveTemplate ({ templateMaps }) {
+    return function retrieveTemplateMiddleware (req, res, next) {
+        req.profiler.start('windshaft-cartodb.get_template');
+
+        const { user } = res.locals;
+        const templateId = templateName(req.params.template_id);
+
+        templateMaps.getTemplate(user, templateId, (err, template) => {
+            if (err) {
+                return next(err);
+            }
+
+            if (!template) {
+                const error = new Error(`Cannot find template '${templateId}' of user '${user}'`);
+                error.http_status = 404;
+                return next(error);
+            }
+            // auth_id was added by ourselves,
+            // so we remove it before returning to the user
+            delete template.auth_id;
+
+            res.statusCode = 200;
+            res.body = { template };
+
+            next();
+        });
+    };
+}
+
+function destroyTemplate ({ templateMaps }) {
+    return function destroyTemplateMiddleware (req, res, next) {
+        req.profiler.start('windshaft-cartodb.delete_template');
+
+        const { user } = res.locals;
+        const templateId = templateName(req.params.template_id);
+
+        templateMaps.delTemplate(user, templateId, (err/* , tpl_val */) => {
+            if (err) {
+                return next(err);
+            }
+
+            res.statusCode = 204;
+            res.body = '';
+
+            next();
+        });
+    };
+}
+
+function listTemplates ({ templateMaps }) {
+    return function listTemplatesMiddleware (req, res, next) {
+        req.profiler.start('windshaft-cartodb.get_template_list');
+
+        const { user } = res.locals;
+
+        templateMaps.listTemplates(user, (err, templateIds) => {
+            if (err) {
+                return next(err);
+            }
+
+            res.statusCode = 200;
+            res.body = { template_ids: templateIds };
+
+            next();
+        });
+    };
+}

lib/cartodb/api/template/named-template-controller.js

@@ -0,0 +1,214 @@
+const cleanUpQueryParams = require('../middlewares/clean-up-query-params');
+const credentials = require('../middlewares/credentials');
+const dbConnSetup = require('../middlewares/db-conn-setup');
+const authorize = require('../middlewares/authorize');
+const initProfiler = require('../middlewares/init-profiler');
+const checkJsonContentType = require('../middlewares/check-json-content-type');
+const incrementMapViewCount = require('../middlewares/increment-map-view-count');
+const augmentLayergroupData = require('../middlewares/augment-layergroup-data');
+const cacheControlHeader = require('../middlewares/cache-control-header');
+const cacheChannelHeader = require('../middlewares/cache-channel-header');
+const surrogateKeyHeader = require('../middlewares/surrogate-key-header');
+const lastModifiedHeader = require('../middlewares/last-modified-header');
+const lastUpdatedTimeLayergroup = require('../middlewares/last-updated-time-layergroup');
+const layerStats = require('../middlewares/layer-stats');
+const layergroupIdHeader = require('../middlewares/layergroup-id-header');
+const layergroupMetadata = require('../middlewares/layergroup-metadata');
+const mapError = require('../middlewares/map-error');
+const NamedMapMapConfigProvider = require('../../models/mapconfig/provider/named-map-provider');
+const CreateLayergroupMapConfigProvider = require('../../models/mapconfig/provider/create-layergroup-provider');
+const rateLimit = require('../middlewares/rate-limit');
+const { RATE_LIMIT_ENDPOINTS_GROUPS } = rateLimit;
+
+module.exports = class NamedMapController {
+    /**
+     * @param {PgConnection} pgConnection
+     * @param {TemplateMaps} templateMaps
+     * @param {MapBackend} mapBackend
+     * @param metadataBackend
+     * @param {SurrogateKeysCache} surrogateKeysCache
+     * @param {UserLimitsBackend} userLimitsBackend
+     * @param {LayergroupAffectedTables} layergroupAffectedTables
+     * @param {MapConfigAdapter} mapConfigAdapter
+     * @param {StatsBackend} statsBackend
+     * @param {AuthBackend} authBackend
+     * @param layergroupMetadata
+     * @constructor
+     */
+    constructor (
+        pgConnection,
+        templateMaps,
+        mapBackend,
+        metadataBackend,
+        surrogateKeysCache,
+        userLimitsBackend,
+        layergroupAffectedTables,
+        mapConfigAdapter,
+        statsBackend,
+        authBackend,
+        layergroupMetadata
+    ) {
+        this.pgConnection = pgConnection;
+        this.templateMaps = templateMaps;
+        this.mapBackend = mapBackend;
+        this.metadataBackend = metadataBackend;
+        this.surrogateKeysCache = surrogateKeysCache;
+        this.userLimitsBackend = userLimitsBackend;
+        this.layergroupAffectedTables = layergroupAffectedTables;
+        this.mapConfigAdapter = mapConfigAdapter;
+        this.statsBackend = statsBackend;
+        this.authBackend = authBackend;
+        this.layergroupMetadata = layergroupMetadata;
+    }
+
+    register (templateRouter) {
+        templateRouter.get('/:template_id/jsonp', this.middlewares());
+        templateRouter.post('/:template_id', this.middlewares());
+    }
+
+    middlewares () {
+        const isTemplateInstantiation = true;
+        const useTemplateHash = true;
+        const includeQuery = false;
+        const label = 'NAMED MAP LAYERGROUP';
+        const addContext = false;
+
+        return [
+            credentials(),
+            authorize(this.authBackend),
+            dbConnSetup(this.pgConnection),
+            rateLimit(this.userLimitsBackend, RATE_LIMIT_ENDPOINTS_GROUPS.NAMED),
+            cleanUpQueryParams(['aggregation']),
+            initProfiler(isTemplateInstantiation),
+            checkJsonContentType(),
+            checkInstantiteLayergroup(),
+            getTemplate(
+                this.templateMaps,
+                this.pgConnection,
+                this.metadataBackend,
+                this.userLimitsBackend,
+                this.mapConfigAdapter,
+                this.layergroupAffectedTables
+            ),
+            instantiateLayergroup(
+                this.mapBackend,
+                this.userLimitsBackend,
+                this.pgConnection,
+                this.layergroupAffectedTables
+            ),
+            incrementMapViewCount(this.metadataBackend),
+            augmentLayergroupData(),
+            cacheControlHeader({ ttl: global.environment.varnish.layergroupTtl || 86400, revalidate: true }),
+            cacheChannelHeader(),
+            surrogateKeyHeader({ surrogateKeysCache: this.surrogateKeysCache }),
+            lastModifiedHeader(),
+            lastUpdatedTimeLayergroup(),
+            layerStats(this.pgConnection, this.statsBackend),
+            layergroupIdHeader(this.templateMaps ,useTemplateHash),
+            layergroupMetadata(this.layergroupMetadata, includeQuery),
+            mapError({ label, addContext })
+        ];
+    }
+};
+
+function checkInstantiteLayergroup () {
+    return function checkInstantiteLayergroupMiddleware(req, res, next) {
+        if (req.method === 'GET') {
+            const { callback, config } = req.query;
+
+            if (callback === undefined || callback.length === 0) {
+                return next(new Error('callback parameter should be present and be a function name'));
+            }
+
+            if (config) {
+                try {
+                    req.body = JSON.parse(config);
+                } catch(e) {
+                    return next(new Error('Invalid config parameter, should be a valid JSON'));
+                }
+            }
+        }
+
+        req.profiler.done('checkInstantiteLayergroup');
+
+        return next();
+    };
+}
+
+function getTemplate (
+    templateMaps,
+    pgConnection,
+    metadataBackend,
+    userLimitsBackend,
+    mapConfigAdapter,
+    affectedTablesCache
+) {
+    return function getTemplateMiddleware (req, res, next) {
+        const templateParams = req.body;
+        const { user, dbuser, dbname, dbpassword, dbhost, dbport } = res.locals;
+        const { template_id } = req.params;
+        const { auth_token } = req.query;
+
+        const params = Object.assign({ dbuser, dbname, dbpassword, dbhost, dbport }, req.query);
+
+        const mapConfigProvider = new NamedMapMapConfigProvider(
+            templateMaps,
+            pgConnection,
+            metadataBackend,
+            userLimitsBackend,
+            mapConfigAdapter,
+            affectedTablesCache,
+            user,
+            template_id,
+            templateParams,
+            auth_token,
+            params
+        );
+
+        mapConfigProvider.getMapConfig((err, mapConfig, rendererParams) => {
+            req.profiler.done('named.getMapConfig');
+            if (err) {
+                return next(err);
+            }
+
+            res.locals.mapConfig = mapConfig;
+            res.locals.rendererParams = rendererParams;
+            res.locals.mapConfigProvider = mapConfigProvider;
+
+            next();
+        });
+    };
+}
+
+function instantiateLayergroup (mapBackend, userLimitsBackend, pgConnection, affectedTablesCache) {
+    return function instantiateLayergroupMiddleware (req, res, next) {
+        const { user, mapConfig, rendererParams } = res.locals;
+        const mapConfigProvider = new CreateLayergroupMapConfigProvider(
+            mapConfig,
+            user,
+            userLimitsBackend,
+            pgConnection,
+            affectedTablesCache,
+            rendererParams
+        );
+
+        mapBackend.createLayergroup(mapConfig, rendererParams, mapConfigProvider, (err, layergroup, stats = {}) => {
+            req.profiler.add(stats);
+
+            if (err) {
+                return next(err);
+            }
+
+            res.statusCode = 200;
+            res.body = layergroup;
+
+            const { mapConfigProvider } = res.locals;
+
+            res.locals.analysesResults = mapConfigProvider.analysesResults;
+            res.locals.template = mapConfigProvider.template;
+            res.locals.context = mapConfigProvider.context;
+
+            next();
+        });
+    };
+}

lib/cartodb/api/template/template-router.js

@@ -0,0 +1,64 @@
+const { Router: router } = require('express');
+
+const NamedMapController = require('./named-template-controller');
+const AdminTemplateController = require('./admin-template-controller');
+const TileTemplateController = require('./tile-template-controller');
+
+module.exports = class TemplateRouter {
+    constructor ({ collaborators }) {
+        const {
+            pgConnection,
+            templateMaps,
+            mapBackend,
+            metadataBackend,
+            surrogateKeysCache,
+            userLimitsBackend,
+            layergroupAffectedTablesCache,
+            mapConfigAdapter,
+            statsBackend,
+            authBackend,
+            layergroupMetadata,
+            namedMapProviderCache,
+            tileBackend,
+        } = collaborators;
+
+        this.namedMapController = new NamedMapController(
+            pgConnection,
+            templateMaps,
+            mapBackend,
+            metadataBackend,
+            surrogateKeysCache,
+            userLimitsBackend,
+            layergroupAffectedTablesCache,
+            mapConfigAdapter,
+            statsBackend,
+            authBackend,
+            layergroupMetadata
+        );
+
+        this.tileTemplateController = new TileTemplateController(
+            namedMapProviderCache,
+            tileBackend,
+            surrogateKeysCache,
+            pgConnection,
+            authBackend,
+            userLimitsBackend
+        );
+
+        this.adminTemplateController = new AdminTemplateController(
+            authBackend,
+            templateMaps,
+            userLimitsBackend
+        );
+    }
+
+    register (apiRouter, templatePaths) {
+        const templateRouter = router({ mergeParams: true });
+
+        this.namedMapController.register(templateRouter);
+        this.tileTemplateController.register(templateRouter);
+        this.adminTemplateController.register(templateRouter);
+
+        templatePaths.forEach(path => apiRouter.use(path, templateRouter));
+    }
+};

lib/cartodb/api/template/tile-template-controller.js

@@ -0,0 +1,95 @@
+const coordinates = require('../middlewares/coordinates');
+const cleanUpQueryParams = require('../middlewares/clean-up-query-params');
+const credentials = require('../middlewares/credentials');
+const dbConnSetup = require('../middlewares/db-conn-setup');
+const authorize = require('../middlewares/authorize');
+const namedMapProvider = require('../middlewares/named-map-provider');
+const cacheControlHeader = require('../middlewares/cache-control-header');
+const cacheChannelHeader = require('../middlewares/cache-channel-header');
+const surrogateKeyHeader = require('../middlewares/surrogate-key-header');
+const lastModifiedHeader = require('../middlewares/last-modified-header');
+const vectorError = require('../middlewares/vector-error');
+const rateLimit = require('../middlewares/rate-limit');
+const { RATE_LIMIT_ENDPOINTS_GROUPS } = rateLimit;
+
+module.exports = class TileTemplateController {
+    constructor (
+        namedMapProviderCache,
+        tileBackend,
+        surrogateKeysCache,
+        pgConnection,
+        authBackend,
+        userLimitsBackend
+    ) {
+        this.namedMapProviderCache = namedMapProviderCache;
+        this.tileBackend = tileBackend;
+        this.surrogateKeysCache = surrogateKeysCache;
+        this.pgConnection = pgConnection;
+        this.authBackend = authBackend;
+        this.userLimitsBackend = userLimitsBackend;
+    }
+
+    register (templateRouter) {
+        templateRouter.get('/:template_id/:layer/:z/:x/:y.(:format)', this.middlewares());
+    }
+
+    middlewares () {
+        return [
+            coordinates(),
+            credentials(),
+            authorize(this.authBackend),
+            dbConnSetup(this.pgConnection),
+            rateLimit(this.userLimitsBackend, RATE_LIMIT_ENDPOINTS_GROUPS.NAMED_TILES),
+            cleanUpQueryParams(),
+            namedMapProvider({
+                namedMapProviderCache: this.namedMapProviderCache,
+                label: 'NAMED_MAP_TILE'
+            }),
+            getTile({
+                tileBackend: this.tileBackend,
+                label: 'NAMED_MAP_TILE'
+            }),
+            setContentTypeHeader(),
+            cacheControlHeader(),
+            cacheChannelHeader(),
+            surrogateKeyHeader({ surrogateKeysCache: this.surrogateKeysCache }),
+            lastModifiedHeader(),
+            vectorError()
+        ];
+    }
+};
+
+function getTile ({ tileBackend, label }) {
+    return function getTileMiddleware (req, res, next) {
+        const { mapConfigProvider } = res.locals;
+        const { layer, z, x, y, format } = req.params;
+        const params = { layer, z, x, y, format };
+
+        tileBackend.getTile(mapConfigProvider, params, (err, tile, headers, stats) => {
+            req.profiler.add(stats);
+            req.profiler.done('render-' + format);
+
+            if (err) {
+                err.label = label;
+                return next(err);
+            }
+
+            if (headers) {
+                res.set(headers);
+            }
+
+            res.statusCode = 200;
+            res.body = tile;
+
+            next();
+        });
+    };
+}
+
+function setContentTypeHeader () {
+    return function setContentTypeHeaderMiddleware(req, res, next) {
+        res.set('Content-Type', res.get('content-type') || res.get('Content-Type') || 'image/png');
+
+        next();
+    };
+}

lib/cartodb/api/user_limits_api.js

@@ -1,28 +0,0 @@
-/**
- *
- * @param metadataBackend
- * @param options
- * @constructor
- * @type {UserLimitsApi}
- */
-function UserLimitsApi(metadataBackend, options) {
-    this.metadataBackend = metadataBackend;
-    this.options = options || {};
-    this.options.limits = this.options.limits || {};
-}
-
-module.exports = UserLimitsApi;
-
-UserLimitsApi.prototype.getRenderLimits = function (username, callback) {
-    var self = this;
-    this.metadataBackend.getTilerRenderLimit(username, function handleTilerLimits(err, renderLimit) {
-        if (err) {
-            return callback(err);
-        }
-
-        return callback(null, {
-            cacheOnTimeout: self.options.limits.cacheOnTimeout || false,
-            render: renderLimit || self.options.limits.render || 0
-        });
-    });
-};

lib/cartodb/backends/analysis-status.js

@@ -5,16 +5,14 @@ function AnalysisStatusBackend() {
 
 module.exports = AnalysisStatusBackend;
 
