]> git.immae.eu Git - github/Chocobozzz/PeerTube.git/blob - server/controllers/api/runners/registration-tokens.ts
Fix runner api rate limit bypass
[github/Chocobozzz/PeerTube.git] / server / controllers / api / runners / registration-tokens.ts
1 import express from 'express'
2 import { logger, loggerTagsFactory } from '@server/helpers/logger'
3 import { generateRunnerRegistrationToken } from '@server/helpers/token-generator'
4 import {
5 apiRateLimiter,
6 asyncMiddleware,
7 authenticate,
8 ensureUserHasRight,
9 paginationValidator,
10 runnerRegistrationTokensSortValidator,
11 setDefaultPagination,
12 setDefaultSort
13 } from '@server/middlewares'
14 import { deleteRegistrationTokenValidator } from '@server/middlewares/validators/runners'
15 import { RunnerRegistrationTokenModel } from '@server/models/runner/runner-registration-token'
16 import { HttpStatusCode, ListRunnerRegistrationTokensQuery, UserRight } from '@shared/models'
17
18 const lTags = loggerTagsFactory('api', 'runner')
19
20 const runnerRegistrationTokensRouter = express.Router()
21
22 runnerRegistrationTokensRouter.post('/registration-tokens/generate',
23 apiRateLimiter,
24 authenticate,
25 ensureUserHasRight(UserRight.MANAGE_RUNNERS),
26 asyncMiddleware(generateRegistrationToken)
27 )
28
29 runnerRegistrationTokensRouter.delete('/registration-tokens/:id',
30 apiRateLimiter,
31 authenticate,
32 ensureUserHasRight(UserRight.MANAGE_RUNNERS),
33 asyncMiddleware(deleteRegistrationTokenValidator),
34 asyncMiddleware(deleteRegistrationToken)
35 )
36
37 runnerRegistrationTokensRouter.get('/registration-tokens',
38 apiRateLimiter,
39 authenticate,
40 ensureUserHasRight(UserRight.MANAGE_RUNNERS),
41 paginationValidator,
42 runnerRegistrationTokensSortValidator,
43 setDefaultSort,
44 setDefaultPagination,
45 asyncMiddleware(listRegistrationTokens)
46 )
47
48 // ---------------------------------------------------------------------------
49
50 export {
51 runnerRegistrationTokensRouter
52 }
53
54 // ---------------------------------------------------------------------------
55
56 async function generateRegistrationToken (req: express.Request, res: express.Response) {
57 logger.info('Generating new runner registration token.', lTags())
58
59 const registrationToken = new RunnerRegistrationTokenModel({
60 registrationToken: generateRunnerRegistrationToken()
61 })
62
63 await registrationToken.save()
64
65 return res.sendStatus(HttpStatusCode.NO_CONTENT_204)
66 }
67
68 async function deleteRegistrationToken (req: express.Request, res: express.Response) {
69 logger.info('Removing runner registration token.', lTags())
70
71 const runnerRegistrationToken = res.locals.runnerRegistrationToken
72
73 await runnerRegistrationToken.destroy()
74
75 return res.sendStatus(HttpStatusCode.NO_CONTENT_204)
76 }
77
78 async function listRegistrationTokens (req: express.Request, res: express.Response) {
79 const query: ListRunnerRegistrationTokensQuery = req.query
80
81 const resultList = await RunnerRegistrationTokenModel.listForApi({
82 start: query.start,
83 count: query.count,
84 sort: query.sort
85 })
86
87 return res.json({
88 total: resultList.total,
89 data: resultList.data.map(d => d.toFormattedJSON())
90 })
91 }