]> git.immae.eu Git - github/Chocobozzz/PeerTube.git/blame - server/middlewares/validators/oembed.ts
/!\ Use a dedicated config file for development
[github/Chocobozzz/PeerTube.git] / server / middlewares / validators / oembed.ts
CommitLineData
41fb13c3 1import express from 'express'
c8861d5d 2import { query } from 'express-validator'
d8755eed 3import { join } from 'path'
868fce62 4import { loadVideo } from '@server/lib/model-loaders'
6fad8e51
C
5import { VideoPlaylistModel } from '@server/models/video/video-playlist'
6import { VideoPlaylistPrivacy, VideoPrivacy } from '@shared/models'
c0e8b12e 7import { HttpStatusCode } from '../../../shared/models/http/http-error-codes'
9452d4fd 8import { isTestOrDevInstance } from '../../helpers/core-utils'
b3d9dedc 9import { isIdOrUUIDValid, isUUIDValid, toCompleteUUID } from '../../helpers/custom-validators/misc'
da854ddd 10import { logger } from '../../helpers/logger'
6dd9de95 11import { WEBSERVER } from '../../initializers/constants'
10363c74 12import { areValidationErrors } from './shared'
d8755eed 13
a1eda903
C
14const playlistPaths = [
15 join('videos', 'watch', 'playlist'),
16 join('w', 'p')
17]
18
19const videoPaths = [
20 join('videos', 'watch'),
21 'w'
22]
23
24function buildUrls (paths: string[]) {
25 return paths.map(p => WEBSERVER.SCHEME + '://' + join(WEBSERVER.HOST, p) + '/')
26}
27
28const startPlaylistURLs = buildUrls(playlistPaths)
29const startVideoURLs = buildUrls(videoPaths)
6fad8e51 30
d8755eed
C
31const isURLOptions = {
32 require_host: true,
33 require_tld: true
34}
35
36// We validate 'localhost', so we don't have the top level domain
9452d4fd 37if (isTestOrDevInstance()) {
d8755eed
C
38 isURLOptions.require_tld = false
39}
40
41const oembedValidator = [
42 query('url').isURL(isURLOptions).withMessage('Should have a valid url'),
43 query('maxwidth').optional().isInt().withMessage('Should have a valid max width'),
44 query('maxheight').optional().isInt().withMessage('Should have a valid max height'),
45 query('format').optional().isIn([ 'xml', 'json' ]).withMessage('Should have a valid format'),
46
a2431b7d 47 async (req: express.Request, res: express.Response, next: express.NextFunction) => {
d8755eed
C
48 logger.debug('Checking oembed parameters', { parameters: req.query })
49
a2431b7d
C
50 if (areValidationErrors(req, res)) return
51
52 if (req.query.format !== undefined && req.query.format !== 'json') {
76148b27
RK
53 return res.fail({
54 status: HttpStatusCode.NOT_IMPLEMENTED_501,
55 message: 'Requested format is not implemented on server.',
56 data: {
57 format: req.query.format
58 }
59 })
a2431b7d
C
60 }
61
67c604ae
C
62 const url = req.query.url as string
63
e93ee838
C
64 let urlPath: string
65
66 try {
67 urlPath = new URL(url).pathname
68 } catch (err) {
69 return res.fail({
70 status: HttpStatusCode.BAD_REQUEST_400,
71 message: err.message,
72 data: {
73 url
74 }
75 })
76 }
77
a1eda903
C
78 const isPlaylist = startPlaylistURLs.some(u => url.startsWith(u))
79 const isVideo = isPlaylist ? false : startVideoURLs.some(u => url.startsWith(u))
6fad8e51
C
80
81 const startIsOk = isVideo || isPlaylist
82
e5d9877f 83 const parts = urlPath.split('/')
67c604ae 84
e5d9877f 85 if (startIsOk === false || parts.length === 0) {
76148b27
RK
86 return res.fail({
87 status: HttpStatusCode.BAD_REQUEST_400,
88 message: 'Invalid url.',
89 data: {
90 url
91 }
92 })
a2431b7d 93 }
d8755eed 94
e5d9877f 95 const elementId = toCompleteUUID(parts.pop())
6fad8e51 96 if (isIdOrUUIDValid(elementId) === false) {
76148b27 97 return res.fail({ message: 'Invalid video or playlist id.' })
a2431b7d 98 }
d8755eed 99
6fad8e51 100 if (isVideo) {
868fce62 101 const video = await loadVideo(elementId, 'all')
6fad8e51
C
102
103 if (!video) {
76148b27
RK
104 return res.fail({
105 status: HttpStatusCode.NOT_FOUND_404,
106 message: 'Video not found'
107 })
6fad8e51 108 }
d8755eed 109
b3d9dedc
C
110 if (
111 video.privacy === VideoPrivacy.PUBLIC ||
112 (video.privacy === VideoPrivacy.UNLISTED && isUUIDValid(elementId) === true)
113 ) {
114 res.locals.videoAll = video
115 return next()
6fad8e51
C
116 }
117
b3d9dedc
C
118 return res.fail({
119 status: HttpStatusCode.FORBIDDEN_403,
120 message: 'Video is not publicly available'
121 })
6fad8e51
C
122 }
123
124 // Is playlist
125
126 const videoPlaylist = await VideoPlaylistModel.loadWithAccountAndChannelSummary(elementId, undefined)
127 if (!videoPlaylist) {
76148b27
RK
128 return res.fail({
129 status: HttpStatusCode.NOT_FOUND_404,
130 message: 'Video playlist not found'
131 })
6fad8e51
C
132 }
133
b3d9dedc
C
134 if (
135 videoPlaylist.privacy === VideoPlaylistPrivacy.PUBLIC ||
136 (videoPlaylist.privacy === VideoPlaylistPrivacy.UNLISTED && isUUIDValid(elementId))
137 ) {
138 res.locals.videoPlaylistSummary = videoPlaylist
139 return next()
6fad8e51
C
140 }
141
b3d9dedc
C
142 return res.fail({
143 status: HttpStatusCode.FORBIDDEN_403,
144 message: 'Playlist is not public'
145 })
d8755eed 146 }
6fad8e51 147
d8755eed
C
148]
149
150// ---------------------------------------------------------------------------
151
152export {
153 oembedValidator
154}