-
-AnalysisStatusBackend.prototype.getNodeStatus = function (params, callback) {
-    var nodeId = params.nodeId;
-
+AnalysisStatusBackend.prototype.getNodeStatus = function (nodeId, dbParams, callback) {
     var statusQuery = [
         'SELECT node_id, status, updated_at, last_error_message as error_message',
         'FROM cdb_analysis_catalog where node_id = \'' + nodeId + '\''
     ].join(' ');
 
-    var pg = new PSQL(dbParamsFromReqParams(params));
+    var pg = new PSQL(dbParams);
+
     pg.query(statusQuery, function(err, result) {
         if (err) {
             return callback(err, result);
@@ -36,23 +34,3 @@ AnalysisStatusBackend.prototype.getNodeStatus = function (params, callback) {
         return callback(null, statusResponse);
     }, true); // use read-only transaction
 };
-
-function dbParamsFromReqParams(params) {
-    var dbParams = {};
-    if ( params.dbuser ) {
-        dbParams.user = params.dbuser;
-    }
-    if ( params.dbpassword ) {
-        dbParams.pass = params.dbpassword;
-    }
-    if ( params.dbhost ) {
-        dbParams.host = params.dbhost;
-    }
-    if ( params.dbport ) {
-        dbParams.port = params.dbport;
-    }
-    if ( params.dbname ) {
-        dbParams.dbname = params.dbname;
-    }
-    return dbParams;
-}

lib/cartodb/backends/auth.js

@@ -0,0 +1,178 @@
+/**
+ *
+ * @param {PgConnection} pgConnection
+ * @param metadataBackend
+ * @param {MapStore} mapStore
+ * @param {TemplateMaps} templateMaps
+ * @constructor
+ * @type {AuthBackend}
+ */
+function AuthBackend(pgConnection, metadataBackend, mapStore, templateMaps) {
+    this.pgConnection = pgConnection;
+    this.metadataBackend = metadataBackend;
+    this.mapStore = mapStore;
+    this.templateMaps = templateMaps;
+}
+
+module.exports = AuthBackend;
+
+// Check if the user is authorized by a signer
+//
+// @param res express response object
+// @param callback function(err, signed_by) signed_by will be
+//                 null if the request is not signed by anyone
+//                 or will be a string cartodb username otherwise.
+//
+AuthBackend.prototype.authorizedBySigner = function(req, res, callback) {
+    if ( ! res.locals.token || ! res.locals.signer ) {
+        return callback(null, false); // no signer requested
+    }
+
+    var self = this;
+
+    var layergroup_id = res.locals.token;
+    var auth_token = req.query.auth_token;
+
+    this.mapStore.load(layergroup_id, function(err, mapConfig) {
+        if (err) {
+            return callback(err);
+        }
+
+        var authorized = self.templateMaps.isAuthorized(mapConfig.obj().template, auth_token);
+
+        return callback(null, authorized);
+    });
+};
+
+function isValidApiKey(apikey) {
+    return apikey.type &&
+        apikey.user &&
+        apikey.databasePassword &&
+        apikey.databaseRole;
+}
+
+// Check if a request is authorized by api_key
+//
+// @param user
+// @param res express response object
+// @param callback function(err, authorized)
+//        NOTE: authorized is expected to be 0 or 1 (integer)
+//
+AuthBackend.prototype.authorizedByAPIKey = function(user, res, callback) {
+    const apikeyToken = res.locals.api_key;
+    const basicAuthUsername = res.locals.basicAuthUsername;
+
+    if ( ! apikeyToken ) {
+        return callback(null, false); // no api key, no authorization...
+    }
+
+    this.metadataBackend.getApikey(user, apikeyToken, (err, apikey) => {
+        if (err) {
+            if (isNameNotFoundError(err)) {
+                err.http_status = 404;
+            }
+
+            return callback(err);
+        }
+
+        if ( !isValidApiKey(apikey)) {
+            const error = new Error('Unauthorized');
+            error.type = 'auth';
+            error.subtype = 'api-key-not-found';
+            error.http_status = 401;
+
+            return callback(error);
+        }
+
+        if (!usernameMatches(basicAuthUsername, res.locals.user)) {
+            const error = new Error('Forbidden');
+            error.type = 'auth';
+            error.subtype = 'api-key-username-mismatch';
+            error.http_status = 403;
+
+            return callback(error);
+        }
+
+        if (!apikey.grantsMaps) {
+            const error = new Error('Forbidden');
+            error.type = 'auth';
+            error.subtype = 'api-key-does-not-grant-access';
+            error.http_status = 403;
+
+            return callback(error);
+        }
+
+        return callback(null, true, apikey);
+    });
+};
+
+function isNameNotFoundError (err) {
+    return err.message && -1 !== err.message.indexOf('name not found');
+}
+
+function usernameMatches (basicAuthUsername, requestUsername) {
+    return !(basicAuthUsername && (basicAuthUsername !== requestUsername));
+}
+
+/**
+ * Check access authorization
+ *
+ * @param req - standard req object. Importantly contains table and host information
+ * @param res - standard res object. Contains the auth parameters in locals
+ * @param callback function(err, allowed) is access allowed not?
+ */
+AuthBackend.prototype.authorize = function(req, res, callback) {
+    var user = res.locals.user;
+
+    this.authorizedByAPIKey(user, res, (err, isAuthorizedByApikey) => {
+        if (err) {
+            return callback(err);
+        }
+
+        if (isAuthorizedByApikey) {
+            return this.pgConnection.setDBAuth(user, res.locals, 'regular', function (err) {
+                req.profiler.done('setDBAuth');
+
+                if (err) {
+                    return callback(err);
+                }
+
+                callback(null, true);
+            });
+        }
+
+        this.authorizedBySigner(req, res, (err, isAuthorizedBySigner) => {
+            if (err) {
+                return callback(err);
+            }
+
+            if (isAuthorizedBySigner) {
+                return this.pgConnection.setDBAuth(user, res.locals, 'master', function (err) {
+                    req.profiler.done('setDBAuth');
+
+                    if (err) {
+                        return callback(err);
+                    }
+
+                    callback(null, true);
+                });
+            }
+
+            // if no signer name was given, use default api key
+            if (!res.locals.signer) {
+                return this.pgConnection.setDBAuth(user, res.locals, 'default', function (err) {
+                    req.profiler.done('setDBAuth');
+
+                    if (err) {
+                        return callback(err);
+                    }
+
+                    callback(null, true);
+                });
+            }
+
+            // if signer name was given, return no authorization
+            return callback(null, false);
+        });
+    });
+};

lib/cartodb/backends/dataview.js

@@ -1,13 +1,11 @@
 var assert = require('assert');
-
 var _ = require('underscore');
 var PSQL = require('cartodb-psql');
 var step = require('step');
-
 var BBoxFilter = require('../models/filter/bbox');
-
 var DataviewFactory = require('../models/dataview/factory');
 var DataviewFactoryWithOverviews = require('../models/dataview/overviews/factory');
+const dbParamsFromReqParams = require('../utils/database-params');
 var OverviewsQueryRewriter = require('../utils/overviews_query_rewriter');
 var overviewsQueryRewriter = new OverviewsQueryRewriter({
     zoom_level: 'CDB_ZoomFromScale(!scale_denominator!)'
@@ -37,59 +35,32 @@ DataviewBackend.prototype.getDataview = function (mapConfigProvider, user, param
                 throw new Error("Dataview '" + dataviewName + "' does not exists");
             }
 
-            var pg = new PSQL(dbParamsFromReqParams(params));
-
             var ownFilter = +params.own_filter;
-            ownFilter = !!ownFilter;
-
-            var query = (ownFilter) ? dataviewDefinition.sql.own_filter_on : dataviewDefinition.sql.own_filter_off;
-            var sourceId =  dataviewDefinition.source.id; // node.id
-            var layer = _.find(mapConfig.obj().layers, function(l) {
-                return l.options.source && (l.options.source.id === sourceId);
-            });
-            var queryRewriteData = layer && layer.options.query_rewrite_data;
-            if (queryRewriteData && dataviewDefinition.node.type === 'source') {
-                queryRewriteData = _.extend({}, queryRewriteData, {
-                    filters: dataviewDefinition.node.filters,
-                    unfiltered_query: dataviewDefinition.sql.own_filter_on
-                });
+            var noFilters = +params.no_filters;
+            if (Number.isFinite(ownFilter) && Number.isFinite(noFilters)) {
+                err = new Error();
+                err.message = 'Both own_filter and no_filters cannot be sent in the same request';
+                err.type = 'dataview';
+                err.http_status = 400;
+                return callback(err);
             }
 
+            var pg = new PSQL(dbParamsFromReqParams(params));
+
+            var query = getDataviewQuery(dataviewDefinition, ownFilter, noFilters);
             if (params.bbox) {
                 var bboxFilter = new BBoxFilter({column: 'the_geom_webmercator', srid: 3857}, {bbox: params.bbox});
                 query = bboxFilter.sql(query);
-                if ( queryRewriteData ) {
-                    var bbox_filter_definition = {
-                        type: 'bbox',
-                        options: {
-                            column: 'the_geom_webmercator',
-                            srid: 3857
-                        },
-                        params: {
-                            bbox: params.bbox
-                        }
-                    };
-                    queryRewriteData = _.extend(queryRewriteData, { bbox_filter: bbox_filter_definition });
-                }
             }
 
+            var queryRewriteData = getQueryRewriteData(mapConfig, dataviewDefinition, params);
+
             var dataviewFactory = DataviewFactoryWithOverviews.getFactory(
                 overviewsQueryRewriter, queryRewriteData, { bbox: params.bbox }
             );
 
-            var overrideParams = _.reduce(_.pick(params, 'start', 'end', 'bins'),
-                function castNumbers(overrides, val, k) {
-                    if (!Number.isFinite(+val)) {
-                        throw new Error('Invalid number format for parameter \'' + k + '\'');
-                    }
-                    overrides[k] = +val;
-                    return overrides;
-                },
-                {ownFilter: ownFilter}
-            );
-
             var dataview = dataviewFactory.getDataview(query, dataviewDefinition);
-            dataview.getResult(pg, overrideParams, this);
+            dataview.getResult(pg, getOverrideParams(params, !!ownFilter), this);
         },
         function returnCallback(err, result) {
             return callback(err, result);
@@ -97,9 +68,67 @@ DataviewBackend.prototype.getDataview = function (mapConfigProvider, user, param
     );
 };
 
-DataviewBackend.prototype.search = function (mapConfigProvider, user, params, callback) {
-    var dataviewName = params.dataviewName;
+function getDataviewQuery(dataviewDefinition, ownFilter, noFilters) {
+    if (noFilters) {
+        return dataviewDefinition.sql.no_filters;
+    } else if (ownFilter === 1) {
+        return dataviewDefinition.sql.own_filter_on;
+    } else {
+        return dataviewDefinition.sql.own_filter_off;
+    }
+}
 
+function getQueryRewriteData(mapConfig, dataviewDefinition, params) {
+    var sourceId = dataviewDefinition.source.id; // node.id
+    var layer = _.find(mapConfig.obj().layers, function(l) {
+        return l.options.source && (l.options.source.id === sourceId);
+    });
+    var queryRewriteData = layer && layer.options.query_rewrite_data;
+    if (queryRewriteData && dataviewDefinition.node.type === 'source') {
+        queryRewriteData = _.extend({}, queryRewriteData, {
+            filters: dataviewDefinition.node.filters,
+            unfiltered_query: dataviewDefinition.sql.own_filter_on
+        });
+    }
+
+    if (params.bbox && queryRewriteData) {
+        var bbox_filter_definition = {
+            type: 'bbox',
+            options: {
+                column: 'the_geom_webmercator',
+                srid: 3857
+            },
+            params: {
+                bbox: params.bbox
+            }
+        };
+        queryRewriteData = _.extend(queryRewriteData, { bbox_filter: bbox_filter_definition });
+    }
+
+    return queryRewriteData;
+}
+
+function getOverrideParams(params, ownFilter) {
+    var overrideParams = _.reduce(_.pick(params, 'start', 'end', 'bins', 'offset', 'categories'),
+        function castNumbers(overrides, val, k) {
+            if (!Number.isFinite(+val)) {
+                throw new Error('Invalid number format for parameter \'' + k + '\'');
+            }
+            overrides[k] = +val;
+            return overrides;
+        },
+        {ownFilter: ownFilter}
+    );
+
+    // validation will be delegated to the proper dataview
+    if (params.aggregation !== undefined) {
+        overrideParams.aggregation = params.aggregation;
+    }
+
+    return overrideParams;
+}
+
+DataviewBackend.prototype.search = function (mapConfigProvider, user, dataviewName, params, callback) {
     step(
         function getMapConfig() {
             mapConfigProvider.getMapConfig(this);
@@ -139,23 +168,3 @@ function getDataviewDefinition(mapConfig, dataviewName) {
     var dataviews = mapConfig.dataviews || {};
     return dataviews[dataviewName];
 }
-
-function dbParamsFromReqParams(params) {
-    var dbParams = {};
-    if ( params.dbuser ) {
-        dbParams.user = params.dbuser;
-    }
-    if ( params.dbpassword ) {
-        dbParams.pass = params.dbpassword;
-    }
-    if ( params.dbhost ) {
-        dbParams.host = params.dbhost;
-    }
-    if ( params.dbport ) {
-        dbParams.port = params.dbport;
-    }
-    if ( params.dbname ) {
-        dbParams.dbname = params.dbname;
-    }
-    return dbParams;
-}

lib/cartodb/backends/filter-stats.js

@@ -2,11 +2,11 @@ var _ = require('underscore');
 var step = require('step');
 var AnalysisFilter = require('../models/filter/analysis');
 
-function FilterStatsApi(pgQueryRunner) {
+function FilterStatsBackends(pgQueryRunner) {
     this.pgQueryRunner = pgQueryRunner;
 }
 
-module.exports = FilterStatsApi;
+module.exports = FilterStatsBackends;
 
 function getEstimatedRows(pgQueryRunner, username, query, callback) {
     pgQueryRunner.run(username, "EXPLAIN (FORMAT JSON)"+query, function(err, result_rows) {
@@ -23,7 +23,7 @@ function getEstimatedRows(pgQueryRunner, username, query, callback) {
     });
 }
 
