server/middlewares/validators/video-channels.ts

   1 import * as express from 'express'
   2 import { body, param } from 'express-validator/check'
   3 import { UserRight } from '../../../shared'
   4 import { isIdValid } from '../../helpers/custom-validators/misc'
   5 import {
   6   isVideoChannelDescriptionValid,
   7   isVideoChannelExist,
   8   isVideoChannelNameValid
   9 } from '../../helpers/custom-validators/video-channels'
  10 import { isIdOrUUIDValid } from '../../helpers/index'
  11 import { logger } from '../../helpers/logger'
  12 import { database as db } from '../../initializers'
  13 import { UserInstance } from '../../models'
  14 import { areValidationErrors } from './utils'
  15 import { isAccountIdExist } from '../../helpers/custom-validators/accounts'
  16 import { VideoChannelInstance } from '../../models/video/video-channel-interface'
  17
  18 const listVideoAccountChannelsValidator = [
  19   param('accountId').custom(isIdOrUUIDValid).withMessage('Should have a valid account id'),
  20
  21   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
  22     logger.debug('Checking listVideoAccountChannelsValidator parameters', { parameters: req.body })
  23
  24     if (areValidationErrors(req, res)) return
  25     if (!await isAccountIdExist(req.params.accountId, res)) return
  26
  27     return next()
  28   }
  29 ]
  30
  31 const videoChannelsAddValidator = [
  32   body('name').custom(isVideoChannelNameValid).withMessage('Should have a valid name'),
  33   body('description').custom(isVideoChannelDescriptionValid).withMessage('Should have a valid description'),
  34
  35   (req: express.Request, res: express.Response, next: express.NextFunction) => {
  36     logger.debug('Checking videoChannelsAdd parameters', { parameters: req.body })
  37
  38     if (areValidationErrors(req, res)) return
  39
  40     return next()
  41   }
  42 ]
  43
  44 const videoChannelsUpdateValidator = [
  45   param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
  46   body('name').optional().custom(isVideoChannelNameValid).withMessage('Should have a valid name'),
  47   body('description').optional().custom(isVideoChannelDescriptionValid).withMessage('Should have a valid description'),
  48
  49   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
  50     logger.debug('Checking videoChannelsUpdate parameters', { parameters: req.body })
  51
  52     if (areValidationErrors(req, res)) return
  53     if (!await isVideoChannelExist(req.params.id, res)) return
  54
  55     // We need to make additional checks
  56     if (res.locals.videoChannel.isOwned() === false) {
  57       return res.status(403)
  58         .json({ error: 'Cannot update video channel of another server' })
  59         .end()
  60     }
  61
  62     if (res.locals.videoChannel.Account.userId !== res.locals.oauth.token.User.id) {
  63       return res.status(403)
  64         .json({ error: 'Cannot update video channel of another user' })
  65         .end()
  66     }
  67
  68     return next()
  69   }
  70 ]
  71
  72 const videoChannelsRemoveValidator = [
  73   param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
  74
  75   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
  76     logger.debug('Checking videoChannelsRemove parameters', { parameters: req.params })
  77
  78     if (areValidationErrors(req, res)) return
  79     if (!await isVideoChannelExist(req.params.id, res)) return
  80
  81     // Check if the user who did the request is able to delete the video
  82     if (!checkUserCanDeleteVideoChannel(res.locals.user, res.locals.videoChannel, res)) return
  83     if (!await checkVideoChannelIsNotTheLastOne(res)) return
  84
  85     return next()
  86   }
  87 ]
  88
  89 const videoChannelsGetValidator = [
  90   param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
  91
  92   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
  93     logger.debug('Checking videoChannelsGet parameters', { parameters: req.params })
  94
  95     if (areValidationErrors(req, res)) return
  96     if (!await isVideoChannelExist(req.params.id, res)) return
  97
  98     return next()
  99   }
 100 ]
 101
 102 const videoChannelsShareValidator = [
 103   param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
 104   param('accountId').custom(isIdValid).not().isEmpty().withMessage('Should have a valid account id'),
 105
 106   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
 107     logger.debug('Checking videoChannelShare parameters', { parameters: req.params })
 108
 109     if (areValidationErrors(req, res)) return
 110     if (!await isVideoChannelExist(req.params.id, res)) return
 111
 112     const share = await db.VideoChannelShare.load(res.locals.video.id, req.params.accountId, undefined)
 113     if (!share) {
 114       return res.status(404)
 115         .end()
 116     }
 117
 118     res.locals.videoChannelShare = share
 119
 120     return next()
 121   }
 122 ]
 123
 124 // ---------------------------------------------------------------------------
 125
 126 export {
 127   listVideoAccountChannelsValidator,
 128   videoChannelsAddValidator,
 129   videoChannelsUpdateValidator,
 130   videoChannelsRemoveValidator,
 131   videoChannelsGetValidator,
 132   videoChannelsShareValidator
 133 }
 134
 135 // ---------------------------------------------------------------------------
 136
 137 function checkUserCanDeleteVideoChannel (user: UserInstance, videoChannel: VideoChannelInstance, res: express.Response) {
 138   // Retrieve the user who did the request
 139   if (videoChannel.isOwned() === false) {
 140     res.status(403)
 141               .json({ error: 'Cannot remove video channel of another server.' })
 142               .end()
 143
 144     return false
 145   }
 146
 147   // Check if the user can delete the video channel
 148   // The user can delete it if s/he is an admin
 149   // Or if s/he is the video channel's account
 150   if (user.hasRight(UserRight.REMOVE_ANY_VIDEO_CHANNEL) === false && videoChannel.Account.userId !== user.id) {
 151     res.status(403)
 152               .json({ error: 'Cannot remove video channel of another user' })
 153               .end()
 154
 155     return false
 156   }
 157
 158   return true
 159 }
 160
 161 async function checkVideoChannelIsNotTheLastOne (res: express.Response) {
 162   const count = await db.VideoChannel.countByAccount(res.locals.oauth.token.User.Account.id)
 163
 164   if (count <= 1) {
 165     res.status(409)
 166       .json({ error: 'Cannot remove the last channel of this user' })
 167       .end()
 168
 169     return false
 170   }
 171
 172   return true
 173 }