]> git.immae.eu Git - github/Chocobozzz/PeerTube.git/blob - server/controllers/api/runners/manage-runners.ts
Fix runner api rate limit bypass
[github/Chocobozzz/PeerTube.git] / server / controllers / api / runners / manage-runners.ts
1 import express from 'express'
2 import { logger, loggerTagsFactory } from '@server/helpers/logger'
3 import { generateRunnerToken } from '@server/helpers/token-generator'
4 import {
5 apiRateLimiter,
6 asyncMiddleware,
7 authenticate,
8 ensureUserHasRight,
9 paginationValidator,
10 runnersSortValidator,
11 setDefaultPagination,
12 setDefaultSort
13 } from '@server/middlewares'
14 import { deleteRunnerValidator, getRunnerFromTokenValidator, registerRunnerValidator } from '@server/middlewares/validators/runners'
15 import { RunnerModel } from '@server/models/runner/runner'
16 import { HttpStatusCode, ListRunnersQuery, RegisterRunnerBody, UserRight } from '@shared/models'
17
18 const lTags = loggerTagsFactory('api', 'runner')
19
20 const manageRunnersRouter = express.Router()
21
22 manageRunnersRouter.post('/register',
23 apiRateLimiter,
24 asyncMiddleware(registerRunnerValidator),
25 asyncMiddleware(registerRunner)
26 )
27 manageRunnersRouter.post('/unregister',
28 apiRateLimiter,
29 asyncMiddleware(getRunnerFromTokenValidator),
30 asyncMiddleware(unregisterRunner)
31 )
32
33 manageRunnersRouter.delete('/:runnerId',
34 apiRateLimiter,
35 authenticate,
36 ensureUserHasRight(UserRight.MANAGE_RUNNERS),
37 asyncMiddleware(deleteRunnerValidator),
38 asyncMiddleware(deleteRunner)
39 )
40
41 manageRunnersRouter.get('/',
42 apiRateLimiter,
43 authenticate,
44 ensureUserHasRight(UserRight.MANAGE_RUNNERS),
45 paginationValidator,
46 runnersSortValidator,
47 setDefaultSort,
48 setDefaultPagination,
49 asyncMiddleware(listRunners)
50 )
51
52 // ---------------------------------------------------------------------------
53
54 export {
55 manageRunnersRouter
56 }
57
58 // ---------------------------------------------------------------------------
59
60 async function registerRunner (req: express.Request, res: express.Response) {
61 const body: RegisterRunnerBody = req.body
62
63 const runnerToken = generateRunnerToken()
64
65 const runner = new RunnerModel({
66 runnerToken,
67 name: body.name,
68 description: body.description,
69 lastContact: new Date(),
70 ip: req.ip,
71 runnerRegistrationTokenId: res.locals.runnerRegistrationToken.id
72 })
73
74 await runner.save()
75
76 logger.info('Registered new runner %s', runner.name, { ...lTags(runner.name) })
77
78 return res.json({ id: runner.id, runnerToken })
79 }
80 async function unregisterRunner (req: express.Request, res: express.Response) {
81 const runner = res.locals.runner
82 await runner.destroy()
83
84 logger.info('Unregistered runner %s', runner.name, { ...lTags(runner.name) })
85
86 return res.sendStatus(HttpStatusCode.NO_CONTENT_204)
87 }
88
89 async function deleteRunner (req: express.Request, res: express.Response) {
90 const runner = res.locals.runner
91
92 await runner.destroy()
93
94 logger.info('Deleted runner %s', runner.name, { ...lTags(runner.name) })
95
96 return res.sendStatus(HttpStatusCode.NO_CONTENT_204)
97 }
98
99 async function listRunners (req: express.Request, res: express.Response) {
100 const query: ListRunnersQuery = req.query
101
102 const resultList = await RunnerModel.listForApi({
103 start: query.start,
104 count: query.count,
105 sort: query.sort
106 })
107
108 return res.json({
109 total: resultList.total,
110 data: resultList.data.map(d => d.toFormattedJSON())
111 })
112 }