-FilterStatsApi.prototype.getFilterStats = function (username, unfiltered_query, filters, callback) {
+FilterStatsBackends.prototype.getFilterStats = function (username, unfiltered_query, filters, callback) {
   var stats = {};
   var self = this;
   step(

lib/cartodb/backends/layer-stats/empty-layer-stats.js

@@ -0,0 +1,16 @@
+function EmptyLayerStats(types) {
+    this._types = types || {};
+}
+
+EmptyLayerStats.prototype.is = function (type) {
+    return this._types[type] ? this._types[type] : false;
+};
+
+EmptyLayerStats.prototype.getStats =
+function (layer, dbConnection, callback) {
+    setImmediate(function() {
+        callback(null, {});
+    });
+};
+
+module.exports = EmptyLayerStats;

lib/cartodb/backends/layer-stats/factory.js

@@ -0,0 +1,23 @@
+var LayerStats = require('./layer-stats');
+var EmptyLayerStats = require('./empty-layer-stats');
+var MapnikLayerStats = require('./mapnik-layer-stats');
+var TorqueLayerStats = require('./torque-layer-stats');
+
+module.exports = function LayerStatsFactory(type) {
+    var layerStatsIterator = [];
+    var selectedType = type || 'ALL';
+
+    if (selectedType === 'ALL') {
+        layerStatsIterator.push(new EmptyLayerStats({ http: true, plain: true }));
+        layerStatsIterator.push(new MapnikLayerStats());
+        layerStatsIterator.push(new TorqueLayerStats());
+    } else if (selectedType === 'mapnik') {
+        layerStatsIterator.push(new EmptyLayerStats({ http: true, plain: true, torque: true }));
+        layerStatsIterator.push(new MapnikLayerStats());
+    } else if (selectedType === 'torque') {
+        layerStatsIterator.push(new EmptyLayerStats({ http: true, plain: true, mapnik: true }));
+        layerStatsIterator.push(new TorqueLayerStats());
+    }
+
+    return new LayerStats(layerStatsIterator);
+};

lib/cartodb/backends/layer-stats/layer-stats.js

@@ -0,0 +1,45 @@
+var queue = require('queue-async');
+
+function LayerStats(layerStatsIterator) {
+    this.layerStatsIterator = layerStatsIterator;
+}
+
+LayerStats.prototype.getStats = function (mapConfig, dbConnection, callback) {
+    var self = this;
+    var stats = [];
+
+    if (!mapConfig.getLayers().length) {
+        return callback(null, stats);
+    }
+    var metaQueue = queue(mapConfig.getLayers().length);
+    mapConfig.getLayers().forEach(function (layer, layerId) {
+        var layerType = mapConfig.layerType(layerId);
+
+        for (var i = 0; i < self.layerStatsIterator.length; i++) {
+            if (self.layerStatsIterator[i].is(layerType)) {
+                var getStats = self.layerStatsIterator[i].getStats.bind(self.layerStatsIterator[i]);
+                metaQueue.defer(getStats, layer, dbConnection);
+                break;
+            }
+        }
+    });
+
+    metaQueue.awaitAll(function (err, results) {
+        if (err) {
+            return callback(err);
+        }
+
+        if (!results) {
+            return callback(null, null);
+        }
+
+        mapConfig.getLayers().forEach(function (layer, layerIndex) {
+            stats[layerIndex] = results[layerIndex];
+        });
+
+        return callback(err, stats);
+    });
+
+};
+
+module.exports = LayerStats;

lib/cartodb/backends/layer-stats/mapnik-layer-stats.js

@@ -0,0 +1,267 @@
+const queryUtils = require('../../utils/query-utils');
+const AggregationMapConfig = require('../../models/aggregation/aggregation-mapconfig');
+
+function MapnikLayerStats () {
+    this._types = {
+        mapnik: true,
+        cartodb: true
+    };
+}
+
+MapnikLayerStats.prototype.is = function (type) {
+    return this._types[type] ? this._types[type] : false;
+};
+
+function columnAggregations(field) {
+    if (field.type === 'number') {
+        return ['min', 'max', 'avg', 'sum'];
+    }
+    if (field.type === 'date') { // TODO other types too?
+        return ['min', 'max'];
+    }
+    return [];
+}
+
+function _getSQL(ctx, query, type='pre', zoom=0) {
+    let sql;
+    if (type === 'pre') {
+        sql = ctx.preQuery;
+    }
+    else {
+        sql = ctx.aggrQuery;
+    }
+    sql = queryUtils.subsituteTokensForZoom(sql, zoom || 0);
+    return query(sql);
+}
+
+function _estimatedFeatureCount(ctx) {
+    return queryUtils.queryPromise(ctx.dbConnection, _getSQL(ctx, queryUtils.getQueryRowEstimation))
+        .then(res => ({ estimatedFeatureCount: res.rows[0].rows }))
+        .catch(() => ({ estimatedFeatureCount: -1 }));
+}
+
+function _featureCount(ctx) {
+    if (ctx.metaOptions.featureCount) {
+        // TODO: if ctx.metaOptions.columnStats we can combine this with column stats query
+        return queryUtils.queryPromise(ctx.dbConnection, _getSQL(ctx, queryUtils.getQueryActualRowCount))
+            .then(res => ({ featureCount: res.rows[0].rows }));
+    }
+    return Promise.resolve();
+}
+
+function _aggrFeatureCount(ctx) {
+    if (ctx.metaOptions.hasOwnProperty('aggrFeatureCount')) {
+        // We expect as zoom level as the value of aggrFeatureCount
+        // TODO: it'd be nice to admit an array of zoom levels to
+        // return metadata for multiple levels.
+        return queryUtils.queryPromise(
+            ctx.dbConnection,
+            _getSQL(ctx, queryUtils.getQueryActualRowCount, 'post',  ctx.metaOptions.aggrFeatureCount)
+        ).then(res => ({ aggrFeatureCount: res.rows[0].rows }));
+    }
+    return Promise.resolve();
+}
+
+function _geometryType(ctx) {
+    if (ctx.metaOptions.geometryType) {
+        const geometryColumn = AggregationMapConfig.getAggregationGeometryColumn();
+        const sqlQuery = _getSQL(ctx, sql => queryUtils.getQueryGeometryType(sql, geometryColumn));
+        return queryUtils.queryPromise(ctx.dbConnection, sqlQuery)
+            .then(res => ({ geometryType: res.rows[0].geom_type }));
+    }
+    return Promise.resolve();
+}
+
+function _columns(ctx) {
+    if (ctx.metaOptions.columns || ctx.metaOptions.columnStats) {
+        // note: post-aggregation columns are in layer.options.columns when aggregation is present
+        return queryUtils.queryPromise(ctx.dbConnection, _getSQL(ctx, sql => queryUtils.getQueryLimited(sql, 0)))
+            .then(res => formatResultFields(ctx.dbConnection, res.fields));
+    }
+    return Promise.resolve();
+}
+
+// combine a list of results merging the properties of all the objects
+// undefined results are admitted and ignored
+function mergeResults(results) {
+    if (results) {
+        if (results.length === 0) {
+            return {};
+        }
+        return results.reduce((a, b) => {
+            if (a === undefined) {
+                return b;
+            }
+            if (b === undefined) {
+                return a;
+            }
+            return Object.assign({}, a, b);
+        });
+    }
+}
+
+// deeper (1 level) combination of a list of objects:
+// mergeColumns([{ col1: { a: 1 }, col2: { a: 2 } }, { col1: { b: 3 } }]) => { col1: { a: 1, b: 3 }, col2: { a: 2 } }
+function mergeColumns(results) {
+    if (results) {
+        if (results.length === 0) {
+            return {};
+        }
+        return results.reduce((a, b) => {
+            let c = Object.assign({}, b || {}, a || {});
+            Object.keys(c).forEach(key => {
+                if (b.hasOwnProperty(key)) {
+                    c[key] = Object.assign(c[key], b[key]);
+                }
+            });
+            return c;
+        });
+    }
+}
+
+const SAMPLE_SEED = 0.5;
+const DEFAULT_SAMPLE_ROWS = 100;
+
+function _sample(ctx, numRows) {
+    if (ctx.metaOptions.sample) {
+        const sampleProb = Math.min(ctx.metaOptions.sample.num_rows / numRows, 1);
+        // We'll use a safety limit just in case numRows is a bad estimate
+        const requestedRows = ctx.metaOptions.sample.num_rows || DEFAULT_SAMPLE_ROWS;
+        const limit = Math.ceil(requestedRows * 1.5);
+        let columns = ctx.metaOptions.sample.include_columns;
+        return queryUtils.queryPromise(ctx.dbConnection, _getSQL(
+            ctx,
+            sql => queryUtils.getQuerySample(sql, sampleProb, limit, SAMPLE_SEED, columns)
+        )).then(res => ({ sample: res.rows }));
+    }
+    return Promise.resolve();
+}
+
+function _columnStats(ctx, columns) {
+    if (!columns) {
+        return Promise.resolve();
+    }
+    if (ctx.metaOptions.columnStats) {
+        let queries = [];
+        let aggr = [];
+        queries.push(new Promise(resolve => resolve(columns))); // add columns as first result
+        Object.keys(columns).forEach(name => {
+            aggr = aggr.concat(
+                columnAggregations(columns[name])
+                .map(fn => `${fn}(${name}) AS ${name}_${fn}`)
+            );
+            if (columns[name].type === 'string') {
+                const topN = ctx.metaOptions.columnStats.topCategories || 1024;
+                const includeNulls = ctx.metaOptions.columnStats.hasOwnProperty('includeNulls') ?
+                    ctx.metaOptions.columnStats.includeNulls :
+                    true;
+
+                // TODO:  ctx.metaOptions.columnStats.maxCategories
+                //        => use PG stats to dismiss columns with more distinct values
+                queries.push(
+                    queryUtils.queryPromise(
+                        ctx.dbConnection,
+                        _getSQL(ctx, sql => queryUtils.getQueryTopCategories(sql, name, topN, includeNulls))
+                    ).then(res => ({ [name]: { categories: res.rows } }))
+                );
+            }
+        });
+        queries.push(
+            queryUtils.queryPromise(
+                ctx.dbConnection,
+                _getSQL(ctx, sql => `SELECT ${aggr.join(',')} FROM (${sql}) AS __cdb_query`)
+            ).then(res => {
+                let stats = {};
+                Object.keys(columns).forEach(name => {
+                    stats[name] = {};
+                    columnAggregations(columns[name]).forEach(fn => {
+                        stats[name][fn] = res.rows[0][`${name}_${fn}`];
+                    });
+                });
+                return stats;
+            })
+        );
+        return Promise.all(queries).then(results => ({ columns: mergeColumns(results) }));
+    }
+    return Promise.resolve({ columns });
+}
+
+// This is adapted from SQL API:
+function fieldType(cname) {
+    let tname;
+    switch (true) {
+        case /bool/.test(cname):
+            tname = 'boolean';
+            break;
+        case /int|float|numeric/.test(cname):
+            tname = 'number';
+            break;
+        case /text|char|unknown/.test(cname):
+            tname = 'string';
+            break;
+        case /date|time/.test(cname):
+            tname = 'date';
+            break;
+        default:
+            tname = cname;
+    }
+    if ( tname && cname.match(/^_/) ) {
+        tname += '[]';
+    }
+    return tname;
+}
+
+// columns are returned as an object { columnName1: { type1: ...}, ..}
+// for consistency with SQL API
+function formatResultFields(dbConnection, fields = []) {
+    let nfields = {};
+    for (let field of fields) {
+      const cname = dbConnection.typeName(field.dataTypeID);
+      let tname;
+      if ( ! cname ) {
+        tname = 'unknown(' + field.dataTypeID + ')';
+      } else {
+        tname = fieldType(cname);
+      }
+      nfields[field.name] = { type: tname };
+    }
+    return nfields;
+}
+
+MapnikLayerStats.prototype.getStats =
+function (layer, dbConnection, callback) {
+    let aggrQuery = layer.options.sql;
+    let preQuery =  layer.options.sql_raw || aggrQuery;
+
+    let ctx = {
+        dbConnection,
+        preQuery,
+        aggrQuery,
+        metaOptions: layer.options.metadata || {}
+    };
+
+    // TODO: could save some queries if queryUtils.getAggregationMetadata() has been used and kept somewhere
+    // we would set queries.results.estimatedFeatureCount and queries.results.geometryType
+    // (if metaOptions.geometryType) from it.
+
+    // TODO: compute _sample with _featureCount when available
+    // TODO: add support for sample.exclude option by, in that case, forcing the columns query and
+    // passing the results to the sample query function.
+
+    Promise.all([
+        _estimatedFeatureCount(ctx).then(
+            ({ estimatedFeatureCount }) => _sample(ctx, estimatedFeatureCount)
+                .then(sampleResults => mergeResults([sampleResults, { estimatedFeatureCount }]))
+        ),
+        _featureCount(ctx),
+        _aggrFeatureCount(ctx),
+        _geometryType(ctx),
+        _columns(ctx).then(columns => _columnStats(ctx, columns))
+    ]).then(results => {
+        callback(null, mergeResults(results));
+    }).catch(error => {
+        callback(error);
+    });
+};
+
+module.exports = MapnikLayerStats;

lib/cartodb/backends/layer-stats/torque-layer-stats.js

@@ -0,0 +1,16 @@
+function TorqueLayerStats() {
+    this._types = {
+        torque: true
+    };
+}
+
+TorqueLayerStats.prototype.is = function (type) {
+    return this._types[type] ? this._types[type] : false;
+};
+
+TorqueLayerStats.prototype.getStats =
+function (layer, dbConnection, callback) {
+    return callback(null, {});
+};
+
+module.exports = TorqueLayerStats;

lib/cartodb/backends/overviews-metadata.js

@@ -1,25 +1,20 @@
-var SubstitutionTokens = require('../utils/substitution-tokens');
+const queryUtils = require('../utils/query-utils');
 
-function OverviewsMetadataApi(pgQueryRunner) {
+function OverviewsMetadataBackend(pgQueryRunner) {
     this.pgQueryRunner = pgQueryRunner;
 }
 
-module.exports = OverviewsMetadataApi;
+module.exports = OverviewsMetadataBackend;
 
-function prepareSql(sql) {
-    return sql && SubstitutionTokens.replace(sql, {
-        bbox: 'ST_MakeEnvelope(0,0,0,0)',
-        scale_denominator: '0',
-        pixel_width: '1',
-        pixel_height: '1'
-    });
-}
-
-OverviewsMetadataApi.prototype.getOverviewsMetadata = function (username, sql, callback) {
+OverviewsMetadataBackend.prototype.getOverviewsMetadata = function (username, sql, callback) {
     // FIXME: Currently using internal function _cdb_schema_name
     //        CDB_Overviews should provide the schema information directly.
-    var query = 'SELECT *, _cdb_schema_name(base_table)' +
-                '  FROM CDB_Overviews(CDB_QueryTablesText($windshaft$' + prepareSql(sql) + '$windshaft$))';
+    const query = `
+      SELECT *, _cdb_schema_name(base_table)
+        FROM CDB_Overviews(
+            CDB_QueryTablesText($windshaft$${queryUtils.substituteDummyTokens(sql)}$windshaft$)
+        );
+    `;
     this.pgQueryRunner.run(username, query, function handleOverviewsRows(err, rows) {
         if (err){
             callback(err);

lib/cartodb/backends/pg_connection.js

@@ -1,7 +1,6 @@
-var assert = require('assert');
-var step = require('step');
 var PSQL = require('cartodb-psql');
 var _ = require('underscore');
+const debug = require('debug')('cachechan');
 
 function PgConnection(metadataBackend) {
     this.metadataBackend = metadataBackend;
@@ -20,45 +19,59 @@ module.exports = PgConnection;
 //
 // @param callback function(err)
 //
-PgConnection.prototype.setDBAuth = function(username, params, callback) {
-    var self = this;
-
-    var user_params = {};
-    var auth_user = global.environment.postgres_auth_user;
-    var auth_pass = global.environment.postgres_auth_pass;
-    step(
-        function getId() {
-            self.metadataBackend.getUserId(username, this);
-        },
-        function(err, user_id) {
-            assert.ifError(err);
-            user_params.user_id = user_id;
-            var dbuser = _.template(auth_user, user_params);
-            _.extend(params, {dbuser:dbuser});
-
-            // skip looking up user_password if postgres_auth_pass
-            // doesn't contain the "user_password" label
-            if (!auth_pass || ! auth_pass.match(/\buser_password\b/) ) {
-                return null;
+PgConnection.prototype.setDBAuth = function(username, params, apikeyType, callback) {
+    if (apikeyType === 'master') {
+        this.metadataBackend.getMasterApikey(username, (err, apikey) => {
+            if (err) {
+                if (isNameNotFoundError(err)) {
+                    err.http_status = 404;
+                }
+                return callback(err);
             }
 
