server/middlewares/validators/video-channels.ts

   1 import * as express from 'express'
   2 import { body, param } from 'express-validator/check'
   3 import { UserRight } from '../../../shared'
   4 import { checkAccountIdExists } from '../../helpers/custom-validators/accounts'
   5 import { isIdValid } from '../../helpers/custom-validators/misc'
   6 import {
   7   checkVideoChannelExists,
   8   isVideoChannelDescriptionValid,
   9   isVideoChannelExistsPromise,
  10   isVideoChannelNameValid
  11 } from '../../helpers/custom-validators/video-channels'
  12 import { isIdOrUUIDValid } from '../../helpers/index'
  13 import { logger } from '../../helpers/logger'
  14 import { database as db } from '../../initializers'
  15 import { UserInstance } from '../../models'
  16 import { areValidationErrors, checkErrors } from './utils'
  17
  18 const listVideoAccountChannelsValidator = [
  19   param('accountId').custom(isIdOrUUIDValid).withMessage('Should have a valid account id'),
  20
  21   (req: express.Request, res: express.Response, next: express.NextFunction) => {
  22     logger.debug('Checking listVideoAccountChannelsValidator parameters', { parameters: req.body })
  23
  24     checkErrors(req, res, () => {
  25       checkAccountIdExists(req.params.accountId, res, next)
  26     })
  27   }
  28 ]
  29
  30 const videoChannelsAddValidator = [
  31   body('name').custom(isVideoChannelNameValid).withMessage('Should have a valid name'),
  32   body('description').custom(isVideoChannelDescriptionValid).withMessage('Should have a valid description'),
  33
  34   (req: express.Request, res: express.Response, next: express.NextFunction) => {
  35     logger.debug('Checking videoChannelsAdd parameters', { parameters: req.body })
  36
  37     checkErrors(req, res, next)
  38   }
  39 ]
  40
  41 const videoChannelsUpdateValidator = [
  42   param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
  43   body('name').optional().custom(isVideoChannelNameValid).withMessage('Should have a valid name'),
  44   body('description').optional().custom(isVideoChannelDescriptionValid).withMessage('Should have a valid description'),
  45
  46   (req: express.Request, res: express.Response, next: express.NextFunction) => {
  47     logger.debug('Checking videoChannelsUpdate parameters', { parameters: req.body })
  48
  49     checkErrors(req, res, () => {
  50       checkVideoChannelExists(req.params.id, res, () => {
  51         // We need to make additional checks
  52         if (res.locals.videoChannel.isOwned() === false) {
  53           return res.status(403)
  54             .json({ error: 'Cannot update video channel of another server' })
  55             .end()
  56         }
  57
  58         if (res.locals.videoChannel.Account.userId !== res.locals.oauth.token.User.id) {
  59           return res.status(403)
  60             .json({ error: 'Cannot update video channel of another user' })
  61             .end()
  62         }
  63
  64         next()
  65       })
  66     })
  67   }
  68 ]
  69
  70 const videoChannelsRemoveValidator = [
  71   param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
  72
  73   (req: express.Request, res: express.Response, next: express.NextFunction) => {
  74     logger.debug('Checking videoChannelsRemove parameters', { parameters: req.params })
  75
  76     checkErrors(req, res, () => {
  77       checkVideoChannelExists(req.params.id, res, () => {
  78         // Check if the user who did the request is able to delete the video
  79         checkUserCanDeleteVideoChannel(res, () => {
  80           checkVideoChannelIsNotTheLastOne(res, next)
  81         })
  82       })
  83     })
  84   }
  85 ]
  86
  87 const videoChannelsGetValidator = [
  88   param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
  89
  90   (req: express.Request, res: express.Response, next: express.NextFunction) => {
  91     logger.debug('Checking videoChannelsGet parameters', { parameters: req.params })
  92
  93     checkErrors(req, res, () => {
  94       checkVideoChannelExists(req.params.id, res, next)
  95     })
  96   }
  97 ]
  98
  99 const videoChannelsShareValidator = [
 100   param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
 101   param('accountId').custom(isIdValid).not().isEmpty().withMessage('Should have a valid account id'),
 102
 103   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
 104     logger.debug('Checking videoChannelShare parameters', { parameters: req.params })
 105
 106     if (areValidationErrors(req, res)) return
 107     if (!await isVideoChannelExistsPromise(req.params.id, res)) return
 108
 109     const share = await db.VideoChannelShare.load(res.locals.video.id, req.params.accountId)
 110     if (!share) {
 111       return res.status(404)
 112         .end()
 113     }
 114
 115     res.locals.videoChannelShare = share
 116
 117     return next()
 118   }
 119 ]
 120
 121 // ---------------------------------------------------------------------------
 122
 123 export {
 124   listVideoAccountChannelsValidator,
 125   videoChannelsAddValidator,
 126   videoChannelsUpdateValidator,
 127   videoChannelsRemoveValidator,
 128   videoChannelsGetValidator,
 129   videoChannelsShareValidator
 130 }
 131
 132 // ---------------------------------------------------------------------------
 133
 134 function checkUserCanDeleteVideoChannel (res: express.Response, callback: () => void) {
 135   const user: UserInstance = res.locals.oauth.token.User
 136
 137   // Retrieve the user who did the request
 138   if (res.locals.videoChannel.isOwned() === false) {
 139     return res.status(403)
 140               .json({ error: 'Cannot remove video channel of another server.' })
 141               .end()
 142   }
 143
 144   // Check if the user can delete the video channel
 145   // The user can delete it if s/he is an admin
 146   // Or if s/he is the video channel's account
 147   if (user.hasRight(UserRight.REMOVE_ANY_VIDEO_CHANNEL) === false && res.locals.videoChannel.Account.userId !== user.id) {
 148     return res.status(403)
 149               .json({ error: 'Cannot remove video channel of another user' })
 150               .end()
 151   }
 152
 153   // If we reach this comment, we can delete the video
 154   callback()
 155 }
 156
 157 function checkVideoChannelIsNotTheLastOne (res: express.Response, callback: () => void) {
 158   db.VideoChannel.countByAccount(res.locals.oauth.token.User.Account.id)
 159     .then(count => {
 160       if (count <= 1) {
 161         return res.status(409)
 162           .json({ error: 'Cannot remove the last channel of this user' })
 163           .end()
 164       }
 165
 166       callback()
 167     })
 168 }