server/controllers/api/users.ts

   1 import * as express from 'express'
   2 import { extname, join } from 'path'
   3 import * as sharp from 'sharp'
   4 import * as uuidv4 from 'uuid/v4'
   5 import { UserCreate, UserRight, UserRole, UserUpdate, UserUpdateMe, UserVideoRate as FormattedUserVideoRate } from '../../../shared'
   6 import { unlinkPromise } from '../../helpers/core-utils'
   7 import { retryTransactionWrapper } from '../../helpers/database-utils'
   8 import { logger } from '../../helpers/logger'
   9 import { createReqFiles, getFormattedObjects } from '../../helpers/utils'
  10 import { AVATAR_MIMETYPE_EXT, AVATARS_SIZE, CONFIG, sequelizeTypescript } from '../../initializers'
  11 import { sendUpdateUser } from '../../lib/activitypub/send'
  12 import { createUserAccountAndChannel } from '../../lib/user'
  13 import {
  14   asyncMiddleware, authenticate, ensureUserHasRight, ensureUserRegistrationAllowed, paginationValidator, setPagination, setUsersSort,
  15   setVideosSort, token, usersAddValidator, usersGetValidator, usersRegisterValidator, usersRemoveValidator, usersSortValidator,
  16   usersUpdateMeValidator, usersUpdateValidator, usersVideoRatingValidator
  17 } from '../../middlewares'
  18 import { usersUpdateMyAvatarValidator, videosSortValidator } from '../../middlewares/validators'
  19 import { AccountVideoRateModel } from '../../models/account/account-video-rate'
  20 import { UserModel } from '../../models/account/user'
  21 import { AvatarModel } from '../../models/avatar/avatar'
  22 import { VideoModel } from '../../models/video/video'
  23
  24 const reqAvatarFile = createReqFiles('avatarfile', CONFIG.STORAGE.AVATARS_DIR, AVATAR_MIMETYPE_EXT)
  25
  26 const usersRouter = express.Router()
  27
  28 usersRouter.get('/me',
  29   authenticate,
  30   asyncMiddleware(getUserInformation)
  31 )
  32
  33 usersRouter.get('/me/videos',
  34   authenticate,
  35   paginationValidator,
  36   videosSortValidator,
  37   setVideosSort,
  38   setPagination,
  39   asyncMiddleware(getUserVideos)
  40 )
  41
  42 usersRouter.get('/me/videos/:videoId/rating',
  43   authenticate,
  44   asyncMiddleware(usersVideoRatingValidator),
  45   asyncMiddleware(getUserVideoRating)
  46 )
  47
  48 usersRouter.get('/',
  49   authenticate,
  50   ensureUserHasRight(UserRight.MANAGE_USERS),
  51   paginationValidator,
  52   usersSortValidator,
  53   setUsersSort,
  54   setPagination,
  55   asyncMiddleware(listUsers)
  56 )
  57
  58 usersRouter.get('/:id',
  59   asyncMiddleware(usersGetValidator),
  60   getUser
  61 )
  62
  63 usersRouter.post('/',
  64   authenticate,
  65   ensureUserHasRight(UserRight.MANAGE_USERS),
  66   asyncMiddleware(usersAddValidator),
  67   asyncMiddleware(createUserRetryWrapper)
  68 )
  69
  70 usersRouter.post('/register',
  71   asyncMiddleware(ensureUserRegistrationAllowed),
  72   asyncMiddleware(usersRegisterValidator),
  73   asyncMiddleware(registerUserRetryWrapper)
  74 )
  75
  76 usersRouter.put('/me',
  77   authenticate,
  78   usersUpdateMeValidator,
  79   asyncMiddleware(updateMe)
  80 )
  81
  82 usersRouter.post('/me/avatar/pick',
  83   authenticate,
  84   reqAvatarFile,
  85   usersUpdateMyAvatarValidator,
  86   asyncMiddleware(updateMyAvatar)
  87 )
  88
  89 usersRouter.put('/:id',
  90   authenticate,
  91   ensureUserHasRight(UserRight.MANAGE_USERS),
  92   asyncMiddleware(usersUpdateValidator),
  93   asyncMiddleware(updateUser)
  94 )
  95
  96 usersRouter.delete('/:id',
  97   authenticate,
  98   ensureUserHasRight(UserRight.MANAGE_USERS),
  99   asyncMiddleware(usersRemoveValidator),
 100   asyncMiddleware(removeUser)
 101 )
 102
 103 usersRouter.post('/token', token, success)
 104 // TODO: Once https://github.com/oauthjs/node-oauth2-server/pull/289 is merged, implement revoke token route
 105
 106 // ---------------------------------------------------------------------------
 107
 108 export {
 109   usersRouter
 110 }
 111
 112 // ---------------------------------------------------------------------------
 113
 114 async function getUserVideos (req: express.Request, res: express.Response, next: express.NextFunction) {
 115   const user = res.locals.oauth.token.User as UserModel
 116   const resultList = await VideoModel.listUserVideosForApi(user.id ,req.query.start, req.query.count, req.query.sort)
 117
 118   return res.json(getFormattedObjects(resultList.data, resultList.total))
 119 }
 120
 121 async function createUserRetryWrapper (req: express.Request, res: express.Response, next: express.NextFunction) {
 122   const options = {
 123     arguments: [ req ],
 124     errorMessage: 'Cannot insert the user with many retries.'
