server/middlewares/validators/shared/videos.ts

   1 import { Response } from 'express'
   2 import { loadVideo, VideoLoadType } from '@server/lib/model-loaders'
   3 import { VideoChannelModel } from '@server/models/video/video-channel'
   4 import { VideoFileModel } from '@server/models/video/video-file'
   5 import {
   6   MUser,
   7   MUserAccountId,
   8   MVideoAccountLight,
   9   MVideoFormattableDetails,
  10   MVideoFullLight,
  11   MVideoIdThumbnail,
  12   MVideoImmutable,
  13   MVideoThumbnail,
  14   MVideoWithRights
  15 } from '@server/types/models'
  16 import { HttpStatusCode } from '@shared/core-utils'
  17 import { UserRight } from '@shared/models'
  18
  19 async function doesVideoExist (id: number | string, res: Response, fetchType: VideoLoadType = 'all') {
  20   const userId = res.locals.oauth ? res.locals.oauth.token.User.id : undefined
  21
  22   const video = await loadVideo(id, fetchType, userId)
  23
  24   if (video === null) {
  25     res.fail({
  26       status: HttpStatusCode.NOT_FOUND_404,
  27       message: 'Video not found'
  28     })
  29     return false
  30   }
  31
  32   switch (fetchType) {
  33     case 'for-api':
  34       res.locals.videoAPI = video as MVideoFormattableDetails
  35       break
  36
  37     case 'all':
  38       res.locals.videoAll = video as MVideoFullLight
  39       break
  40
  41     case 'only-immutable-attributes':
  42       res.locals.onlyImmutableVideo = video as MVideoImmutable
  43       break
  44
  45     case 'id':
  46       res.locals.videoId = video as MVideoIdThumbnail
  47       break
  48
  49     case 'only-video':
  50       res.locals.onlyVideo = video as MVideoThumbnail
  51       break
  52
  53     case 'only-video-with-rights':
  54       res.locals.onlyVideoWithRights = video as MVideoWithRights
  55       break
  56   }
  57
  58   return true
  59 }
  60
  61 async function doesVideoFileOfVideoExist (id: number, videoIdOrUUID: number | string, res: Response) {
  62   if (!await VideoFileModel.doesVideoExistForVideoFile(id, videoIdOrUUID)) {
  63     res.fail({
  64       status: HttpStatusCode.NOT_FOUND_404,
  65       message: 'VideoFile matching Video not found'
  66     })
  67     return false
  68   }
  69
  70   return true
  71 }
  72
  73 async function doesVideoChannelOfAccountExist (channelId: number, user: MUserAccountId, res: Response) {
  74   const videoChannel = await VideoChannelModel.loadAndPopulateAccount(channelId)
  75
  76   if (videoChannel === null) {
  77     res.fail({ message: 'Unknown video "video channel" for this instance.' })
  78     return false
  79   }
  80
  81   // Don't check account id if the user can update any video
  82   if (user.hasRight(UserRight.UPDATE_ANY_VIDEO) === true) {
  83     res.locals.videoChannel = videoChannel
  84     return true
  85   }
  86
  87   if (videoChannel.Account.id !== user.Account.id) {
  88     res.fail({
  89       message: 'Unknown video "video channel" for this account.'
  90     })
  91     return false
  92   }
  93
  94   res.locals.videoChannel = videoChannel
  95   return true
  96 }
  97
  98 function checkUserCanManageVideo (user: MUser, video: MVideoAccountLight, right: UserRight, res: Response, onlyOwned = true) {
  99   // Retrieve the user who did the request
 100   if (onlyOwned && video.isOwned() === false) {
 101     res.fail({
 102       status: HttpStatusCode.FORBIDDEN_403,
 103       message: 'Cannot manage a video of another server.'
 104     })
 105     return false
 106   }
 107
 108   // Check if the user can delete the video
 109   // The user can delete it if he has the right
 110   // Or if s/he is the video's account
 111   const account = video.VideoChannel.Account
 112   if (user.hasRight(right) === false && account.userId !== user.id) {
 113     res.fail({
 114       status: HttpStatusCode.FORBIDDEN_403,
 115       message: 'Cannot manage a video of another user.'
 116     })
 117     return false
 118   }
 119
 120   return true
 121 }
 122
 123 // ---------------------------------------------------------------------------
 124
 125 export {
 126   doesVideoChannelOfAccountExist,
 127   doesVideoExist,
 128   doesVideoFileOfVideoExist,
 129   checkUserCanManageVideo
 130 }