-            self.metadataBackend.getUserDBPass(username, this);
-        },
-        function(err, user_password) {
-            assert.ifError(err);
-            user_params.user_password = user_password;
-            if ( auth_pass ) {
-                var dbpass = _.template(auth_pass, user_params);
-                _.extend(params, {dbpassword:dbpass});
+            params.dbuser = apikey.databaseRole;
+            params.dbpassword = apikey.databasePassword;
+
+            return callback();
+        });
+    } else if (apikeyType === 'regular') { //Actually it can be any type of api key
+        this.metadataBackend.getApikey(username, params.api_key, (err, apikey) => {
+            if (err) {
+                if (isNameNotFoundError(err)) {
+                    err.http_status = 404;
+                }
+                return callback(err);
             }
-            return true;
-        },
-        function finish(err) {
-            callback(err);
-        }
-    );
+
+            params.dbuser = apikey.databaseRole;
+            params.dbpassword = apikey.databasePassword;
+
+            return callback();
+        });
+    } else if (apikeyType === 'default') {
+        this.metadataBackend.getApikey(username, 'default_public', (err, apikey) => {
+            if (err) {
+                if (isNameNotFoundError(err)) {
+                    err.http_status = 404;
+                }
+                return callback(err);
+            }
+
+            params.dbuser = apikey.databaseRole;
+            params.dbpassword = apikey.databasePassword;
+
+            return callback();
+        });
+    } else {
+        return callback(new Error(`Invalid Apikey type: ${apikeyType}, valid ones: master, regular, default`));
+    }
 };
 
+function isNameNotFoundError (err) {
+    return err.message && -1 !== err.message.indexOf('name not found');
+}
+
+
 // Set db connection parameters to those for the given username
 //
 // @param dbowner cartodb username of database owner,
@@ -71,36 +84,30 @@ PgConnection.prototype.setDBAuth = function(username, params, callback) {
 // @param callback function(err)
 //
 PgConnection.prototype.setDBConn = function(dbowner, params, callback) {
-    var self = this;
-    // Add default database connection parameters
-    // if none given
     _.defaults(params, {
-        dbuser: global.environment.postgres.user,
-        dbpassword: global.environment.postgres.password,
+        // dbuser: global.environment.postgres.user,
+        // dbpassword: global.environment.postgres.password,
         dbhost: global.environment.postgres.host,
         dbport: global.environment.postgres.port
     });
-    step(
-        function getConnectionParams() {
-            self.metadataBackend.getUserDBConnectionParams(dbowner, this);
-        },
-        function extendParams(err, dbParams){
-            assert.ifError(err);
-            // we don't want null values or overwrite a non public user
-            if (params.dbuser !== 'publicuser' || !dbParams.dbuser) {
-                delete dbParams.dbuser;
-            }
-            if ( dbParams ) {
-                _.extend(params, dbParams);
-            }
-            return null;
-        },
-        function finish(err) {
-            callback(err);
-        }
-    );
-};
 
+    this.metadataBackend.getUserDBConnectionParams(dbowner, (err, dbParams) => {
+        if (err) {
+            return callback(err);
+        }
+
+        // we don’t want null values or overwrite a non public user
+        if (params.dbuser !== 'publicuser' || !dbParams.dbuser) {
+            delete dbParams.dbuser;
+        }
+
+        if (dbParams) {
+            _.extend(params, dbParams);
+        }
+
+        callback();
+    });
+};
 
 /**
  * Returns a `cartodb-psql` object for a given username.
@@ -109,28 +116,37 @@ PgConnection.prototype.setDBConn = function(dbowner, params, callback) {
  */
 
 PgConnection.prototype.getConnection = function(username, callback) {
-    var self = this;
+    debug("getConn1");
 
-    var params = {};
-
-    require('debug')('cachechan')("getConn1");
-    step(
-        function setAuth() {
-            self.setDBAuth(username, params, this);
-        },
-        function setConn(err) {
-            assert.ifError(err);
-            self.setDBConn(username, params, this);
-        },
-        function openConnection(err) {
-            assert.ifError(err);
-            return callback(err, new PSQL({
-                user: params.dbuser,
-                pass: params.dbpass,
-                host: params.dbhost,
-                port: params.dbport,
-                dbname: params.dbname
-            }));
+    this.getDatabaseParams(username, (err, databaseParams) => {
+        if (err) {
+            return callback(err);
         }
-    );
+        return callback(err, new PSQL({
+            user: databaseParams.dbuser,
+            pass: databaseParams.dbpass,
+            host: databaseParams.dbhost,
+            port: databaseParams.dbport,
+            dbname: databaseParams.dbname
+        }));
+
+    });
+};
+
+PgConnection.prototype.getDatabaseParams = function(username, callback) {
+    const databaseParams = {};
+
+    this.setDBAuth(username, databaseParams, 'master', err => {
+        if (err) {
+            return callback(err);
+        }
+
+        this.setDBConn(username, databaseParams, err => {
+            if (err) {
+                return callback(err);
+            }
+
+            callback(null, databaseParams);
+        });
+    });
 };

lib/cartodb/backends/pg_query_runner.js

@@ -1,6 +1,4 @@
-var assert = require('assert');
 var PSQL = require('cartodb-psql');
-var step = require('step');
 
 function PgQueryRunner(pgConnection) {
     this.pgConnection = pgConnection;
@@ -16,31 +14,23 @@ module.exports = PgQueryRunner;
  * @param {Function} callback function({Error}, {Array}) second argument is guaranteed to be an array
  */
 PgQueryRunner.prototype.run = function(username, query, callback) {
-    var self = this;
 
-    var params = {};
-
-    step(
-        function setAuth() {
-            self.pgConnection.setDBAuth(username, params, this);
-        },
-        function setConn(err) {
-            assert.ifError(err);
-            self.pgConnection.setDBConn(username, params, this);
-        },
-        function executeQuery(err) {
-            assert.ifError(err);
-            var psql = new PSQL({
-                user: params.dbuser,
-                pass: params.dbpass,
-                host: params.dbhost,
-                port: params.dbport,
-                dbname: params.dbname
-            });
-            psql.query(query, function(err, resultSet) {
-                resultSet = resultSet || {};
-                return callback(err, resultSet.rows || []);
-            });
+    this.pgConnection.getDatabaseParams(username, (err, databaseParams) => {
+        if (err) {
+            return callback(err);
         }
-    );
+
+        const psql = new PSQL({
+            user: databaseParams.dbuser,
+            pass: databaseParams.dbpass,
+            host: databaseParams.dbhost,
+            port: databaseParams.dbport,
+            dbname: databaseParams.dbname
+        });
+
+        psql.query(query, function (err, resultSet) {
+            resultSet = resultSet || {};
+            return callback(err, resultSet.rows || []);
+        });
+    });
 };

lib/cartodb/backends/stats.js

@@ -0,0 +1,16 @@
+var layerStats = require('./layer-stats/factory');
+
+function StatsBackend() {
+}
+
+module.exports = StatsBackend;
+
+StatsBackend.prototype.getStats = function(mapConfig, dbConnection, callback) {
+    var enabledFeatures = global.environment.enabledFeatures;
+    var layerStatsEnabled = enabledFeatures ? enabledFeatures.layerStats: false;
+    if (layerStatsEnabled) {
+        layerStats().getStats(mapConfig, dbConnection, callback);
+    } else {
+        return callback(null, []);
+    }
+};

lib/cartodb/backends/tables-extent.js

@@ -1,8 +1,8 @@
-function TablesExtentApi(pgQueryRunner) {
+function TablesExtentBackend(pgQueryRunner) {
     this.pgQueryRunner = pgQueryRunner;
 }
 
-module.exports = TablesExtentApi;
+module.exports = TablesExtentBackend;
 
 /**
  * Given a username and a list of tables it will return the estimated extent in SRID 4326 for all the tables based on
@@ -13,7 +13,7 @@ module.exports = TablesExtentApi;
  *  `table_name` format as valid input
  * @param {Function} callback function(err, result) {Object} result with `west`, `south`, `east`, `north`
  */
-TablesExtentApi.prototype.getBounds = function (username, tables, callback) {
+TablesExtentBackend.prototype.getBounds = function (username, tables, callback) {
     var estimatedExtentSQLs = tables.map(function(table) {
         return "ST_EstimatedExtent('" + table.schema_name + "', '" + table.table_name + "', 'the_geom_webmercator')";
     });

lib/cartodb/backends/template_maps.js

@@ -296,7 +296,7 @@ TemplateMaps.prototype.delTemplate = function(owner, tpl_id, callback) {
 // @param callback function(err)
 //
 TemplateMaps.prototype.updTemplate = function(owner, tpl_id, template, callback) {
-    
+
     var self = this;
 
     template = templateDefaults(template);
@@ -430,13 +430,17 @@ var _reNumber = /^([-+]?[\d\.]?\d+([eE][+-]?\d+)?)$/,
     _reCSSColorVal = /^#[0-9a-fA-F]{3,6}$/;
 
 function _replaceVars (str, params) {
-  //return _.template(str, params); // lazy way, possibly dangerous
-  // Construct regular expressions for each param
+    // Construct regular expressions for each param
     Object.keys(params).forEach(function(k) {
         str = str.replace(new RegExp("<%=\\s*" + k + "\\s*%>", "g"), params[k]);
     });
     return str;
 }
+
+function isObject(val) {
+    return ( _.isObject(val) && !_.isArray(val) && !_.isFunction(val));
+}
+
 TemplateMaps.prototype.instance = function(template, params) {
   var all_params = {};
   var phold = template.placeholders || {};
@@ -474,6 +478,13 @@ TemplateMaps.prototype.instance = function(template, params) {
 
   // NOTE: we're deep-cloning the layergroup here
   var layergroup = JSON.parse(JSON.stringify(template.layergroup));
+
+  if (layergroup.buffersize && isObject(layergroup.buffersize)) {
+      Object.keys(layergroup.buffersize).forEach(function(k) {
+        layergroup.buffersize[k] = parseInt(_replaceVars(layergroup.buffersize[k], all_params), 10);
+      });
+  }
+
   for (var i=0; i<layergroup.layers.length; ++i) {
     var lyropt = layergroup.layers[i].options;
 

lib/cartodb/backends/turbo-carto-postgres-datasource.js

@@ -10,15 +10,21 @@ function createTemplate(method) {
         'max({{=it._column}}) max_val,',
         'avg({{=it._column}}) avg_val,',
         method,
-        'FROM ({{=it._sql}}) _table_sql WHERE {{=it._column}} IS NOT NULL'
+        'FROM ({{=it._sql}}) _table_sql WHERE {{=it._column}} IS NOT NULL',
+        'AND',
+        '  {{=it._column}} != \'infinity\'::float',
+        'AND',
+        '  {{=it._column}} != \'-infinity\'::float',
+        'AND',
+        '  {{=it._column}} != \'NaN\'::float'
     ].join('\n'));
 }
 
 var methods = {
-    quantiles: 'CDB_QuantileBins(array_agg(distinct({{=it._column}}::numeric)), {{=it._buckets}}) as quantiles',
+    quantiles: 'CDB_QuantileBins(array_agg({{=it._column}}::numeric), {{=it._buckets}}) as quantiles',
     equal: 'CDB_EqualIntervalBins(array_agg({{=it._column}}::numeric), {{=it._buckets}}) as equal',
-    jenks: 'CDB_JenksBins(array_agg(distinct({{=it._column}}::numeric)), {{=it._buckets}}) as jenks',
-    headtails: 'CDB_HeadsTailsBins(array_agg(distinct({{=it._column}}::numeric)), {{=it._buckets}}) as headtails'
+    jenks: 'CDB_JenksBins(array_agg({{=it._column}}::numeric), {{=it._buckets}}) as jenks',
+    headtails: 'CDB_HeadsTailsBins(array_agg({{=it._column}}::numeric), {{=it._buckets}}) as headtails'
 };
 
 var methodTemplates = Object.keys(methods).reduce(function(methodTemplates, methodName) {

lib/cartodb/backends/user-limits.js

@@ -0,0 +1,91 @@
+var step = require('step');
+
+/**
+ *
+ * @param metadataBackend
+ * @param options
+ * @constructor
+ * @type {UserLimitsBackend}
+ */
+function UserLimitsBackend(metadataBackend, options) {
+    this.metadataBackend = metadataBackend;
+    this.options = options || {};
+    this.options.limits = this.options.limits || {};
+
+    this.preprareRateLimit();
+}
+
+module.exports = UserLimitsBackend;
+
+UserLimitsBackend.prototype.getRenderLimits = function (username, apiKey, callback) {
+    var self = this;
+
+    var limits = {
+        cacheOnTimeout: self.options.limits.cacheOnTimeout || false,
+        render: self.options.limits.render || 0
+    };
+
+    self.getTimeoutRenderLimit(username, apiKey, function (err, timeoutRenderLimit) {
+        if (err) {
+            return callback(err);
+        }
+
+        if (timeoutRenderLimit && timeoutRenderLimit.render) {
+            if (Number.isFinite(timeoutRenderLimit.render)) {
+                limits.render = timeoutRenderLimit.render;
+            }
+        }
+
+        return callback(null, limits);
+    });
+};
+
+UserLimitsBackend.prototype.getTimeoutRenderLimit = function (username, apiKey, callback) {
+    var self = this;
+
+    step(
+        function isAuthorized() {
+            var next = this;
+
+            if (!apiKey) {
+                return next(null, false);
+            }
+
+            self.metadataBackend.getUserMapKey(username, function (err, userApiKey) {
+                if (err) {
+                    return next(err);
+                }
+
+                return next(null, userApiKey === apiKey);
+            });
+        },
+        function getUserTimeoutRenderLimits(err, authorized) {
+            var next = this;
+
+            if (err) {
+                return next(err);
+            }
+
+            self.metadataBackend.getUserTimeoutRenderLimits(username, function (err, timeoutRenderLimit) {
+                if (err) {
+                    return next(err);
+                }
+
+                next(null, {
+                    render: authorized ? timeoutRenderLimit.render : timeoutRenderLimit.renderPublic
+                });
+            });
+        },
+        callback
+    );
+};
+
+UserLimitsBackend.prototype.preprareRateLimit = function () {
+    if (this.options.limits.rateLimitsEnabled) {
+        this.metadataBackend.loadRateLimitsScript();
+    }
+};
+
+UserLimitsBackend.prototype.getRateLimit = function (user, endpointGroup, callback) {
+    this.metadataBackend.getRateLimit(user, 'maps', endpointGroup, callback);
+};

lib/cartodb/cache/named_map_provider_cache.js

@@ -6,12 +6,20 @@ var queue = require('queue-async');
 
 var LruCache = require("lru-cache");
 
