server/controllers/api/users/index.ts

   1 import * as express from 'express'
   2 import * as RateLimit from 'express-rate-limit'
   3 import { UserCreate, UserRight, UserRole, UserUpdate } from '../../../../shared'
   4 import { logger } from '../../../helpers/logger'
   5 import { getFormattedObjects } from '../../../helpers/utils'
   6 import { CONFIG, RATES_LIMIT, sequelizeTypescript } from '../../../initializers'
   7 import { Emailer } from '../../../lib/emailer'
   8 import { Redis } from '../../../lib/redis'
   9 import { createUserAccountAndChannel } from '../../../lib/user'
  10 import {
  11   asyncMiddleware,
  12   asyncRetryTransactionMiddleware,
  13   authenticate,
  14   ensureUserHasRight,
  15   ensureUserRegistrationAllowed,
  16   ensureUserRegistrationAllowedForIP,
  17   paginationValidator,
  18   setDefaultPagination,
  19   setDefaultSort,
  20   token,
  21   usersAddValidator,
  22   usersGetValidator,
  23   usersRegisterValidator,
  24   usersRemoveValidator,
  25   usersSortValidator,
  26   usersUpdateValidator
  27 } from '../../../middlewares'
  28 import { usersAskResetPasswordValidator, usersBlockingValidator, usersResetPasswordValidator } from '../../../middlewares/validators'
  29 import { UserModel } from '../../../models/account/user'
  30 import { OAuthTokenModel } from '../../../models/oauth/oauth-token'
  31 import { auditLoggerFactory, UserAuditView } from '../../../helpers/audit-logger'
  32 import { meRouter } from './me'
  33
  34 const auditLogger = auditLoggerFactory('users')
  35
  36 const loginRateLimiter = new RateLimit({
  37   windowMs: RATES_LIMIT.LOGIN.WINDOW_MS,
  38   max: RATES_LIMIT.LOGIN.MAX,
  39   delayMs: 0
  40 })
  41
  42 const usersRouter = express.Router()
  43 usersRouter.use('/', meRouter)
  44
  45 usersRouter.get('/',
  46   authenticate,
  47   ensureUserHasRight(UserRight.MANAGE_USERS),
  48   paginationValidator,
  49   usersSortValidator,
  50   setDefaultSort,
  51   setDefaultPagination,
  52   asyncMiddleware(listUsers)
  53 )
  54
  55 usersRouter.post('/:id/block',
  56   authenticate,
  57   ensureUserHasRight(UserRight.MANAGE_USERS),
  58   asyncMiddleware(usersBlockingValidator),
  59   asyncMiddleware(blockUser)
  60 )
  61 usersRouter.post('/:id/unblock',
  62   authenticate,
  63   ensureUserHasRight(UserRight.MANAGE_USERS),
  64   asyncMiddleware(usersBlockingValidator),
  65   asyncMiddleware(unblockUser)
  66 )
  67
  68 usersRouter.get('/:id',
  69   authenticate,
  70   ensureUserHasRight(UserRight.MANAGE_USERS),
  71   asyncMiddleware(usersGetValidator),
  72   getUser
  73 )
  74
  75 usersRouter.post('/',
  76   authenticate,
  77   ensureUserHasRight(UserRight.MANAGE_USERS),
  78   asyncMiddleware(usersAddValidator),
  79   asyncRetryTransactionMiddleware(createUser)
  80 )
  81
  82 usersRouter.post('/register',
  83   asyncMiddleware(ensureUserRegistrationAllowed),
  84   ensureUserRegistrationAllowedForIP,
  85   asyncMiddleware(usersRegisterValidator),
  86   asyncRetryTransactionMiddleware(registerUser)
  87 )
  88
  89 usersRouter.put('/:id',
  90   authenticate,
  91   ensureUserHasRight(UserRight.MANAGE_USERS),
  92   asyncMiddleware(usersUpdateValidator),
  93   asyncMiddleware(updateUser)
  94 )
  95
  96 usersRouter.delete('/:id',
  97   authenticate,
  98   ensureUserHasRight(UserRight.MANAGE_USERS),
  99   asyncMiddleware(usersRemoveValidator),
 100   asyncMiddleware(removeUser)
 101 )
 102
 103 usersRouter.post('/ask-reset-password',
 104   asyncMiddleware(usersAskResetPasswordValidator),
 105   asyncMiddleware(askResetUserPassword)
 106 )
 107
 108 usersRouter.post('/:id/reset-password',
 109   asyncMiddleware(usersResetPasswordValidator),
 110   asyncMiddleware(resetUserPassword)
 111 )
 112
 113 usersRouter.post('/token',
 114   loginRateLimiter,
 115   token,
 116   success
 117 )
 118 // TODO: Once https://github.com/oauthjs/node-oauth2-server/pull/289 is merged, implement revoke token route
 119
 120 // ---------------------------------------------------------------------------
 121
 122 export {
 123   usersRouter
 124 }
 125
 126 // ---------------------------------------------------------------------------
 127
 128 async function createUser (req: express.Request, res: express.Response) {
 129   const body: UserCreate = req.body
 130   const userToCreate = new UserModel({
 131     username: body.username,
 132     password: body.password,
 133     email: body.email,
 134     nsfwPolicy: CONFIG.INSTANCE.DEFAULT_NSFW_POLICY,
 135     autoPlayVideo: true,
 136     role: body.role,
 137     videoQuota: body.videoQuota
 138   })
 139
 140   const { user, account } = await createUserAccountAndChannel(userToCreate)
 141
 142   auditLogger.create(res.locals.oauth.token.User.Account.Actor.getIdentifier(), new UserAuditView(user.toFormattedJSON()))
 143   logger.info('User %s with its channel and account created.', body.username)
 144
 145   return res.json({
 146     user: {
 147       id: user.id,
 148       account: {
 149         id: account.id,
