server/controllers/api/users/index.ts

   1 import * as express from 'express'
   2 import * as RateLimit from 'express-rate-limit'
   3 import { UserCreate, UserRight, UserRole, UserUpdate } from '../../../../shared'
   4 import { logger } from '../../../helpers/logger'
   5 import { getFormattedObjects } from '../../../helpers/utils'
   6 import { CONFIG, RATES_LIMIT, sequelizeTypescript } from '../../../initializers'
   7 import { Emailer } from '../../../lib/emailer'
   8 import { Redis } from '../../../lib/redis'
   9 import { createUserAccountAndChannel } from '../../../lib/user'
  10 import {
  11   asyncMiddleware,
  12   asyncRetryTransactionMiddleware,
  13   authenticate,
  14   ensureUserHasRight,
  15   ensureUserRegistrationAllowed,
  16   ensureUserRegistrationAllowedForIP,
  17   paginationValidator,
  18   setDefaultPagination,
  19   setDefaultSort,
  20   token,
  21   usersAddValidator,
  22   usersGetValidator,
  23   usersRegisterValidator,
  24   usersRemoveValidator,
  25   usersSortValidator,
  26   usersUpdateValidator
  27 } from '../../../middlewares'
  28 import { usersAskResetPasswordValidator, usersBlockingValidator, usersResetPasswordValidator } from '../../../middlewares/validators'
  29 import { UserModel } from '../../../models/account/user'
  30 import { OAuthTokenModel } from '../../../models/oauth/oauth-token'
  31 import { auditLoggerFactory, UserAuditView } from '../../../helpers/audit-logger'
  32 import { meRouter } from './me'
  33
  34 const auditLogger = auditLoggerFactory('users')
  35
  36 const loginRateLimiter = new RateLimit({
  37   windowMs: RATES_LIMIT.LOGIN.WINDOW_MS,
  38   max: RATES_LIMIT.LOGIN.MAX,
  39   delayMs: 0
  40 })
  41
  42 const usersRouter = express.Router()
  43 usersRouter.use('/', meRouter)
  44
  45 usersRouter.get('/',
  46   authenticate,
  47   ensureUserHasRight(UserRight.MANAGE_USERS),
  48   paginationValidator,
  49   usersSortValidator,
  50   setDefaultSort,
  51   setDefaultPagination,
  52   asyncMiddleware(listUsers)
  53 )
  54
  55 usersRouter.post('/:id/block',
  56   authenticate,
  57   ensureUserHasRight(UserRight.MANAGE_USERS),
  58   asyncMiddleware(usersBlockingValidator),
  59   asyncMiddleware(blockUser)
  60 )
  61 usersRouter.post('/:id/unblock',
  62   authenticate,
  63   ensureUserHasRight(UserRight.MANAGE_USERS),
  64   asyncMiddleware(usersBlockingValidator),
  65   asyncMiddleware(unblockUser)
  66 )
  67
  68 usersRouter.get('/:id',
  69   authenticate,
  70   ensureUserHasRight(UserRight.MANAGE_USERS),
  71   asyncMiddleware(usersGetValidator),
  72   getUser
  73 )
  74
  75 usersRouter.post('/',
  76   authenticate,
  77   ensureUserHasRight(UserRight.MANAGE_USERS),
  78   asyncMiddleware(usersAddValidator),
  79   asyncRetryTransactionMiddleware(createUser)
  80 )
  81
  82 usersRouter.post('/register',
  83   asyncMiddleware(ensureUserRegistrationAllowed),
  84   ensureUserRegistrationAllowedForIP,
  85   asyncMiddleware(usersRegisterValidator),
  86   asyncRetryTransactionMiddleware(registerUser)
  87 )
  88
  89 usersRouter.put('/:id',
  90   authenticate,
  91   ensureUserHasRight(UserRight.MANAGE_USERS),
  92   asyncMiddleware(usersUpdateValidator),
  93   asyncMiddleware(updateUser)
  94 )
  95
  96 usersRouter.delete('/:id',
  97   authenticate,
  98   ensureUserHasRight(UserRight.MANAGE_USERS),
  99   asyncMiddleware(usersRemoveValidator),
 100   asyncMiddleware(removeUser)
 101 )
 102
 103 usersRouter.post('/ask-reset-password',
 104   asyncMiddleware(usersAskResetPasswordValidator),
 105   asyncMiddleware(askResetUserPassword)
 106 )
 107
 108 usersRouter.post('/:id/reset-password',
 109   asyncMiddleware(usersResetPasswordValidator),
 110   asyncMiddleware(resetUserPassword)
 111 )
 112
 113 usersRouter.post('/token',
 114   loginRateLimiter,
 115   token,
 116   success
 117 )
 118 // TODO: Once https://github.com/oauthjs/node-oauth2-server/pull/289 is merged, implement revoke token route
 119
 120 // ---------------------------------------------------------------------------
 121
 122 export {
 123   usersRouter
 124 }
 125
 126 // ---------------------------------------------------------------------------
 127
 128 async function createUser (req: express.Request, res: express.Response) {
 129   const body: UserCreate = req.body
 130   const userToCreate = new UserModel({
 131     username: body.username,
 132     password: body.password,
 133     email: body.email,
 134     nsfwPolicy: CONFIG.INSTANCE.DEFAULT_NSFW_POLICY,
 135     autoPlayVideo: true,
 136     role: body.role,
 137     videoQuota: body.videoQuota,
 138     videoQuotaDaily: body.videoQuotaDaily
 139   })
 140
 141   const { user, account } = await createUserAccountAndChannel(userToCreate)
 142
 143   auditLogger.create(res.locals.oauth.token.User.Account.Actor.getIdentifier(), new UserAuditView(user.toFormattedJSON()))
 144   logger.info('User %s with its channel and account created.', body.username)
 145
 146   return res.json({
 147     user: {
 148       id: user.id,
 149       account: {
 150         id: account.id,
 151         uuid: account.Actor.uuid
 152       }