-function NamedMapProviderCache(templateMaps, pgConnection, metadataBackend, userLimitsApi, mapConfigAdapter) {
+function NamedMapProviderCache(
+    templateMaps,
+    pgConnection,
+    metadataBackend,
+    userLimitsBackend,
+    mapConfigAdapter,
+    affectedTablesCache
+) {
     this.templateMaps = templateMaps;
     this.pgConnection = pgConnection;
     this.metadataBackend = metadataBackend;
-    this.userLimitsApi = userLimitsApi;
+    this.userLimitsBackend = userLimitsBackend;
     this.mapConfigAdapter = mapConfigAdapter;
+    this.affectedTablesCache = affectedTablesCache;
 
     this.providerCache = new LruCache({ max: 2000 });
 }
@@ -28,8 +36,9 @@ NamedMapProviderCache.prototype.get = function(user, templateId, config, authTok
             this.templateMaps,
             this.pgConnection,
             this.metadataBackend,
-            this.userLimitsApi,
+            this.userLimitsBackend,
             this.mapConfigAdapter,
+            this.affectedTablesCache,
             user,
             templateId,
             config,

lib/cartodb/controllers/analyses.js

@@ -1,169 +0,0 @@
-var step = require('step');
-var assert = require('assert');
-var dot = require('dot');
-dot.templateSettings.strip = false;
-var PSQL = require('cartodb-psql');
-
-var util = require('util');
-var BaseController = require('./base');
-
-var cors = require('../middleware/cors');
-var userMiddleware = require('../middleware/user');
-
-function AnalysesController(authApi, pgConnection) {
-    BaseController.call(this, authApi, pgConnection);
-}
-
-util.inherits(AnalysesController, BaseController);
-
-module.exports = AnalysesController;
-
-AnalysesController.prototype.register = function(app) {
-    app.get(app.base_url_mapconfig + '/analyses/catalog', cors(), userMiddleware, this.catalog.bind(this));
-};
-
-AnalysesController.prototype.sendResponse = function(req, res, resource) {
-    res.set('Cache-Control', 'public,max-age=10,must-revalidate');
-    this.send(req, res, resource, 200);
-};
-
-AnalysesController.prototype.catalog = function(req, res) {
-    var self = this;
-    var username = req.context.user;
-
-    step(
-        function reqParams() {
-            self.req2params(req, this);
-        },
-        function catalogQuery(err) {
-            assert.ifError(err);
-            var pg = new PSQL(dbParamsFromReqParams(req.params));
-            getMetadata(username, pg, this);
-        },
-        function prepareResponse(err, results) {
-            assert.ifError(err);
-
-            var analysisIdToTable = results.tables.reduce(function(analysisIdToTable, table) {
-                var analysisId = table.relname.split('_')[2];
-                if (analysisId && analysisId.length === 40) {
-                    analysisIdToTable[analysisId] = table;
-                }
-                return analysisIdToTable;
-            }, {});
-
-            var catalogWithTables = results.catalog.map(function(analysis) {
-                if (analysisIdToTable.hasOwnProperty(analysis.node_id)) {
-                    analysis.table = analysisIdToTable[analysis.node_id];
-                }
-                return analysis;
-            });
-
-            return catalogWithTables.sort(function(analysisA, analysisB) {
-                if (!!analysisA.table && !!analysisB.table) {
-                    return analysisB.table.size - analysisA.table.size;
-                }
-
-                if (!!analysisA.table) {
-                    return -1;
-                }
-
-                if (!!analysisB.table) {
-                    return 1;
-                }
-
-                return -1;
-            });
-        },
-        function sendResponse(err, catalogWithTables) {
-            if (err) {
-                if (err.message.match(/permission\sdenied/)) {
-                    err = new Error('Unauthorized');
-                    err.http_status = 401;
-                }
-                self.sendError(req, res, err);
-            } else {
-                self.sendResponse(req, res, { catalog: catalogWithTables });
-            }
-        }
-    );
-};
-
-var catalogQueryTpl = dot.template(
-    'SELECT analysis_def->>\'type\' as type, * FROM cartodb.cdb_analysis_catalog WHERE username = \'{{=it._username}}\''
-);
-
-var tablesQueryTpl = dot.template([
-    "WITH analysis_tables AS (",
-    "    SELECT",
-    "        n.nspname AS nspname,",
-    "        c.relname AS relname,",
-    "        pg_total_relation_size(",
-    "            format('%s.%s', pg_catalog.quote_ident(n.nspname), pg_catalog.quote_ident(c.relname))",
-    "        ) AS size,",
-    "        format('%s.%s', pg_catalog.quote_ident(nspname), pg_catalog.quote_ident(relname)) AS fully_qualified_name",
-    "    FROM pg_catalog.pg_class c, pg_catalog.pg_namespace n",
-    "    WHERE c.relnamespace = n.oid",
-    "    AND pg_catalog.quote_ident(c.relname) ~ '^analysis_[a-z0-9]{10}_[a-z0-9]{40}$'",
-    "    AND n.nspname IN ('{{=it._username}}', 'public')",
-    ")",
-    "SELECT *, pg_size_pretty(size) as size_pretty",
-    "FROM analysis_tables",
-    "ORDER BY size DESC"
-].join('\n'));
-
-
-function getMetadata(username, pg, callback) {
-    var results = {
-        catalog: [],
-        tables: []
-    };
-    step(
-        function getCatalog() {
-            pg.query(catalogQueryTpl({_username: username}), this, true); // use read-only transaction
-        },
-        function handleCatalog(err, resultSet) {
-            assert.ifError(err);
-            resultSet = resultSet || {};
-            results.catalog = resultSet.rows || [];
-            this();
-        },
-        function getTables(err) {
-            assert.ifError(err);
-            pg.query(tablesQueryTpl({_username: username}), this, true); // use read-only transaction
-        },
-        function handleTables(err, resultSet) {
-            assert.ifError(err);
-            resultSet = resultSet || {};
-            results.tables = resultSet.rows || [];
-            this();
-        },
-        function finish(err) {
-            if (err) {
-                return callback(err);
-            }
-
-            return callback(null, results);
-        }
-    );
-}
-
-
-function dbParamsFromReqParams(params) {
-    var dbParams = {};
-    if ( params.dbuser ) {
-        dbParams.user = params.dbuser;
-    }
-    if ( params.dbpassword ) {
-        dbParams.pass = params.dbpassword;
-    }
-    if ( params.dbhost ) {
-        dbParams.host = params.dbhost;
-    }
-    if ( params.dbport ) {
-        dbParams.port = params.dbport;
-    }
-    if ( params.dbname ) {
-        dbParams.dbname = params.dbname;
-    }
-    return dbParams;
-}

lib/cartodb/controllers/base.js

@@ -1,289 +0,0 @@
-var assert = require('assert');
-
-var _ = require('underscore');
-var step = require('step');
-var debug = require('debug')('windshaft:cartodb');
-
-var LZMA = require('lzma').LZMA;
-var lzmaWorker = new LZMA();
-
-// Whitelist query parameters and attach format
-var REQUEST_QUERY_PARAMS_WHITELIST = [
-    'config',
-    'map_key',
-    'api_key',
-    'auth_token',
-    'callback',
-    'zoom',
-    'lon',
-    'lat',
-    // widgets & filters
-    'filters', // json
-    'own_filter', // 0, 1
-    'bbox', // w,s,e,n
-    'bins', // number
-    'start', // number
-    'end', // number
-    'column_type', // string
-    // widgets search
-    'q'
-];
-
-function BaseController(authApi, pgConnection) {
-    this.authApi = authApi;
-    this.pgConnection = pgConnection;
-}
-
-module.exports = BaseController;
-
-// jshint maxcomplexity:10
-/**
- * Whitelist input and get database name & default geometry type from
- * subdomain/user metadata held in CartoDB Redis
- * @param req - standard express request obj. Should have host & table
- * @param callback
- */
-BaseController.prototype.req2params = function(req, callback){
-    var self = this;
-
-    if ( req.query.lzma ) {
-
-        // Decode (from base64)
-        var lzma = new Buffer(req.query.lzma, 'base64')
-            .toString('binary')
-            .split('')
-            .map(function(c) {
-                return c.charCodeAt(0) - 128;
-            });
-
-
-        // Decompress
-        lzmaWorker.decompress(
-            lzma,
-            function(result) {
-                req.profiler.done('lzma');
-                try {
-                    delete req.query.lzma;
-                    _.extend(req.query, JSON.parse(result));
-                    self.req2params(req, callback);
-                } catch (err) {
-                    req.profiler.done('req2params');
-                    callback(new Error('Error parsing lzma as JSON: ' + err));
-                }
-            }
-        );
-        return;
-    }
-
-    var allowedQueryParams = REQUEST_QUERY_PARAMS_WHITELIST;
-    if (Array.isArray(req.context.allowedQueryParams)) {
-        allowedQueryParams = allowedQueryParams.concat(req.context.allowedQueryParams);
-    }
-    req.query = _.pick(req.query, allowedQueryParams);
-    req.params = _.extend({}, req.params); // shuffle things as request is a strange array/object
-
-    var user = req.context.user;
-
-    if ( req.params.token ) {
-        // Token might match the following patterns:
-        // - {user}@{tpl_id}@{token}:{cache_buster}
-        var tksplit = req.params.token.split(':');
-        req.params.token = tksplit[0];
-        if ( tksplit.length > 1 ) {
-            req.params.cache_buster= tksplit[1];
-        }
-        tksplit = req.params.token.split('@');
-        if ( tksplit.length > 1 ) {
-            req.params.signer = tksplit.shift();
-            if ( ! req.params.signer ) {
-                req.params.signer = user;
-            }
-            else if ( req.params.signer !== user ) {
-                var err = new Error(
-                        'Cannot use map signature of user "' + req.params.signer + '" on db of user "' + user + '"'
-                );
-                err.http_status = 403;
-                req.profiler.done('req2params');
-                callback(err);
-                return;
-            }
-            if ( tksplit.length > 1 ) {
-                /*var template_hash = */tksplit.shift(); // unused
-            }
-            req.params.token = tksplit.shift();
-        }
-    }
-
-    // bring all query values onto req.params object
-    _.extend(req.params, req.query);
-
-    req.profiler.done('req2params.setup');
-
-    step(
-        function getPrivacy(){
-            self.authApi.authorize(req, this);
-        },
-        function validateAuthorization(err, authorized) {
-            req.profiler.done('authorize');
-            assert.ifError(err);
-            if(!authorized) {
-                err = new Error("Sorry, you are unauthorized (permission denied)");
-                err.http_status = 403;
-                throw err;
-            }
-            return null;
-        },
-        function getDatabase(err){
-            assert.ifError(err);
-            self.pgConnection.setDBConn(user, req.params, this);
-        },
-        function finishSetup(err) {
-            if ( err ) {
-                req.profiler.done('req2params');
-                return callback(err, req);
-            }
-
-            // Add default database connection parameters
-            // if none given
-            _.defaults(req.params, {
-                dbuser: global.environment.postgres.user,
-                dbpassword: global.environment.postgres.password,
-                dbhost: global.environment.postgres.host,
-                dbport: global.environment.postgres.port
-            });
-
-            req.profiler.done('req2params');
-            callback(null, req);
-        }
-    );
-};
-// jshint maxcomplexity:6
-
-// jshint maxcomplexity:9
-BaseController.prototype.send = function(req, res, body, status, headers) {
-    if (req.params.dbhost) {
-        res.set('X-Served-By-DB-Host', req.params.dbhost);
-    }
-
-    res.set('X-Tiler-Profiler', req.profiler.toJSONString());
-
-    if (headers) {
-        res.set(headers);
-    }
-
-    res.status(status);
-
-    if (!Buffer.isBuffer(body) && typeof body === 'object') {
-        if (req.query && req.query.callback) {
-            res.jsonp(body);
-        } else {
-            res.json(body);
-        }
-    } else {
-        res.send(body);
-    }
-
-    try {
-        // May throw due to dns, see
-        // See http://github.com/CartoDB/Windshaft/issues/166
-        req.profiler.sendStats();
-    } catch (err) {
-        debug("error sending profiling stats: " + err);
-    }
-};
-// jshint maxcomplexity:6
-
-BaseController.prototype.sendError = function(req, res, err, label) {
-    var allErrors = Array.isArray(err) ? err : [err];
-    label = label || 'UNKNOWN';
-    err = allErrors[0] || new Error(label);
-    allErrors[0] = err;
-
-    var statusCode = findStatusCode(err);
-
-    debug('[%s ERROR] -- %d: %s, %s', label, statusCode, err, err.stack);
-
-    // If a callback was requested, force status to 200
-    if (req.query && req.query.callback) {
-        statusCode = 200;
-    }
-
-    var errorResponseBody = {
-        errors: allErrors.map(errorMessage),
-        errors_with_context: allErrors.map(errorMessageWithContext)
-    };
-
-    this.send(req, res, errorResponseBody, statusCode);
-};
-
-function stripConnectionInfo(message) {
-    // Strip connection info, if any
-    return message
-        // See https://github.com/CartoDB/Windshaft/issues/173
-        .replace(/Connection string: '[^']*'\n\s/im, '')
-        // See https://travis-ci.org/CartoDB/Windshaft/jobs/20703062#L1644
-        .replace(/is the server.*encountered/im, 'encountered');
-}
-
-function errorMessage(err) {
-    // See https://github.com/Vizzuality/Windshaft-cartodb/issues/68
-    var message = (_.isString(err) ? err : err.message) || 'Unknown error';
-
-    return stripConnectionInfo(message);
-}
-
-function errorMessageWithContext(err) {
-    // See https://github.com/Vizzuality/Windshaft-cartodb/issues/68
-    var message = (_.isString(err) ? err : err.message) || 'Unknown error';
-
-    var error = {
-        type: err.type || 'unknown',
-        message: stripConnectionInfo(message),
-    };
-
-    for (var prop in err) {
-        // type & message are properties from Error's prototype and will be skipped
-        if (err.hasOwnProperty(prop)) {
-            error[prop] = err[prop];
-        }
-    }
-
-    return error;
-}
-module.exports.errorMessage = errorMessage;
-
-function findStatusCode(err) {
-    var statusCode;
-    if ( err.http_status ) {
-        statusCode = err.http_status;
-    } else {
-        statusCode = statusFromErrorMessage('' + err);
-    }
-    return statusCode;
-}
-module.exports.findStatusCode = findStatusCode;
-
-function statusFromErrorMessage(errMsg) {
-    // Find an appropriate statusCode based on message
-    // jshint maxcomplexity:7
-    var statusCode = 400;
-    if ( -1 !== errMsg.indexOf('permission denied') ) {
-        statusCode = 403;
-    }
-    else if ( -1 !== errMsg.indexOf('authentication failed') ) {
-        statusCode = 403;
-    }
-    else if (errMsg.match(/Postgis Plugin.*[\s|\n].*column.*does not exist/)) {
-        statusCode = 400;
-    }
-    else if ( -1 !== errMsg.indexOf('does not exist') ) {
-        if ( -1 !== errMsg.indexOf(' role ') ) {
-            statusCode = 403; // role 'xxx' does not exist
-        } else if ( errMsg.match(/function .* does not exist/) ) {
-            statusCode = 400; // invalid SQL (SQL function does not exist)
-        } else {
-            statusCode = 404;
-        }
-    }
-    return statusCode;
-}

lib/cartodb/controllers/index.js

@@ -1,8 +0,0 @@
-module.exports = {
-    Analyses: require('./analyses'),
-    Layergroup: require('./layergroup'),
-    Map: require('./map'),
-    NamedMaps: require('./named_maps'),
-    NamedMapsAdmin: require('./named_maps_admin'),
-    ServerInfo: require('./server_info')
-};

