server/controllers/api/videos/abuse.ts

   1 import * as express from 'express'
   2 import { UserRight, VideoAbuseCreate, VideoAbuseState, VideoAbuse, videoAbusePredefinedReasonsMap } from '../../../../shared'
   3 import { logger } from '../../../helpers/logger'
   4 import { getFormattedObjects } from '../../../helpers/utils'
   5 import { sequelizeTypescript } from '../../../initializers/database'
   6 import {
   7   asyncMiddleware,
   8   asyncRetryTransactionMiddleware,
   9   authenticate,
  10   ensureUserHasRight,
  11   paginationValidator,
  12   setDefaultPagination,
  13   setDefaultSort,
  14   videoAbuseGetValidator,
  15   videoAbuseReportValidator,
  16   videoAbusesSortValidator,
  17   videoAbuseUpdateValidator,
  18   videoAbuseListValidator
  19 } from '../../../middlewares'
  20 import { AccountModel } from '../../../models/account/account'
  21 import { VideoAbuseModel } from '../../../models/video/video-abuse'
  22 import { auditLoggerFactory, VideoAbuseAuditView } from '../../../helpers/audit-logger'
  23 import { Notifier } from '../../../lib/notifier'
  24 import { sendVideoAbuse } from '../../../lib/activitypub/send/send-flag'
  25 import { MVideoAbuseAccountVideo } from '../../../types/models/video'
  26 import { getServerActor } from '@server/models/application/application'
  27 import { MAccountDefault } from '@server/types/models'
  28
  29 const auditLogger = auditLoggerFactory('abuse')
  30 const abuseVideoRouter = express.Router()
  31
  32 abuseVideoRouter.get('/abuse',
  33   authenticate,
  34   ensureUserHasRight(UserRight.MANAGE_VIDEO_ABUSES),
  35   paginationValidator,
  36   videoAbusesSortValidator,
  37   setDefaultSort,
  38   setDefaultPagination,
  39   videoAbuseListValidator,
  40   asyncMiddleware(listVideoAbuses)
  41 )
  42 abuseVideoRouter.put('/:videoId/abuse/:id',
  43   authenticate,
  44   ensureUserHasRight(UserRight.MANAGE_VIDEO_ABUSES),
  45   asyncMiddleware(videoAbuseUpdateValidator),
  46   asyncRetryTransactionMiddleware(updateVideoAbuse)
  47 )
  48 abuseVideoRouter.post('/:videoId/abuse',
  49   authenticate,
  50   asyncMiddleware(videoAbuseReportValidator),
  51   asyncRetryTransactionMiddleware(reportVideoAbuse)
  52 )
  53 abuseVideoRouter.delete('/:videoId/abuse/:id',
  54   authenticate,
  55   ensureUserHasRight(UserRight.MANAGE_VIDEO_ABUSES),
  56   asyncMiddleware(videoAbuseGetValidator),
  57   asyncRetryTransactionMiddleware(deleteVideoAbuse)
  58 )
  59
  60 // ---------------------------------------------------------------------------
  61
  62 export {
  63   abuseVideoRouter
  64 }
  65
  66 // ---------------------------------------------------------------------------
  67
  68 async function listVideoAbuses (req: express.Request, res: express.Response) {
  69   const user = res.locals.oauth.token.user
  70   const serverActor = await getServerActor()
  71
  72   const resultList = await VideoAbuseModel.listForApi({
  73     start: req.query.start,
  74     count: req.query.count,
  75     sort: req.query.sort,
  76     id: req.query.id,
  77     predefinedReason: req.query.predefinedReason,
  78     search: req.query.search,
  79     state: req.query.state,
  80     videoIs: req.query.videoIs,
  81     searchReporter: req.query.searchReporter,
  82     searchReportee: req.query.searchReportee,
  83     searchVideo: req.query.searchVideo,
  84     searchVideoChannel: req.query.searchVideoChannel,
  85     serverAccountId: serverActor.Account.id,
  86     user
  87   })
  88
  89   return res.json(getFormattedObjects(resultList.data, resultList.total))
  90 }
  91
  92 async function updateVideoAbuse (req: express.Request, res: express.Response) {
  93   const videoAbuse = res.locals.videoAbuse
  94
  95   if (req.body.moderationComment !== undefined) videoAbuse.moderationComment = req.body.moderationComment
  96   if (req.body.state !== undefined) videoAbuse.state = req.body.state
  97
  98   await sequelizeTypescript.transaction(t => {
  99     return videoAbuse.save({ transaction: t })
 100   })
 101
 102   // Do not send the delete to other instances, we updated OUR copy of this video abuse
 103
 104   return res.type('json').status(204).end()
 105 }
 106
 107 async function deleteVideoAbuse (req: express.Request, res: express.Response) {
 108   const videoAbuse = res.locals.videoAbuse
 109
 110   await sequelizeTypescript.transaction(t => {
 111     return videoAbuse.destroy({ transaction: t })
 112   })
 113
 114   // Do not send the delete to other instances, we delete OUR copy of this video abuse
 115
 116   return res.type('json').status(204).end()
 117 }
 118
 119 async function reportVideoAbuse (req: express.Request, res: express.Response) {
 120   const videoInstance = res.locals.videoAll
 121   const body: VideoAbuseCreate = req.body
 122   let reporterAccount: MAccountDefault
 123   let videoAbuseJSON: VideoAbuse
 124
 125   const videoAbuseInstance = await sequelizeTypescript.transaction(async t => {
 126     reporterAccount = await AccountModel.load(res.locals.oauth.token.User.Account.id, t)
 127     const predefinedReasons = body.predefinedReasons?.map(r => videoAbusePredefinedReasonsMap[r])
 128
 129     const abuseToCreate = {
 130       reporterAccountId: reporterAccount.id,
 131       reason: body.reason,
 132       videoId: videoInstance.id,
 133       state: VideoAbuseState.PENDING,
 134       predefinedReasons,
 135       startAt: body.startAt,
 136       endAt: body.endAt
 137     }
 138
 139     const videoAbuseInstance: MVideoAbuseAccountVideo = await VideoAbuseModel.create(abuseToCreate, { transaction: t })
 140     videoAbuseInstance.Video = videoInstance
 141     videoAbuseInstance.Account = reporterAccount
 142
 143     // We send the video abuse to the origin server
 144     if (videoInstance.isOwned() === false) {
 145       await sendVideoAbuse(reporterAccount.Actor, videoAbuseInstance, videoInstance, t)
 146     }
 147
 148     videoAbuseJSON = videoAbuseInstance.toFormattedJSON()
 149     auditLogger.create(reporterAccount.Actor.getIdentifier(), new VideoAbuseAuditView(videoAbuseJSON))
 150
 151     return videoAbuseInstance
 152   })
 153
 154   Notifier.Instance.notifyOnNewVideoAbuse({
 155     videoAbuse: videoAbuseJSON,
 156     videoAbuseInstance,
 157     reporter: reporterAccount.Actor.getIdentifier()
 158   })
 159
 160   logger.info('Abuse report for video "%s" created.', videoInstance.name)
 161
 162   return res.json({ videoAbuse: videoAbuseJSON }).end()
 163 }