]> git.immae.eu Git - github/Chocobozzz/PeerTube.git/blob - server/lib/activitypub/process/process-delete.ts
Improve AP actor checks
[github/Chocobozzz/PeerTube.git] / server / lib / activitypub / process / process-delete.ts
1 import { ActivityDelete } from '../../../../shared/models/activitypub'
2 import { retryTransactionWrapper } from '../../../helpers/database-utils'
3 import { logger } from '../../../helpers/logger'
4 import { sequelizeTypescript } from '../../../initializers'
5 import { AccountModel } from '../../../models/account/account'
6 import { ActorModel } from '../../../models/activitypub/actor'
7 import { VideoModel } from '../../../models/video/video'
8 import { VideoChannelModel } from '../../../models/video/video-channel'
9 import { VideoCommentModel } from '../../../models/video/video-comment'
10 import { forwardActivity } from '../send/utils'
11
12 async function processDeleteActivity (activity: ActivityDelete, byActor: ActorModel) {
13 const objectUrl = typeof activity.object === 'string' ? activity.object : activity.object.id
14
15 if (activity.actor === objectUrl) {
16 // We need more attributes (all the account and channel)
17 const byActorFull = await ActorModel.loadByUrlAndPopulateAccountAndChannel(byActor.url)
18
19 if (byActorFull.type === 'Person') {
20 if (!byActorFull.Account) throw new Error('Actor ' + byActorFull.url + ' is a person but we cannot find it in database.')
21
22 byActorFull.Account.Actor = await byActorFull.Account.$get('Actor') as ActorModel
23 return retryTransactionWrapper(processDeleteAccount, byActorFull.Account)
24 } else if (byActorFull.type === 'Group') {
25 if (!byActorFull.VideoChannel) throw new Error('Actor ' + byActorFull.url + ' is a group but we cannot find it in database.')
26
27 byActorFull.VideoChannel.Actor = await byActorFull.VideoChannel.$get('Actor') as ActorModel
28 return retryTransactionWrapper(processDeleteVideoChannel, byActorFull.VideoChannel)
29 }
30 }
31
32 {
33 const videoCommentInstance = await VideoCommentModel.loadByUrlAndPopulateAccount(objectUrl)
34 if (videoCommentInstance) {
35 return retryTransactionWrapper(processDeleteVideoComment, byActor, videoCommentInstance, activity)
36 }
37 }
38
39 {
40 const videoInstance = await VideoModel.loadByUrlAndPopulateAccount(objectUrl)
41 if (videoInstance) {
42 if (videoInstance.isOwned()) throw new Error(`Remote instance cannot delete owned video ${videoInstance.url}.`)
43
44 return retryTransactionWrapper(processDeleteVideo, byActor, videoInstance)
45 }
46 }
47
48 return undefined
49 }
50
51 // ---------------------------------------------------------------------------
52
53 export {
54 processDeleteActivity
55 }
56
57 // ---------------------------------------------------------------------------
58
59 async function processDeleteVideo (actor: ActorModel, videoToDelete: VideoModel) {
60 logger.debug('Removing remote video "%s".', videoToDelete.uuid)
61
62 await sequelizeTypescript.transaction(async t => {
63 if (videoToDelete.VideoChannel.Account.Actor.id !== actor.id) {
64 throw new Error('Account ' + actor.url + ' does not own video channel ' + videoToDelete.VideoChannel.Actor.url)
65 }
66
67 await videoToDelete.destroy({ transaction: t })
68 })
69
70 logger.info('Remote video with uuid %s removed.', videoToDelete.uuid)
71 }
72
73 async function processDeleteAccount (accountToRemove: AccountModel) {
74 logger.debug('Removing remote account "%s".', accountToRemove.Actor.uuid)
75
76 await sequelizeTypescript.transaction(async t => {
77 await accountToRemove.destroy({ transaction: t })
78 })
79
80 logger.info('Remote account with uuid %s removed.', accountToRemove.Actor.uuid)
81 }
82
83 async function processDeleteVideoChannel (videoChannelToRemove: VideoChannelModel) {
84 logger.debug('Removing remote video channel "%s".', videoChannelToRemove.Actor.uuid)
85
86 await sequelizeTypescript.transaction(async t => {
87 await videoChannelToRemove.destroy({ transaction: t })
88 })
89
90 logger.info('Remote video channel with uuid %s removed.', videoChannelToRemove.Actor.uuid)
91 }
92
93 function processDeleteVideoComment (byActor: ActorModel, videoComment: VideoCommentModel, activity: ActivityDelete) {
94 logger.debug('Removing remote video comment "%s".', videoComment.url)
95
96 return sequelizeTypescript.transaction(async t => {
97 if (videoComment.Account.id !== byActor.Account.id) {
98 throw new Error('Account ' + byActor.url + ' does not own video comment ' + videoComment.url)
99 }
100
101 await videoComment.destroy({ transaction: t })
102
103 if (videoComment.Video.isOwned()) {
104 // Don't resend the activity to the sender
105 const exceptions = [ byActor ]
106 await forwardActivity(activity, t, exceptions)
107 }
108
109 logger.info('Remote video comment %s removed.', videoComment.url)
110 })
111 }