lib/cartodb/controllers/layergroup.js

@@ -1,434 +0,0 @@
-var assert = require('assert');
-var step = require('step');
-
-var util = require('util');
-var BaseController = require('./base');
-
-var cors = require('../middleware/cors');
-var userMiddleware = require('../middleware/user');
-var allowQueryParams = require('../middleware/allow-query-params');
-
-var DataviewBackend = require('../backends/dataview');
-var AnalysisStatusBackend = require('../backends/analysis-status');
-
-var MapStoreMapConfigProvider = require('../models/mapconfig/provider/map-store-provider');
-
-var QueryTables = require('cartodb-query-tables');
-
-/**
- * @param {AuthApi} authApi
- * @param {PgConnection} pgConnection
- * @param {MapStore} mapStore
- * @param {TileBackend} tileBackend
- * @param {PreviewBackend} previewBackend
- * @param {AttributesBackend} attributesBackend
- * @param {SurrogateKeysCache} surrogateKeysCache
- * @param {UserLimitsApi} userLimitsApi
- * @param {LayergroupAffectedTables} layergroupAffectedTables
- * @param {AnalysisBackend} analysisBackend
- * @constructor
- */
-function LayergroupController(authApi, pgConnection, mapStore, tileBackend, previewBackend, attributesBackend,
-                              surrogateKeysCache, userLimitsApi, layergroupAffectedTables, analysisBackend) {
-    BaseController.call(this, authApi, pgConnection);
-
-    this.pgConnection = pgConnection;
-    this.mapStore = mapStore;
-    this.tileBackend = tileBackend;
-    this.previewBackend = previewBackend;
-    this.attributesBackend = attributesBackend;
-    this.surrogateKeysCache = surrogateKeysCache;
-    this.userLimitsApi = userLimitsApi;
-    this.layergroupAffectedTables = layergroupAffectedTables;
-
-    this.dataviewBackend = new DataviewBackend(analysisBackend);
-    this.analysisStatusBackend = new AnalysisStatusBackend();
-}
-
-util.inherits(LayergroupController, BaseController);
-
-module.exports = LayergroupController;
-
-
-LayergroupController.prototype.register = function(app) {
-    app.get(app.base_url_mapconfig +
-        '/:token/:z/:x/:y@:scale_factor?x.:format', cors(), userMiddleware,
-        this.tile.bind(this));
-
-    app.get(app.base_url_mapconfig +
-        '/:token/:z/:x/:y.:format', cors(), userMiddleware,
-        this.tile.bind(this));
-
-    app.get(app.base_url_mapconfig +
-        '/:token/:layer/:z/:x/:y.(:format)', cors(), userMiddleware,
-        this.layer.bind(this));
-
-    app.get(app.base_url_mapconfig +
-        '/:token/:layer/attributes/:fid', cors(), userMiddleware,
-        this.attributes.bind(this));
-
-    app.get(app.base_url_mapconfig +
-        '/static/center/:token/:z/:lat/:lng/:width/:height.:format',
-        cors(), userMiddleware, allowQueryParams(['layer']),
-        this.center.bind(this));
-
-    app.get(app.base_url_mapconfig +
-        '/static/bbox/:token/:west,:south,:east,:north/:width/:height.:format',
-        cors(), userMiddleware, allowQueryParams(['layer']),
-        this.bbox.bind(this));
-
-    // Undocumented/non-supported API endpoint methods.
-    // Use at your own peril.
-    app.get(app.base_url_mapconfig +
-            '/:token/dataview/:dataviewName', cors(), userMiddleware,
-        this.dataview.bind(this));
-    app.get(app.base_url_mapconfig +
-            '/:token/:layer/widget/:dataviewName', cors(), userMiddleware,
-        this.dataview.bind(this));
-
-    app.get(app.base_url_mapconfig +
-            '/:token/dataview/:dataviewName/search', cors(), userMiddleware,
-        this.dataviewSearch.bind(this));
-    app.get(app.base_url_mapconfig +
-            '/:token/:layer/widget/:dataviewName/search', cors(), userMiddleware,
-        this.dataviewSearch.bind(this));
-
-    app.get(app.base_url_mapconfig +
-        '/:token/analysis/node/:nodeId', cors(), userMiddleware,
-        this.analysisNodeStatus.bind(this));
-};
-
-LayergroupController.prototype.analysisNodeStatus = function(req, res) {
-    var self = this;
-
-    step(
-        function setupParams() {
-            self.req2params(req, this);
-        },
-        function retrieveNodeStatus(err) {
-            assert.ifError(err);
-            self.analysisStatusBackend.getNodeStatus(req.params, this);
-        },
-        function finish(err, nodeStatus, stats) {
-            req.profiler.add(stats || {});
-
-            if (err) {
-                self.sendError(req, res, err, 'GET NODE STATUS');
-            } else {
-                self.sendResponse(req, res, nodeStatus, 200, {
-                    'Cache-Control': 'public,max-age=5',
-                    'Last-Modified': new Date().toUTCString()
-                });
-            }
-        }
-    );
-};
-
-LayergroupController.prototype.dataview = function(req, res) {
-    var self = this;
-
-    step(
-        function setupParams() {
-            self.req2params(req, this);
-        },
-        function retrieveDataview(err) {
-            assert.ifError(err);
-
-            var mapConfigProvider = new MapStoreMapConfigProvider(
-                self.mapStore, req.context.user, self.userLimitsApi, req.params
-            );
-            self.dataviewBackend.getDataview(mapConfigProvider, req.context.user, req.params, this);
-        },
-        function finish(err, dataview, stats) {
-            req.profiler.add(stats || {});
-
-            if (err) {
-                self.sendError(req, res, err, 'GET DATAVIEW');
-            } else {
-                self.sendResponse(req, res, dataview, 200);
-            }
-        }
-    );
-
-};
-
-LayergroupController.prototype.dataviewSearch = function(req, res) {
-    var self = this;
-
-    step(
-        function setupParams() {
-            self.req2params(req, this);
-        },
-        function searchDataview(err) {
-            assert.ifError(err);
-
-            var mapConfigProvider = new MapStoreMapConfigProvider(
-                self.mapStore, req.context.user, self.userLimitsApi, req.params
-            );
-            self.dataviewBackend.search(mapConfigProvider, req.context.user, req.params, this);
-        },
-        function finish(err, searchResult, stats) {
-            req.profiler.add(stats || {});
-
-            if (err) {
-                self.sendError(req, res, err, 'GET DATAVIEW SEARCH');
-            } else {
-                self.sendResponse(req, res, searchResult, 200);
-            }
-        }
-    );
-
-};
-
-LayergroupController.prototype.attributes = function(req, res) {
-    var self = this;
-
-    req.profiler.start('windshaft.maplayer_attribute');
-
-    step(
-        function setupParams() {
-            self.req2params(req, this);
-        },
-        function retrieveFeatureAttributes(err) {
-            assert.ifError(err);
-
-            var mapConfigProvider = new MapStoreMapConfigProvider(
-                self.mapStore, req.context.user, self.userLimitsApi, req.params
-            );
-            self.attributesBackend.getFeatureAttributes(mapConfigProvider, req.params, false, this);
-        },
-        function finish(err, tile, stats) {
-            req.profiler.add(stats || {});
-
-            if (err) {
-                self.sendError(req, res, err, 'GET ATTRIBUTES');
-            } else {
-                self.sendResponse(req, res, tile, 200);
-            }
-        }
-    );
-
-};
-
-// Gets a tile for a given token and set of tile ZXY coords. (OSM style)
-LayergroupController.prototype.tile = function(req, res) {
-    req.profiler.start('windshaft.map_tile');
-    this.tileOrLayer(req, res);
-};
-
-// Gets a tile for a given token, layer set of tile ZXY coords. (OSM style)
-LayergroupController.prototype.layer = function(req, res, next) {
-    if (req.params.token === 'static') {
-        return next();
-    }
-    req.profiler.start('windshaft.maplayer_tile');
-    this.tileOrLayer(req, res);
-};
-
-LayergroupController.prototype.tileOrLayer = function (req, res) {
-    var self = this;
-
-    step(
-        function mapController$prepareParams() {
-            self.req2params(req, this);
-        },
-        function mapController$getTileOrGrid(err) {
-            assert.ifError(err);
-            self.tileBackend.getTile(
-                new MapStoreMapConfigProvider(self.mapStore, req.context.user, self.userLimitsApi, req.params),
-                req.params, this
-            );
-        },
-        function mapController$finalize(err, tile, headers, stats) {
-            req.profiler.add(stats);
-            self.finalizeGetTileOrGrid(err, req, res, tile, headers);
-        }
-    );
-};
-
-// This function is meant for being called as the very last
-// step by all endpoints serving tiles or grids
-LayergroupController.prototype.finalizeGetTileOrGrid = function(err, req, res, tile, headers) {
-    var supportedFormats = {
-        grid_json: true,
-        json_torque: true,
-        torque_json: true,
-        png: true
-    };
-
-    var formatStat = 'invalid';
-    if (req.params.format) {
-        var format = req.params.format.replace('.', '_');
-        if (supportedFormats[format]) {
-            formatStat = format;
-        }
-    }
-
-    if (err) {
-        // See https://github.com/Vizzuality/Windshaft-cartodb/issues/68
-        var errMsg = err.message ? ( '' + err.message ) : ( '' + err );
-
-        // Rewrite mapnik parsing errors to start with layer number
-        var matches = errMsg.match("(.*) in style 'layer([0-9]+)'");
-        if (matches) {
-            errMsg = 'style'+matches[2]+': ' + matches[1];
-        }
-        err.message = errMsg;
-
-        this.sendError(req, res, err, 'TILE RENDER');
-        global.statsClient.increment('windshaft.tiles.error');
-        global.statsClient.increment('windshaft.tiles.' + formatStat + '.error');
-    } else {
-        this.sendResponse(req, res, tile, 200, headers);
-        global.statsClient.increment('windshaft.tiles.success');
-        global.statsClient.increment('windshaft.tiles.' + formatStat + '.success');
-    }
-};
-
-LayergroupController.prototype.bbox = function(req, res) {
-    this.staticMap(req, res, +req.params.width, +req.params.height, {
-        west: +req.params.west,
-        north: +req.params.north,
-        east: +req.params.east,
-        south: +req.params.south
-    });
-};
-
-LayergroupController.prototype.center = function(req, res) {
-    this.staticMap(req, res, +req.params.width, +req.params.height, +req.params.z, {
-        lng: +req.params.lng,
-        lat: +req.params.lat
-    });
-};
-
-LayergroupController.prototype.staticMap = function(req, res, width, height, zoom /* bounds */, center) {
-    var format = req.params.format === 'jpg' ? 'jpeg' : 'png';
-    req.params.layer = 'all';
-    req.params.format = 'png';
-
-    var self = this;
-
-    step(
-        function reqParams() {
-            self.req2params(req, this);
-        },
-        function getImage(err) {
-            assert.ifError(err);
-            if (center) {
-                self.previewBackend.getImage(
-                    new MapStoreMapConfigProvider(self.mapStore, req.context.user, self.userLimitsApi, req.params),
-                    format, width, height, zoom, center, this);
-            } else {
-                self.previewBackend.getImage(
-                    new MapStoreMapConfigProvider(self.mapStore, req.context.user, self.userLimitsApi, req.params),
-                    format, width, height, zoom /* bounds */, this);
-            }
-        },
-        function handleImage(err, image, headers, stats) {
-            req.profiler.done('render-' + format);
-            req.profiler.add(stats || {});
-
-            if (err) {
-                self.sendError(req, res, err, 'STATIC_MAP');
-            } else {
-                res.set('Content-Type', headers['Content-Type'] || 'image/' + format);
-                self.sendResponse(req, res, image, 200);
-            }
-        }
-    );
-};
-
-LayergroupController.prototype.sendResponse = function(req, res, body, status, headers) {
-    var self = this;
-
-    req.profiler.done('res');
-
-    res.set('Cache-Control', 'public,max-age=31536000');
-
-    // Set Last-Modified header
-    var lastUpdated;
-    if (req.params.cache_buster) {
-        // Assuming cache_buster is a timestamp
-        lastUpdated = new Date(parseInt(req.params.cache_buster));
-    } else {
-        lastUpdated = new Date();
-    }
-    res.set('Last-Modified', lastUpdated.toUTCString());
-
-    var dbName = req.params.dbname;
-    step(
-        function getAffectedTables() {
-            self.getAffectedTables(req.context.user, dbName, req.params.token, this);
-        },
-        function sendResponse(err, affectedTables) {
-            req.profiler.done('affectedTables');
-            if (err) {
-                global.logger.warn('ERROR generating cache channel: ' + err);
-            }
-            if (!!affectedTables) {
-                res.set('X-Cache-Channel', affectedTables.getCacheChannel());
-                self.surrogateKeysCache.tag(res, affectedTables);
-            }
-            self.send(req, res, body, status, headers);
-        }
-    );
-
-};
-
-LayergroupController.prototype.getAffectedTables = function(user, dbName, layergroupId, callback) {
-
-    if (this.layergroupAffectedTables.hasAffectedTables(dbName, layergroupId)) {
-        return callback(null, this.layergroupAffectedTables.get(dbName, layergroupId));
-    }
-
-    var self = this;
-    step(
-        function extractSQL() {
-            step(
-                function loadFromStore() {
-                    self.mapStore.load(layergroupId, this);
-                },
-                function getSQL(err, mapConfig) {
-                    assert.ifError(err);
-
-                    var queries = mapConfig.getLayers()
-                        .map(function(lyr) {
-                            return lyr.options.sql;
-                        })
-                        .filter(function(sql) {
-                            return !!sql;
-                        });
-
-                    return queries.length ? queries.join(';') : null;
-                },
-                this
-            );
-        },
-        function findAffectedTables(err, sql) {
-            assert.ifError(err);
-
-            if ( ! sql ) {
-                throw new Error("this request doesn't need an X-Cache-Channel generated");
-            }
-
-            step(
-                function getConnection() {
-                    self.pgConnection.getConnection(user, this);
-                },
-                function getAffectedTables(err, connection) {
-                    assert.ifError(err);
-
-                    QueryTables.getAffectedTablesFromQuery(connection, sql, this);
-                },
-                this
-            );
-        },
-        function buildCacheChannel(err, tables) {
-            assert.ifError(err);
-            self.layergroupAffectedTables.set(dbName, layergroupId, tables);
-
-            return tables;
-        },
-        callback
-    );
-};