 150         uuid: account.Actor.uuid
 151       }
 152     }
 153   }).end()
 154 }
 155
 156 async function registerUser (req: express.Request, res: express.Response) {
 157   const body: UserCreate = req.body
 158
 159   const userToCreate = new UserModel({
 160     username: body.username,
 161     password: body.password,
 162     email: body.email,
 163     nsfwPolicy: CONFIG.INSTANCE.DEFAULT_NSFW_POLICY,
 164     autoPlayVideo: true,
 165     role: UserRole.USER,
 166     videoQuota: CONFIG.USER.VIDEO_QUOTA
 167   })
 168
 169   const { user } = await createUserAccountAndChannel(userToCreate)
 170
 171   auditLogger.create(body.username, new UserAuditView(user.toFormattedJSON()))
 172   logger.info('User %s with its channel and account registered.', body.username)
 173
 174   return res.type('json').status(204).end()
 175 }
 176
 177 async function unblockUser (req: express.Request, res: express.Response, next: express.NextFunction) {
 178   const user: UserModel = res.locals.user
 179
 180   await changeUserBlock(res, user, false)
 181
 182   return res.status(204).end()
 183 }
 184
 185 async function blockUser (req: express.Request, res: express.Response, next: express.NextFunction) {
 186   const user: UserModel = res.locals.user
 187   const reason = req.body.reason
 188
 189   await changeUserBlock(res, user, true, reason)
 190
 191   return res.status(204).end()
 192 }
 193
 194 function getUser (req: express.Request, res: express.Response, next: express.NextFunction) {
 195   return res.json((res.locals.user as UserModel).toFormattedJSON())
 196 }
 197
 198 async function listUsers (req: express.Request, res: express.Response, next: express.NextFunction) {
 199   const resultList = await UserModel.listForApi(req.query.start, req.query.count, req.query.sort)
 200
 201   return res.json(getFormattedObjects(resultList.data, resultList.total))
 202 }
 203
 204 async function removeUser (req: express.Request, res: express.Response, next: express.NextFunction) {
 205   const user: UserModel = res.locals.user
 206
 207   await user.destroy()
 208
 209   auditLogger.delete(res.locals.oauth.token.User.Account.Actor.getIdentifier(), new UserAuditView(user.toFormattedJSON()))
 210
 211   return res.sendStatus(204)
 212 }
 213
 214 async function updateUser (req: express.Request, res: express.Response, next: express.NextFunction) {
 215   const body: UserUpdate = req.body
 216   const userToUpdate = res.locals.user as UserModel
 217   const oldUserAuditView = new UserAuditView(userToUpdate.toFormattedJSON())
 218   const roleChanged = body.role !== undefined && body.role !== userToUpdate.role
 219
 220   if (body.email !== undefined) userToUpdate.email = body.email
 221   if (body.videoQuota !== undefined) userToUpdate.videoQuota = body.videoQuota
 222   if (body.role !== undefined) userToUpdate.role = body.role
 223
 224   const user = await userToUpdate.save()
 225
 226   // Destroy user token to refresh rights
 227   if (roleChanged) {
 228     await OAuthTokenModel.deleteUserToken(userToUpdate.id)
 229   }
 230
 231   auditLogger.update(
 232     res.locals.oauth.token.User.Account.Actor.getIdentifier(),
 233     new UserAuditView(user.toFormattedJSON()),
 234     oldUserAuditView
 235   )
 236
 237   // Don't need to send this update to followers, these attributes are not propagated
 238
 239   return res.sendStatus(204)
 240 }
 241
 242 async function askResetUserPassword (req: express.Request, res: express.Response, next: express.NextFunction) {
 243   const user = res.locals.user as UserModel
 244
 245   const verificationString = await Redis.Instance.setResetPasswordVerificationString(user.id)
 246   const url = CONFIG.WEBSERVER.URL + '/reset-password?userId=' + user.id + '&verificationString=' + verificationString
 247   await Emailer.Instance.addForgetPasswordEmailJob(user.email, url)
 248
 249   return res.status(204).end()
 250 }
 251
 252 async function resetUserPassword (req: express.Request, res: express.Response, next: express.NextFunction) {
 253   const user = res.locals.user as UserModel
 254   user.password = req.body.password
 255
 256   await user.save()
 257
 258   return res.status(204).end()
 259 }
 260
 261 function success (req: express.Request, res: express.Response, next: express.NextFunction) {
 262   res.end()
 263 }
 264
 265 async function changeUserBlock (res: express.Response, user: UserModel, block: boolean, reason?: string) {
 266   const oldUserAuditView = new UserAuditView(user.toFormattedJSON())
 267
 268   user.blocked = block
 269   user.blockedReason = reason || null
 270
 271   await sequelizeTypescript.transaction(async t => {
 272     await OAuthTokenModel.deleteUserToken(user.id, t)
 273
 274     await user.save({ transaction: t })
 275   })
 276
 277   await Emailer.Instance.addUserBlockJob(user, block, reason)
 278
 279   auditLogger.update(
 280     res.locals.oauth.token.User.Account.Actor.getIdentifier(),
 281     new UserAuditView(user.toFormattedJSON()),
 282     oldUserAuditView
 283   )
 284 }