Config option to disable legacy explorer routes

Setting legacyExplorer to false in the loopback config will disable
the routes /routes and /models made available in loopback.rest.
The deprecate module has been added to the project with a reference
added for the legacyExplorer option as it is no longer required by
loopback-explorer. The routes were also modified to to only accept
GET requests. Tests added to validate functionality of disabled
and enabled legacy explorer routes.

package.json

@@ -49,7 +49,8 @@
     "stable": "^0.1.5",
     "strong-remoting": "^2.13.2",
     "uid2": "0.0.3",
-    "underscore.string": "~2.3.3"
+    "underscore.string": "~2.3.3",
+    "depd": "~1.0.0"
   },
   "peerDependencies": {
     "loopback-datasource-juggler": "^2.17.0"

server/middleware/rest.js

@@ -4,6 +4,7 @@
 
 var loopback = require('../../lib/loopback');
 var async = require('async');
+var deprecate = require('depd')('loopback');
 
 /*!
  * Export the middleware.
@@ -28,10 +29,16 @@ function rest() {
   return function restApiHandler(req, res, next) {
     var app = req.app;
 
-    if (req.url === '/routes') {
-      return res.send(app.handler('rest').adapter.allRoutes());
-    } else if (req.url === '/models') {
-      return res.send(app.remotes().toJSON());
+    // added for https://github.com/strongloop/loopback/issues/1134
+    var legacyExplorer = (undefined === app.get('legacyExplorer') || app.get('legacyExplorer')) ? true : false;
+
+    if (legacyExplorer && 'get' === req.method.toLowerCase()) {
+      deprecate('legacyExplorer: Update config.json to disable legacyExplorer routes');
+      if (req.url === '/routes') {
+        return res.send(app.handler('rest').adapter.allRoutes());
+      } else if (req.url === '/models') {
+        return res.send(app.remotes().toJSON());
+      }
     }
 
     if (!handlers) {

test/rest.middleware.test.js

@@ -164,6 +164,40 @@ describe('loopback.rest', function() {
     }, done);
   });
 
+  it('should report 200 for legacy explorer route /routes', function(done) {
+    app.model(MyModel);
+    app.use(loopback.rest());
+    request(app).get('/routes')
+      .expect(200)
+      .end(done);
+  });
+
+  it('should report 200 for legacy explorer route /models', function(done) {
+    app.model(MyModel);
+    app.use(loopback.rest());
+    request(app).get('/models')
+      .expect(200)
+      .end(done);
+  });
+
+  it('should report 404 for disabled legacy explorer route /routes', function(done) {
+    app.set('legacyExplorer', false);
+    app.model(MyModel);
+    app.use(loopback.rest());
+    request(app).get('/routes')
+      .expect(404)
+      .end(done);
+  });
+
+  it('should report 404 for disabled legacy explorer route /models', function(done) {
+    app.set('legacyExplorer', false);
+    app.model(MyModel);
+    app.use(loopback.rest());
+    request(app).get('/models')
+      .expect(404)
+      .end(done);
+  });
+
   describe('context propagation', function() {
     var User;