 153     }
 154   }).end()
 155 }
 156
 157 async function registerUser (req: express.Request, res: express.Response) {
 158   const body: UserCreate = req.body
 159
 160   const userToCreate = new UserModel({
 161     username: body.username,
 162     password: body.password,
 163     email: body.email,
 164     nsfwPolicy: CONFIG.INSTANCE.DEFAULT_NSFW_POLICY,
 165     autoPlayVideo: true,
 166     role: UserRole.USER,
 167     videoQuota: CONFIG.USER.VIDEO_QUOTA,
 168     videoQuotaDaily: CONFIG.USER.VIDEO_QUOTA_DAILY
 169   })
 170
 171   const { user } = await createUserAccountAndChannel(userToCreate)
 172
 173   auditLogger.create(body.username, new UserAuditView(user.toFormattedJSON()))
 174   logger.info('User %s with its channel and account registered.', body.username)
 175
 176   return res.type('json').status(204).end()
 177 }
 178
 179 async function unblockUser (req: express.Request, res: express.Response, next: express.NextFunction) {
 180   const user: UserModel = res.locals.user
 181
 182   await changeUserBlock(res, user, false)
 183
 184   return res.status(204).end()
 185 }
 186
 187 async function blockUser (req: express.Request, res: express.Response, next: express.NextFunction) {
 188   const user: UserModel = res.locals.user
 189   const reason = req.body.reason
 190
 191   await changeUserBlock(res, user, true, reason)
 192
 193   return res.status(204).end()
 194 }
 195
 196 function getUser (req: express.Request, res: express.Response, next: express.NextFunction) {
 197   return res.json((res.locals.user as UserModel).toFormattedJSON())
 198 }
 199
 200 async function listUsers (req: express.Request, res: express.Response, next: express.NextFunction) {
 201   const resultList = await UserModel.listForApi(req.query.start, req.query.count, req.query.sort)
 202
 203   return res.json(getFormattedObjects(resultList.data, resultList.total))
 204 }
 205
 206 async function removeUser (req: express.Request, res: express.Response, next: express.NextFunction) {
 207   const user: UserModel = res.locals.user
 208
 209   await user.destroy()
 210
 211   auditLogger.delete(res.locals.oauth.token.User.Account.Actor.getIdentifier(), new UserAuditView(user.toFormattedJSON()))
 212
 213   return res.sendStatus(204)
 214 }
 215
 216 async function updateUser (req: express.Request, res: express.Response, next: express.NextFunction) {
 217   const body: UserUpdate = req.body
 218   const userToUpdate = res.locals.user as UserModel
 219   const oldUserAuditView = new UserAuditView(userToUpdate.toFormattedJSON())
 220   const roleChanged = body.role !== undefined && body.role !== userToUpdate.role
 221
 222   if (body.email !== undefined) userToUpdate.email = body.email
 223   if (body.videoQuota !== undefined) userToUpdate.videoQuota = body.videoQuota
 224   if (body.videoQuotaDaily !== undefined) userToUpdate.videoQuotaDaily = body.videoQuotaDaily
 225   if (body.role !== undefined) userToUpdate.role = body.role
 226
 227   const user = await userToUpdate.save()
 228
 229   // Destroy user token to refresh rights
 230   if (roleChanged) {
 231     await OAuthTokenModel.deleteUserToken(userToUpdate.id)
 232   }
 233
 234   auditLogger.update(
 235     res.locals.oauth.token.User.Account.Actor.getIdentifier(),
 236     new UserAuditView(user.toFormattedJSON()),
 237     oldUserAuditView
 238   )
 239
 240   // Don't need to send this update to followers, these attributes are not propagated
 241
 242   return res.sendStatus(204)
 243 }
 244
 245 async function askResetUserPassword (req: express.Request, res: express.Response, next: express.NextFunction) {
 246   const user = res.locals.user as UserModel
 247
 248   const verificationString = await Redis.Instance.setResetPasswordVerificationString(user.id)
 249   const url = CONFIG.WEBSERVER.URL + '/reset-password?userId=' + user.id + '&verificationString=' + verificationString
 250   await Emailer.Instance.addForgetPasswordEmailJob(user.email, url)
 251
 252   return res.status(204).end()
 253 }
 254
 255 async function resetUserPassword (req: express.Request, res: express.Response, next: express.NextFunction) {
 256   const user = res.locals.user as UserModel
 257   user.password = req.body.password
 258
 259   await user.save()
 260
 261   return res.status(204).end()
 262 }
 263
 264 function success (req: express.Request, res: express.Response, next: express.NextFunction) {
 265   res.end()
 266 }
 267
 268 async function changeUserBlock (res: express.Response, user: UserModel, block: boolean, reason?: string) {
 269   const oldUserAuditView = new UserAuditView(user.toFormattedJSON())
 270
 271   user.blocked = block
 272   user.blockedReason = reason || null
 273
 274   await sequelizeTypescript.transaction(async t => {
 275     await OAuthTokenModel.deleteUserToken(user.id, t)
 276
 277     await user.save({ transaction: t })
 278   })
 279
 280   await Emailer.Instance.addUserBlockJob(user, block, reason)
 281
 282   auditLogger.update(
 283     res.locals.oauth.token.User.Account.Actor.getIdentifier(),
 284     new UserAuditView(user.toFormattedJSON()),
 285     oldUserAuditView
 286   )
 287 }