server/helpers/middlewares/videos.ts

   1 import { Response } from 'express'
   2 import { fetchVideo, VideoFetchType } from '../video'
   3 import { UserRight } from '../../../shared/models/users'
   4 import { VideoChannelModel } from '../../models/video/video-channel'
   5 import { MUser, MUserAccountId, MVideoAccountLight, MVideoFullLight, MVideoThumbnail, MVideoWithRights } from '@server/typings/models'
   6
   7 async function doesVideoExist (id: number | string, res: Response, fetchType: VideoFetchType = 'all') {
   8   const userId = res.locals.oauth ? res.locals.oauth.token.User.id : undefined
   9
  10   const video = await fetchVideo(id, fetchType, userId)
  11
  12   if (video === null) {
  13     res.status(404)
  14        .json({ error: 'Video not found' })
  15        .end()
  16
  17     return false
  18   }
  19
  20   switch (fetchType) {
  21     case 'all':
  22       res.locals.videoAll = video as MVideoFullLight
  23       break
  24
  25     case 'id':
  26       res.locals.videoId = video
  27       break
  28
  29     case 'only-video':
  30       res.locals.onlyVideo = video as MVideoThumbnail
  31       break
  32
  33     case 'only-video-with-rights':
  34       res.locals.onlyVideoWithRights = video as MVideoWithRights
  35       break
  36   }
  37
  38   return true
  39 }
  40
  41 async function doesVideoChannelOfAccountExist (channelId: number, user: MUserAccountId, res: Response) {
  42   if (user.hasRight(UserRight.UPDATE_ANY_VIDEO) === true) {
  43     const videoChannel = await VideoChannelModel.loadAndPopulateAccount(channelId)
  44     if (videoChannel === null) {
  45       res.status(400)
  46          .json({ error: 'Unknown video `video channel` on this instance.' })
  47          .end()
  48
  49       return false
  50     }
  51
  52     res.locals.videoChannel = videoChannel
  53     return true
  54   }
  55
  56   const videoChannel = await VideoChannelModel.loadByIdAndAccount(channelId, user.Account.id)
  57   if (videoChannel === null) {
  58     res.status(400)
  59        .json({ error: 'Unknown video `video channel` for this account.' })
  60        .end()
  61
  62     return false
  63   }
  64
  65   res.locals.videoChannel = videoChannel
  66   return true
  67 }
  68
  69 function checkUserCanManageVideo (user: MUser, video: MVideoAccountLight, right: UserRight, res: Response) {
  70   // Retrieve the user who did the request
  71   if (video.isOwned() === false) {
  72     res.status(403)
  73        .json({ error: 'Cannot manage a video of another server.' })
  74        .end()
  75     return false
  76   }
  77
  78   // Check if the user can delete the video
  79   // The user can delete it if he has the right
  80   // Or if s/he is the video's account
  81   const account = video.VideoChannel.Account
  82   if (user.hasRight(right) === false && account.userId !== user.id) {
  83     res.status(403)
  84        .json({ error: 'Cannot manage a video of another user.' })
  85        .end()
  86     return false
  87   }
  88
  89   return true
  90 }
  91
  92 // ---------------------------------------------------------------------------
  93
  94 export {
  95   doesVideoChannelOfAccountExist,
  96   doesVideoExist,
  97   checkUserCanManageVideo
  98 }