lib/cartodb/controllers/map.js

@@ -1,433 +0,0 @@
-var _ = require('underscore');
-var assert = require('assert');
-var step = require('step');
-var windshaft = require('windshaft');
-var QueryTables = require('cartodb-query-tables');
-
-var ResourceLocator = require('../models/resource-locator');
-
-var util = require('util');
-var BaseController = require('./base');
-
-var cors = require('../middleware/cors');
-var userMiddleware = require('../middleware/user');
-
-var MapConfig = windshaft.model.MapConfig;
-var Datasource = windshaft.model.Datasource;
-
-var NamedMapsCacheEntry = require('../cache/model/named_maps_entry');
-
-var NamedMapMapConfigProvider = require('../models/mapconfig/provider/named-map-provider');
-var CreateLayergroupMapConfigProvider = require('../models/mapconfig/provider/create-layergroup-provider');
-
-/**
- * @param {AuthApi} authApi
- * @param {PgConnection} pgConnection
- * @param {TemplateMaps} templateMaps
- * @param {MapBackend} mapBackend
- * @param metadataBackend
- * @param {SurrogateKeysCache} surrogateKeysCache
- * @param {UserLimitsApi} userLimitsApi
- * @param {LayergroupAffectedTables} layergroupAffectedTables
- * @param {MapConfigAdapter} mapConfigAdapter
- * @constructor
- */
-function MapController(authApi, pgConnection, templateMaps, mapBackend, metadataBackend,
-                       surrogateKeysCache, userLimitsApi, layergroupAffectedTables, mapConfigAdapter) {
-
-    BaseController.call(this, authApi, pgConnection);
-
-    this.pgConnection = pgConnection;
-    this.templateMaps = templateMaps;
-    this.mapBackend = mapBackend;
-    this.metadataBackend = metadataBackend;
-    this.surrogateKeysCache = surrogateKeysCache;
-    this.userLimitsApi = userLimitsApi;
-    this.layergroupAffectedTables = layergroupAffectedTables;
-
-    this.mapConfigAdapter = mapConfigAdapter;
-    this.resourceLocator = new ResourceLocator(global.environment);
-}
-
-util.inherits(MapController, BaseController);
-
-module.exports = MapController;
-
-
-MapController.prototype.register = function(app) {
-    app.get(app.base_url_mapconfig, cors(), userMiddleware, this.createGet.bind(this));
-    app.post(app.base_url_mapconfig, cors(), userMiddleware, this.createPost.bind(this));
-    app.get(app.base_url_templated + '/:template_id/jsonp', cors(), userMiddleware, this.jsonp.bind(this));
-    app.post(app.base_url_templated + '/:template_id', cors(), userMiddleware, this.instantiate.bind(this));
-    app.options(app.base_url_mapconfig, cors('Content-Type'));
-};
-
-MapController.prototype.createGet = function(req, res){
-    req.profiler.start('windshaft.createmap_get');
-
-    this.create(req, res, function createGet$prepareConfig(err, req) {
-        assert.ifError(err);
-        if ( ! req.params.config ) {
-            throw new Error('layergroup GET needs a "config" parameter');
-        }
-        return JSON.parse(req.params.config);
-    });
-};
-
-MapController.prototype.createPost = function(req, res) {
-    req.profiler.start('windshaft.createmap_post');
-
-    this.create(req, res, function createPost$prepareConfig(err, req) {
-        assert.ifError(err);
-        if (!req.is('application/json')) {
-            throw new Error('layergroup POST data must be of type application/json');
-        }
-        return req.body;
-    });
-};
-
-MapController.prototype.instantiate = function(req, res) {
-    req.profiler.start('windshaft-cartodb.instance_template_post');
-
-    this.instantiateTemplate(req, res, function prepareTemplateParams(callback) {
-        if (!req.is('application/json')) {
-            return callback(new Error('Template POST data must be of type application/json'));
-        }
-        return callback(null, req.body);
-    });
-};
-
-MapController.prototype.jsonp = function(req, res) {
-    req.profiler.start('windshaft-cartodb.instance_template_get');
-
-    this.instantiateTemplate(req, res, function prepareJsonTemplateParams(callback) {
-        var err = null;
-        if ( req.query.callback === undefined || req.query.callback.length === 0) {
-            err = new Error('callback parameter should be present and be a function name');
-        }
-
-        var templateParams = {};
-        if (req.query.config) {
-            try {
-                templateParams = JSON.parse(req.query.config);
-            } catch(e) {
-                err = new Error('Invalid config parameter, should be a valid JSON');
-            }
-        }
-
-        return callback(err, templateParams);
-    });
-};
-
-MapController.prototype.create = function(req, res, prepareConfigFn) {
-    var self = this;
-
-    var mapConfig;
-
-    var context = {};
-
-    step(
-        function setupParams(){
-            self.req2params(req, this);
-        },
-        prepareConfigFn,
-        function prepareAdapterMapConfig(err, requestMapConfig) {
-            assert.ifError(err);
-            context.analysisConfiguration = {
-                user: req.context.user,
-                db: {
-                    host: req.params.dbhost,
-                    port: req.params.dbport,
-                    dbname: req.params.dbname,
-                    user: req.params.dbuser,
-                    pass: req.params.dbpassword
-                },
-                batch: {
-                    username: req.context.user,
-                    apiKey: req.params.api_key
-                }
-            };
-            self.mapConfigAdapter.getMapConfig(req.context.user, requestMapConfig, req.params, context, this);
-        },
-        function createLayergroup(err, requestMapConfig) {
-            assert.ifError(err);
-            var datasource = context.datasource || Datasource.EmptyDatasource();
-            mapConfig = new MapConfig(requestMapConfig, datasource);
-            self.mapBackend.createLayergroup(
-                mapConfig, req.params,
-                new CreateLayergroupMapConfigProvider(mapConfig, req.context.user, self.userLimitsApi, req.params),
-                this
-            );
-        },
-        function afterLayergroupCreate(err, layergroup) {
-            assert.ifError(err);
-            self.afterLayergroupCreate(req, res, mapConfig, layergroup, context.analysesResults, this);
-        },
-        function finish(err, layergroup) {
-            if (err) {
-                if (Number.isFinite(err.layerIndex)) {
-                    var error = new Error(err.message);
-                    error.http_status = err.http_status;
-
-                    if (!err.http_status && err.message.indexOf('column "the_geom_webmercator" does not exist') >= 0) {
-                        error.http_status = 400;
-                    }
-
-                    error.type = 'layer';
-                    error.subtype = err.message.indexOf('Postgis Plugin') >= 0 ? 'query' : undefined;
-                    error.layer = {
-                        id: mapConfig.getLayerId(err.layerIndex),
-                        index: err.layerIndex,
-                        type: mapConfig.layerType(err.layerIndex)
-                    };
-
-                    err = error;
-                }
-                self.sendError(req, res, err, 'ANONYMOUS LAYERGROUP');
-            } else {
-                var analysesResults = context.analysesResults || [];
-                self.addDataviewsAndWidgetsUrls(req.context.user, layergroup, mapConfig.obj());
-                self.addAnalysesMetadata(req.context.user, layergroup, analysesResults, true);
-                addContextMetadata(layergroup, mapConfig.obj(), context);
-                res.set('X-Layergroup-Id', layergroup.layergroupid);
-                self.send(req, res, layergroup, 200);
-            }
-        }
-    );
-};
-
-function addContextMetadata(layergroup, mapConfig, context) {
-    if (layergroup.metadata && Array.isArray(layergroup.metadata.layers) && Array.isArray(mapConfig.layers)) {
-        layergroup.metadata.layers = layergroup.metadata.layers.map(function(layer, layerIndex) {
-            if (context.turboCarto && Array.isArray(context.turboCarto.layers)) {
-                layer.meta.cartocss_meta = context.turboCarto.layers[layerIndex];
-            }
-            return layer;
-        });
-    }
-}
-
-MapController.prototype.instantiateTemplate = function(req, res, prepareParamsFn) {
-    var self = this;
-
-    var cdbuser = req.context.user;
-
-    var mapConfigProvider;
-    var mapConfig;
-
-    step(
-        function setupParams(){
-            self.req2params(req, this);
-        },
-        function getTemplateParams() {
-            prepareParamsFn(this);
-        },
-        function getTemplate(err, templateParams) {
-            assert.ifError(err);
-            mapConfigProvider = new NamedMapMapConfigProvider(
-                self.templateMaps,
-                self.pgConnection,
-                self.metadataBackend,
-                self.userLimitsApi,
-                self.mapConfigAdapter,
-                cdbuser,
-                req.params.template_id,
-                templateParams,
-                req.query.auth_token,
-                req.params
-            );
-            mapConfigProvider.getMapConfig(this);
-        },
-        function createLayergroup(err, mapConfig_, rendererParams) {
-            assert.ifError(err);
-            mapConfig = mapConfig_;
-            self.mapBackend.createLayergroup(
-                mapConfig, rendererParams,
-                new CreateLayergroupMapConfigProvider(mapConfig, cdbuser, self.userLimitsApi, rendererParams),
-                this
-            );
-        },
-        function afterLayergroupCreate(err, layergroup) {
-            assert.ifError(err);
-            self.afterLayergroupCreate(req, res, mapConfig, layergroup, mapConfigProvider.analysesResults, this);
-        },
-        function finishTemplateInstantiation(err, layergroup) {
-            if (err) {
-                self.sendError(req, res, err, 'NAMED MAP LAYERGROUP');
-            } else {
-                var templateHash = self.templateMaps.fingerPrint(mapConfigProvider.template).substring(0, 8);
-                layergroup.layergroupid = cdbuser + '@' + templateHash + '@' + layergroup.layergroupid;
-
-                var _mapConfig = mapConfig.obj();
-                self.addDataviewsAndWidgetsUrls(cdbuser, layergroup, _mapConfig);
-                self.addAnalysesMetadata(cdbuser, layergroup, mapConfigProvider.analysesResults);
-                addContextMetadata(layergroup, _mapConfig, mapConfigProvider.context);
-
-                res.set('X-Layergroup-Id', layergroup.layergroupid);
-                self.surrogateKeysCache.tag(res, new NamedMapsCacheEntry(cdbuser, mapConfigProvider.getTemplateName()));
-
-                self.send(req, res, layergroup, 200);
-            }
-        }
-    );
-};
-
-MapController.prototype.afterLayergroupCreate = function(req, res, mapconfig, layergroup, analysesResults, callback) {
-    var self = this;
-
-    var username = req.context.user;
-
-    var tasksleft = 2; // redis key and affectedTables
-    var errors = [];
-
-    var done = function(err) {
-        if ( err ) {
-            errors.push('' + err);
-        }
-        if ( ! --tasksleft ) {
-            err = errors.length ? new Error(errors.join('\n')) : null;
-            callback(err, layergroup);
-        }
-    };
-
-    // include in layergroup response the variables in serverMedata
-    // those variables are useful to send to the client information
-    // about how to reach this server or information about it
-    _.extend(layergroup, global.environment.serverMetadata);
-
-    // Don't wait for the mapview count increment to
-    // take place before proceeding. Error will be logged
-    // asynchronously
-    this.metadataBackend.incMapviewCount(username, mapconfig.obj().stat_tag, function(err) {
-        req.profiler.done('incMapviewCount');
-        if ( err ) {
-            global.logger.log("ERROR: failed to increment mapview count for user '" + username + "': " + err);
-        }
-        done();
-    });
-
-    var sql = mapconfig.getLayers().map(function(layer) {
-        return layer.options.sql;
-    }).join(';');
-
-    var dbName = req.params.dbname;
-    var layergroupId = layergroup.layergroupid;
-
-    step(
-        function getPgConnection() {
-            self.pgConnection.getConnection(username, this);
-        },
-        function getAffectedTablesAndLastUpdatedTime(err, connection) {
-            assert.ifError(err);
-            QueryTables.getAffectedTablesFromQuery(connection, sql, this);
-        },
-        function handleAffectedTablesAndLastUpdatedTime(err, result) {
-            req.profiler.done('queryTablesAndLastUpdated');
-            assert.ifError(err);
-            // feed affected tables cache so it can be reused from, for instance, layergroup controller
-            self.layergroupAffectedTables.set(dbName, layergroupId, result);
-
-            var lastUpdateTime = result.getLastUpdatedAt();
-            lastUpdateTime = getLastUpdatedTime(analysesResults, lastUpdateTime) || lastUpdateTime;
-
-            // last update for layergroup cache buster
-            layergroup.layergroupid = layergroup.layergroupid + ':' + lastUpdateTime;
-            layergroup.last_updated = new Date(lastUpdateTime).toISOString();
-
-            if (req.method === 'GET') {
-                var ttl = global.environment.varnish.layergroupTtl || 86400;
-                res.set('Cache-Control', 'public,max-age='+ttl+',must-revalidate');
-                res.set('Last-Modified', (new Date()).toUTCString());
-                res.set('X-Cache-Channel', result.getCacheChannel());
-                if (result.tables && result.tables.length > 0) {
-                    self.surrogateKeysCache.tag(res, result);
-                }
-            }
-
-            return null;
-        },
-        function finish(err) {
-            done(err);
-        }
-    );
-};
-
-function getLastUpdatedTime(analysesResults, lastUpdateTime) {
-    if (!Array.isArray(analysesResults)) {
-        return lastUpdateTime;
-    }
-    return analysesResults.reduce(function(lastUpdateTime, analysis) {
-        return analysis.getNodes().reduce(function(lastNodeUpdatedAtTime, node) {
-            var nodeUpdatedAtDate = node.getUpdatedAt();
-            var nodeUpdatedTimeAt = (nodeUpdatedAtDate && nodeUpdatedAtDate.getTime()) || 0;
-            return nodeUpdatedTimeAt > lastNodeUpdatedAtTime ? nodeUpdatedTimeAt : lastNodeUpdatedAtTime;
-        }, lastUpdateTime);
-    }, lastUpdateTime);
-}
-
-MapController.prototype.addAnalysesMetadata = function(username, layergroup, analysesResults, includeQuery) {
-    includeQuery = includeQuery || false;
-    analysesResults = analysesResults || [];
-    layergroup.metadata.analyses = [];
-
-    analysesResults.forEach(function(analysis) {
-        var nodes = analysis.getNodes();
-        layergroup.metadata.analyses.push({
-            nodes: nodes.reduce(function(nodesIdMap, node) {
-                if (node.params.id) {
-                    var nodeResource = layergroup.layergroupid + '/analysis/node/' + node.id();
-                    var nodeRepr = {
-                        status: node.getStatus(),
-                        url: this.resourceLocator.getUrls(username, nodeResource)
-                    };
-                    if (includeQuery) {
-                        nodeRepr.query = node.getQuery();
-                    }
-                    if (node.getStatus() === 'failed') {
-                        nodeRepr.error_message = node.getErrorMessage();
-                    }
-                    nodesIdMap[node.params.id] = nodeRepr;
-                }
-
-                return nodesIdMap;
-            }.bind(this), {})
-        });
-    }.bind(this));
-};
-
-// TODO this should take into account several URL patterns
-MapController.prototype.addDataviewsAndWidgetsUrls = function(username, layergroup, mapConfig) {
-    this.addDataviewsUrls(username, layergroup, mapConfig);
-    this.addWidgetsUrl(username, layergroup, mapConfig);
-};
-
-MapController.prototype.addDataviewsUrls = function(username, layergroup, mapConfig) {
-    layergroup.metadata.dataviews = layergroup.metadata.dataviews || {};
-    var dataviews = mapConfig.dataviews || {};
-
-    Object.keys(dataviews).forEach(function(dataviewName) {
-        var resource = layergroup.layergroupid + '/dataview/' + dataviewName;
-        layergroup.metadata.dataviews[dataviewName] = {
-            url: this.resourceLocator.getUrls(username, resource)
-        };
-    }.bind(this));
-};
-
-MapController.prototype.addWidgetsUrl = function(username, layergroup, mapConfig) {
-    if (layergroup.metadata && Array.isArray(layergroup.metadata.layers) && Array.isArray(mapConfig.layers)) {
-        layergroup.metadata.layers = layergroup.metadata.layers.map(function(layer, layerIndex) {
-            var mapConfigLayer = mapConfig.layers[layerIndex];
-            if (mapConfigLayer.options && mapConfigLayer.options.widgets) {
-                layer.widgets = layer.widgets || {};
-                Object.keys(mapConfigLayer.options.widgets).forEach(function(widgetName) {
-                    var resource = layergroup.layergroupid + '/' + layerIndex + '/widget/' + widgetName;
-                    layer.widgets[widgetName] = {
-                        type: mapConfigLayer.options.widgets[widgetName].type,
-                        url: this.resourceLocator.getUrls(username, resource)
-                    };
-                }.bind(this));
-            }
-            return layer;
-        }.bind(this));
-    }
-};