 125   }
 126
 127   await retryTransactionWrapper(createUser, options)
 128
 129   // TODO : include Location of the new user -> 201
 130   return res.type('json').status(204).end()
 131 }
 132
 133 async function createUser (req: express.Request) {
 134   const body: UserCreate = req.body
 135   const user = new UserModel({
 136     username: body.username,
 137     password: body.password,
 138     email: body.email,
 139     displayNSFW: false,
 140     autoPlayVideo: true,
 141     role: body.role,
 142     videoQuota: body.videoQuota
 143   })
 144
 145   await createUserAccountAndChannel(user)
 146
 147   logger.info('User %s with its channel and account created.', body.username)
 148 }
 149
 150 async function registerUserRetryWrapper (req: express.Request, res: express.Response, next: express.NextFunction) {
 151   const options = {
 152     arguments: [ req ],
 153     errorMessage: 'Cannot insert the user with many retries.'
 154   }
 155
 156   await retryTransactionWrapper(registerUser, options)
 157
 158   return res.type('json').status(204).end()
 159 }
 160
 161 async function registerUser (req: express.Request) {
 162   const body: UserCreate = req.body
 163
 164   const user = new UserModel({
 165     username: body.username,
 166     password: body.password,
 167     email: body.email,
 168     displayNSFW: false,
 169     autoPlayVideo: true,
 170     role: UserRole.USER,
 171     videoQuota: CONFIG.USER.VIDEO_QUOTA
 172   })
 173
 174   await createUserAccountAndChannel(user)
 175
 176   logger.info('User %s with its channel and account registered.', body.username)
 177 }
 178
 179 async function getUserInformation (req: express.Request, res: express.Response, next: express.NextFunction) {
 180   // We did not load channels in res.locals.user
 181   const user = await UserModel.loadByUsernameAndPopulateChannels(res.locals.oauth.token.user.username)
 182
 183   return res.json(user.toFormattedJSON())
 184 }
 185
 186 function getUser (req: express.Request, res: express.Response, next: express.NextFunction) {
 187   return res.json(res.locals.user.toFormattedJSON())
 188 }
 189
 190 async function getUserVideoRating (req: express.Request, res: express.Response, next: express.NextFunction) {
 191   const videoId = +req.params.videoId
 192   const accountId = +res.locals.oauth.token.User.Account.id
 193
 194   const ratingObj = await AccountVideoRateModel.load(accountId, videoId, null)
 195   const rating = ratingObj ? ratingObj.type : 'none'
 196
 197   const json: FormattedUserVideoRate = {
 198     videoId,
 199     rating
 200   }
 201   res.json(json)
 202 }
 203
 204 async function listUsers (req: express.Request, res: express.Response, next: express.NextFunction) {
 205   const resultList = await UserModel.listForApi(req.query.start, req.query.count, req.query.sort)
 206
 207   return res.json(getFormattedObjects(resultList.data, resultList.total))
 208 }
 209
 210 async function removeUser (req: express.Request, res: express.Response, next: express.NextFunction) {
 211   const user = await UserModel.loadById(req.params.id)
 212
 213   await user.destroy()
 214
 215   return res.sendStatus(204)
 216 }
 217
 218 async function updateMe (req: express.Request, res: express.Response, next: express.NextFunction) {
 219   const body: UserUpdateMe = req.body
 220
 221   const user = res.locals.oauth.token.user
 222
 223   if (body.password !== undefined) user.password = body.password
 224   if (body.email !== undefined) user.email = body.email
 225   if (body.displayNSFW !== undefined) user.displayNSFW = body.displayNSFW
 226   if (body.autoPlayVideo !== undefined) user.autoPlayVideo = body.autoPlayVideo
 227
 228   await user.save()
 229   await sendUpdateUser(user, undefined)
 230
 231   return res.sendStatus(204)
 232 }
 233
 234 async function updateMyAvatar (req: express.Request, res: express.Response, next: express.NextFunction) {
 235   const avatarPhysicalFile = req.files['avatarfile'][0]
 236   const user = res.locals.oauth.token.user
 237   const actor = user.Account.Actor
 238
 239   const avatarDir = CONFIG.STORAGE.AVATARS_DIR
 240   const source = join(avatarDir, avatarPhysicalFile.filename)
 241   const extension = extname(avatarPhysicalFile.filename)
 242   const avatarName = uuidv4() + extension
 243   const destination = join(avatarDir, avatarName)
 244
 245   await sharp(source)
 246     .resize(AVATARS_SIZE.width, AVATARS_SIZE.height)
 247     .toFile(destination)
 248
 249   await unlinkPromise(source)
 250
 251   const { avatar } = await sequelizeTypescript.transaction(async t => {
 252     const avatar = await AvatarModel.create({
 253       filename: avatarName
 254     }, { transaction: t })
 255
 256     if (actor.Avatar) {
 257       try {
 258         await actor.Avatar.destroy({ transaction: t })
 259       } catch (err) {
 260         logger.error('Cannot remove old avatar of user %s.', user.username, err)
 261       }
 262     }
 263
 264     actor.set('avatarId', avatar.id)
 265     actor.Avatar = avatar
 266     await actor.save({ transaction: t })
 267
 268     await sendUpdateUser(user, undefined)
 269
 270     return { actor, avatar }
 271   })
 272
 273   return res
 274     .json({
 275       avatar: avatar.toFormattedJSON()
 276     })
 277     .end()
 278 }
 279
 280 async function updateUser (req: express.Request, res: express.Response, next: express.NextFunction) {
 281   const body: UserUpdate = req.body
 282   const user = res.locals.user as UserModel
 283
 284   if (body.email !== undefined) user.email = body.email
 285   if (body.videoQuota !== undefined) user.videoQuota = body.videoQuota
 286   if (body.role !== undefined) user.role = body.role
 287
 288   await user.save()
 289
 290   // Don't need to send this update to followers, these attributes are not propagated
 291
 292   return res.sendStatus(204)
 293 }
 294
 295 function success (req: express.Request, res: express.Response, next: express.NextFunction) {
 296   res.end()
 297 }