lib/cartodb/controllers/named_maps.js

@@ -1,350 +0,0 @@
-var step = require('step');
-var assert = require('assert');
-var _ = require('underscore');
-var NamedMapsCacheEntry = require('../cache/model/named_maps_entry');
-
-var util = require('util');
-var BaseController = require('./base');
-
-var cors = require('../middleware/cors');
-var userMiddleware = require('../middleware/user');
-var allowQueryParams = require('../middleware/allow-query-params');
-
-function NamedMapsController(authApi, pgConnection, namedMapProviderCache, tileBackend, previewBackend,
-                             surrogateKeysCache, tablesExtentApi, metadataBackend) {
-    BaseController.call(this, authApi, pgConnection);
-
-    this.namedMapProviderCache = namedMapProviderCache;
-    this.tileBackend = tileBackend;
-    this.previewBackend = previewBackend;
-    this.surrogateKeysCache = surrogateKeysCache;
-    this.tablesExtentApi = tablesExtentApi;
-    this.metadataBackend = metadataBackend;
-}
-
-util.inherits(NamedMapsController, BaseController);
-
-module.exports = NamedMapsController;
-
-NamedMapsController.prototype.register = function(app) {
-    app.get(app.base_url_templated +
-        '/:template_id/:layer/:z/:x/:y.(:format)', cors(), userMiddleware,
-        this.tile.bind(this));
-
-    app.get(app.base_url_mapconfig +
-        '/static/named/:template_id/:width/:height.:format', cors(), userMiddleware, allowQueryParams(['layer']),
-        this.staticMap.bind(this));
-};
-
-NamedMapsController.prototype.sendResponse = function(req, res, resource, headers, namedMapProvider) {
-    this.surrogateKeysCache.tag(res, new NamedMapsCacheEntry(req.context.user, namedMapProvider.getTemplateName()));
-    res.set('Content-Type', headers['content-type'] || headers['Content-Type'] || 'image/png');
-    res.set('Cache-Control', 'public,max-age=7200,must-revalidate');
-
-    var self = this;
-
-    step(
-        function getAffectedTablesAndLastUpdatedTime() {
-            namedMapProvider.getAffectedTablesAndLastUpdatedTime(this);
-        },
-        function sendResponse(err, result) {
-            req.profiler.done('affectedTables');
-            if (err) {
-                global.logger.log('ERROR generating cache channel: ' + err);
-            }
-            if (!result || !!result.tables) {
-                // we increase cache control as we can invalidate it
-                res.set('Cache-Control', 'public,max-age=31536000');
-
-                var lastModifiedDate;
-                if (Number.isFinite(result.lastUpdatedTime)) {
-                    lastModifiedDate = new Date(result.getLastUpdatedAt());
-                } else {
-                    lastModifiedDate = new Date();
-                }
-                res.set('Last-Modified', lastModifiedDate.toUTCString());
-
-                res.set('X-Cache-Channel', result.getCacheChannel());
-                if (result.tables.length > 0) {
-                    self.surrogateKeysCache.tag(res, result);
-                }
-            }
-            self.send(req, res, resource, 200);
-        }
-    );
-};
-
-NamedMapsController.prototype.tile = function(req, res) {
-    var self = this;
-
-    var cdbUser = req.context.user;
-
-    var namedMapProvider;
-    step(
-        function reqParams() {
-            self.req2params(req, this);
-        },
-        function getNamedMapProvider(err) {
-            assert.ifError(err);
-            self.namedMapProviderCache.get(
-                cdbUser,
-                req.params.template_id,
-                req.query.config,
-                req.query.auth_token,
-                req.params,
-                this
-            );
-        },
-        function getTile(err, _namedMapProvider) {
-            assert.ifError(err);
-            namedMapProvider = _namedMapProvider;
-            self.tileBackend.getTile(namedMapProvider, req.params, this);
-        },
-        function handleImage(err, tile, headers, stats) {
-            req.profiler.add(stats);
-            if (err) {
-                self.sendError(req, res, err, 'NAMED_MAP_TILE');
-            } else {
-                self.sendResponse(req, res, tile, headers, namedMapProvider);
-            }
-        }
-    );
-};
-
-NamedMapsController.prototype.staticMap = function(req, res) {
-    var self = this;
-
-    var cdbUser = req.context.user;
-
-    var format = req.params.format === 'jpg' ? 'jpeg' : 'png';
-    req.params.format = 'png';
-    req.params.layer = 'all';
-
-    var namedMapProvider;
-    step(
-        function reqParams() {
-            self.req2params(req, this);
-        },
-        function getNamedMapProvider(err) {
-            assert.ifError(err);
-            self.namedMapProviderCache.get(
-                cdbUser,
-                req.params.template_id,
-                req.query.config,
-                req.query.auth_token,
-                req.params,
-                this
-            );
-        },
-        function prepareLayerVisibility(err, _namedMapProvider) {
-            assert.ifError(err);
-
-            namedMapProvider = _namedMapProvider;
-
-            self.prepareLayerFilterFromPreviewLayers(cdbUser, req, namedMapProvider, this);
-        },
-        function prepareImageOptions(err) {
-            assert.ifError(err);
-            self.getStaticImageOptions(cdbUser, req.params, namedMapProvider, this);
-        },
-        function getImage(err, imageOpts) {
-            assert.ifError(err);
-
-            var width = +req.params.width;
-            var height = +req.params.height;
-
-            if (!_.isUndefined(imageOpts.zoom) && imageOpts.center) {
-                self.previewBackend.getImage(
-                    namedMapProvider, format, width, height, imageOpts.zoom, imageOpts.center, this);
-            } else {
-                self.previewBackend.getImage(
-                    namedMapProvider, format, width, height, imageOpts.bounds, this);
-            }
-        },
-        function incrementMapViews(err, image, headers, stats) {
-            assert.ifError(err);
-
-            var next = this;
-            namedMapProvider.getMapConfig(function(mapConfigErr, mapConfig) {
-                self.metadataBackend.incMapviewCount(cdbUser, mapConfig.obj().stat_tag, function(sErr) {
-                    if (err) {
-                        global.logger.log("ERROR: failed to increment mapview count for user '%s': %s", cdbUser, sErr);
-                    }
-                    next(err, image, headers, stats);
-                });
-            });
-        },
-        function handleImage(err, image, headers, stats) {
-            req.profiler.done('render-' + format);
-            req.profiler.add(stats || {});
-
-            if (err) {
-                self.sendError(req, res, err, 'STATIC_VIZ_MAP');
-            } else {
-                self.sendResponse(req, res, image, headers, namedMapProvider);
-            }
-        }
-    );
-};
-
-NamedMapsController.prototype.prepareLayerFilterFromPreviewLayers = function (user, req, namedMapProvider, callback) {
-    var self = this;
-    namedMapProvider.getTemplate(function (err, template) {
-        if (err) {
-            return callback(err);
-        }
-
-        if (!template || !template.view || !template.view.preview_layers) {
-           return callback();
-        }
-
-        var previewLayers = template.view.preview_layers;
-        var layerVisibilityFilter = [];
-
-        template.layergroup.layers.forEach(function (layer, index) {
-            if (previewLayers[''+index] !== false && previewLayers[layer.id] !== false) {
-                layerVisibilityFilter.push(''+index);
-            }
-        });
-
-        if (!layerVisibilityFilter.length) {
-            return callback();
-        }
-
-        // overwrites 'all' default filter
-        req.params.layer = layerVisibilityFilter.join(',');
-
-        // recreates the provider
-        self.namedMapProviderCache.get(
-            user,
-            req.params.template_id,
-            req.query.config,
-            req.query.auth_token,
-            req.params,
-            callback
-        );
-    });
-};
-
-var DEFAULT_ZOOM_CENTER = {
-    zoom: 1,
-    center: {
-        lng: 0,
-        lat: 0
-    }
-};
-
-function numMapper(n) {
-    return +n;
-}
-
-NamedMapsController.prototype.getStaticImageOptions = function(cdbUser, params, namedMapProvider, callback) {
-    var self = this;
-
-    if ([params.zoom, params.lon, params.lat].map(numMapper).every(Number.isFinite)) {
-        return callback(null, {
-            zoom: params.zoom,
-            center: {
-                lng: params.lon,
-                lat: params.lat
-            }
-        });
-    }
-
-    if (params.bbox) {
-        var bbox = params.bbox.split(',').map(numMapper);
-        if (bbox.length === 4 && bbox.every(Number.isFinite)) {
-            return callback(null, {
-                bounds: {
-                    west: bbox[0],
-                    south: bbox[1],
-                    east: bbox[2],
-                    north: bbox[3]
-                }
-            });
-        }
-    }
-
-    step(
-        function getTemplate() {
-            namedMapProvider.getTemplate(this);
-        },
-        function handleTemplateView(err, template) {
-            assert.ifError(err);
-
-            if (template.view) {
-                var zoomCenter = templateZoomCenter(template.view);
-                if (zoomCenter) {
-                    if (Number.isFinite(+params.zoom)) {
-                        zoomCenter.zoom = +params.zoom;
-                    }
-                    return zoomCenter;
-                }
-
-                var bounds = templateBounds(template.view);
-                if (bounds) {
-                    return bounds;
-                }
-            }
-
-            return false;
-        },
-        function estimateBoundsIfNoImageOpts(err, imageOpts) {
-            if (imageOpts) {
-                return imageOpts;
-            }
-
-            var next = this;
-            namedMapProvider.getAffectedTablesAndLastUpdatedTime(function(err, affectedTablesAndLastUpdate) {
-                if (err) {
-                    return next(null);
-                }
-
-                var affectedTables = affectedTablesAndLastUpdate.tables || [];
-
-                if (affectedTables.length === 0) {
-                    return next(null);
-                }
-
-                self.tablesExtentApi.getBounds(cdbUser, affectedTables, function(err, result) {
-                    return next(null, result);
-                });
-            });
-
-        },
-        function returnCallback(err, imageOpts) {
-            return callback(err, imageOpts || DEFAULT_ZOOM_CENTER);
-        }
-    );
-};
-
-function templateZoomCenter(view) {
-    if (!_.isUndefined(view.zoom) && view.center) {
-        return {
-            zoom: view.zoom,
-            center: view.center
-        };
-    }
-    return false;
-}
-
-function templateBounds(view) {
-    if (view.bounds) {
-        var hasAllBounds = _.every(['west', 'south', 'east', 'north'], function(prop) {
-            return Number.isFinite(view.bounds[prop]);
-        });
-        if (hasAllBounds) {
-            return {
-                bounds: {
-                    west: view.bounds.west,
-                    south: view.bounds.south,
-                    east: view.bounds.east,
-                    north: view.bounds.north
-                }
-            };
-        } else {
-            return false;
-        }
-    }
-    return false;
-}

lib/cartodb/controllers/named_maps_admin.js

@@ -1,197 +0,0 @@
-var step = require('step');
-var assert = require('assert');
-var templateName = require('../backends/template_maps').templateName;
-
-var util = require('util');
-var BaseController = require('./base');
-
-var cors = require('../middleware/cors');
-var userMiddleware = require('../middleware/user');
-
-
-/**
- * @param {AuthApi} authApi
- * @param {PgConnection} pgConnection
- * @param {TemplateMaps} templateMaps
- * @constructor
- */
-function NamedMapsAdminController(authApi, pgConnection, templateMaps) {
-    BaseController.call(this, authApi, pgConnection);
-
-    this.authApi = authApi;
-    this.templateMaps = templateMaps;
-}
-
-util.inherits(NamedMapsAdminController, BaseController);
-
-module.exports = NamedMapsAdminController;
-
-NamedMapsAdminController.prototype.register = function(app) {
-    app.post(app.base_url_templated, cors(), userMiddleware, this.create.bind(this));
-    app.put(app.base_url_templated + '/:template_id', cors(), userMiddleware, this.update.bind(this));
-    app.get(app.base_url_templated + '/:template_id', cors(), userMiddleware, this.retrieve.bind(this));
-    app.delete(app.base_url_templated + '/:template_id', cors(), userMiddleware, this.destroy.bind(this));
-    app.get(app.base_url_templated, cors(), userMiddleware, this.list.bind(this));
-    app.options(app.base_url_templated + '/:template_id', cors('Content-Type'));
-};
-
-NamedMapsAdminController.prototype.create = function(req, res) {
-    var self = this;
-
-    var cdbuser = req.context.user;
-
-    step(
-        function checkPerms(){
-            self.authApi.authorizedByAPIKey(cdbuser, req, this);
-        },
-        function addTemplate(err, authenticated) {
-            assert.ifError(err);
-            ifUnauthenticated(authenticated, 'Only authenticated users can get template maps');
-            ifInvalidContentType(req, 'template POST data must be of type application/json');
-            var cfg = req.body;
-            self.templateMaps.addTemplate(cdbuser, cfg, this);
-        },
-        function prepareResponse(err, tpl_id){
-            assert.ifError(err);
-            return { template_id: tpl_id };
-        },
-        finishFn(self, req, res, 'POST TEMPLATE')
-    );
-};
-
-NamedMapsAdminController.prototype.update = function(req, res) {
-    var self = this;
-
-    var cdbuser = req.context.user;
-    var template;
-    var tpl_id;
-
-    step(
-        function checkPerms(){
-            self.authApi.authorizedByAPIKey(cdbuser, req, this);
-        },
-        function updateTemplate(err, authenticated) {
-            assert.ifError(err);
-            ifUnauthenticated(authenticated, 'Only authenticated user can update templated maps');
-            ifInvalidContentType(req, 'template PUT data must be of type application/json');
-
-            template = req.body;
-            tpl_id = templateName(req.params.template_id);
-            self.templateMaps.updTemplate(cdbuser, tpl_id, template, this);
-        },
-        function prepareResponse(err){
-            assert.ifError(err);
-
-            return { template_id: tpl_id };
-        },
-        finishFn(self, req, res, 'PUT TEMPLATE')
-    );
-};
-
-NamedMapsAdminController.prototype.retrieve = function(req, res) {
-    var self = this;
-
-    req.profiler.start('windshaft-cartodb.get_template');
-
-    var cdbuser = req.context.user;
-    var tpl_id;
-    step(
-        function checkPerms(){
-            self.authApi.authorizedByAPIKey(cdbuser, req, this);
-        },
-        function getTemplate(err, authenticated) {
-            assert.ifError(err);
-            ifUnauthenticated(authenticated, 'Only authenticated users can get template maps');
-
-            tpl_id = templateName(req.params.template_id);
-            self.templateMaps.getTemplate(cdbuser, tpl_id, this);
-        },
-        function prepareResponse(err, tpl_val) {
-            assert.ifError(err);
-            if ( ! tpl_val ) {
-                err = new Error("Cannot find template '" + tpl_id + "' of user '" + cdbuser + "'");
-                err.http_status = 404;
-                throw err;
-            }
-            // auth_id was added by ourselves,
-            // so we remove it before returning to the user
-            delete tpl_val.auth_id;
-            return { template: tpl_val };
-        },
-        finishFn(self, req, res, 'GET TEMPLATE')
-    );
-};
-
-NamedMapsAdminController.prototype.destroy = function(req, res) {
-    var self = this;
-
-    req.profiler.start('windshaft-cartodb.delete_template');
-
-    var cdbuser = req.context.user;
-    var tpl_id;
-    step(
-        function checkPerms(){
-            self.authApi.authorizedByAPIKey(cdbuser, req, this);
-        },
-        function deleteTemplate(err, authenticated) {
-            assert.ifError(err);
-            ifUnauthenticated(authenticated, 'Only authenticated users can delete template maps');
-
-            tpl_id = templateName(req.params.template_id);
-            self.templateMaps.delTemplate(cdbuser, tpl_id, this);
-        },
-        function prepareResponse(err/*, tpl_val*/){
-            assert.ifError(err);
-            return '';
-        },
-        finishFn(self, req, res, 'DELETE TEMPLATE', 204)
-    );
-};
-
-NamedMapsAdminController.prototype.list = function(req, res) {
-    var self = this;
-    req.profiler.start('windshaft-cartodb.get_template_list');
-
-    var cdbuser = req.context.user;
-
-    step(
-        function checkPerms(){
-            self.authApi.authorizedByAPIKey(cdbuser, req, this);
-        },
-        function listTemplates(err, authenticated) {
-            assert.ifError(err);
-            ifUnauthenticated(authenticated, 'Only authenticated user can list templated maps');
-
-            self.templateMaps.listTemplates(cdbuser, this);
-        },
-        function prepareResponse(err, tpl_ids){
-            assert.ifError(err);
-            return { template_ids: tpl_ids };
-        },
-        finishFn(self, req, res, 'GET TEMPLATE LIST')
-    );
-};
-
-function finishFn(controller, req, res, description, status) {
-    return function finish(err, response){
-        if (err) {
-            controller.sendError(req, res, err, description);
-        } else {
-            controller.send(req, res, response, status || 200);
-        }
-    };
-}
-
-function ifUnauthenticated(authenticated, description) {
-    if (!authenticated) {
-        var err = new Error(description);
-        err.http_status = 403;
-        throw err;
-    }
-}
-
-function ifInvalidContentType(req, description) {
-    if (!req.is('application/json')) {
-        throw new Error(description);
-    }
-}

lib/cartodb/middleware/allow-query-params.js

@@ -1,9 +0,0 @@
-module.exports = function allowQueryParams(params) {
-    if (!Array.isArray(params)) {
-        throw new Error('allowQueryParams must receive an Array of params');
-    }
-    return function allowQueryParamsMiddleware(req, res, next) {
-        req.context.allowedQueryParams = params;
-        next();
-    };
-};