server/middlewares/validators/videos/video-playlists.ts

   1 import * as express from 'express'
   2 import { body, param, ValidationChain } from 'express-validator/check'
   3 import { UserRight, VideoPrivacy } from '../../../../shared'
   4 import { logger } from '../../../helpers/logger'
   5 import { UserModel } from '../../../models/account/user'
   6 import { areValidationErrors } from '../utils'
   7 import { isVideoExist, isVideoImage } from '../../../helpers/custom-validators/videos'
   8 import { CONSTRAINTS_FIELDS } from '../../../initializers'
   9 import { isIdOrUUIDValid, isUUIDValid, toValueOrNull } from '../../../helpers/custom-validators/misc'
  10 import {
  11   isVideoPlaylistDescriptionValid,
  12   isVideoPlaylistExist,
  13   isVideoPlaylistNameValid,
  14   isVideoPlaylistPrivacyValid
  15 } from '../../../helpers/custom-validators/video-playlists'
  16 import { VideoPlaylistModel } from '../../../models/video/video-playlist'
  17 import { cleanUpReqFiles } from '../../../helpers/express-utils'
  18 import { isVideoChannelIdExist } from '../../../helpers/custom-validators/video-channels'
  19 import { VideoPlaylistElementModel } from '../../../models/video/video-playlist-element'
  20 import { VideoModel } from '../../../models/video/video'
  21 import { authenticatePromiseIfNeeded } from '../../oauth'
  22 import { VideoPlaylistPrivacy } from '../../../../shared/models/videos/playlist/video-playlist-privacy.model'
  23
  24 const videoPlaylistsAddValidator = getCommonPlaylistEditAttributes().concat([
  25   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
  26     logger.debug('Checking videoPlaylistsAddValidator parameters', { parameters: req.body })
  27
  28     if (areValidationErrors(req, res)) return cleanUpReqFiles(req)
  29
  30     if (req.body.videoChannelId && !await isVideoChannelIdExist(req.body.videoChannelId, res)) return cleanUpReqFiles(req)
  31
  32     return next()
  33   }
  34 ])
  35
  36 const videoPlaylistsUpdateValidator = getCommonPlaylistEditAttributes().concat([
  37   param('playlistId')
  38     .custom(isIdOrUUIDValid).withMessage('Should have a valid playlist id/uuid'),
  39
  40   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
  41     logger.debug('Checking videoPlaylistsUpdateValidator parameters', { parameters: req.body })
  42
  43     if (areValidationErrors(req, res)) return cleanUpReqFiles(req)
  44
  45     if (!await isVideoPlaylistExist(req.params.playlistId, res)) return cleanUpReqFiles(req)
  46
  47     const videoPlaylist = res.locals.videoPlaylist
  48
  49     if (!checkUserCanManageVideoPlaylist(res.locals.oauth.token.User, res.locals.videoPlaylist, UserRight.REMOVE_ANY_VIDEO_PLAYLIST, res)) {
  50       return cleanUpReqFiles(req)
  51     }
  52
  53     if (videoPlaylist.privacy !== VideoPlaylistPrivacy.PRIVATE && req.body.privacy === VideoPlaylistPrivacy.PRIVATE) {
  54       cleanUpReqFiles(req)
  55       return res.status(409)
  56                 .json({ error: 'Cannot set "private" a video playlist that was not private.' })
  57     }
  58
  59     if (req.body.videoChannelId && !await isVideoChannelIdExist(req.body.videoChannelId, res)) return cleanUpReqFiles(req)
  60
  61     return next()
  62   }
  63 ])
  64
  65 const videoPlaylistsDeleteValidator = [
  66   param('playlistId')
  67     .custom(isIdOrUUIDValid).withMessage('Should have a valid playlist id/uuid'),
  68
  69   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
  70     logger.debug('Checking videoPlaylistsDeleteValidator parameters', { parameters: req.params })
  71
  72     if (areValidationErrors(req, res)) return
  73
  74     if (!await isVideoPlaylistExist(req.params.playlistId, res)) return
  75     if (!checkUserCanManageVideoPlaylist(res.locals.oauth.token.User, res.locals.videoPlaylist, UserRight.REMOVE_ANY_VIDEO_PLAYLIST, res)) {
  76       return
  77     }
  78
  79     return next()
  80   }
  81 ]
  82
  83 const videoPlaylistsGetValidator = [
  84   param('playlistId')
  85     .custom(isIdOrUUIDValid).withMessage('Should have a valid playlist id/uuid'),
  86
  87   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
  88     logger.debug('Checking videoPlaylistsGetValidator parameters', { parameters: req.params })
  89
  90     if (areValidationErrors(req, res)) return
  91
  92     if (!await isVideoPlaylistExist(req.params.playlistId, res)) return
  93
  94     const videoPlaylist: VideoPlaylistModel = res.locals.videoPlaylist
  95
  96     // Video is unlisted, check we used the uuid to fetch it
  97     if (videoPlaylist.privacy === VideoPlaylistPrivacy.UNLISTED) {
  98       if (isUUIDValid(req.params.playlistId)) return next()
  99
 100       return res.status(404).end()
 101     }
 102
 103     if (videoPlaylist.privacy === VideoPlaylistPrivacy.PRIVATE) {
 104       await authenticatePromiseIfNeeded(req, res)
 105
 106       const user: UserModel = res.locals.oauth ? res.locals.oauth.token.User : null
 107
 108       if (
 109         !user ||
 110         (videoPlaylist.OwnerAccount.userId !== user.id && !user.hasRight(UserRight.UPDATE_ANY_VIDEO_PLAYLIST))
 111       ) {
 112         return res.status(403)
 113                   .json({ error: 'Cannot get this private video playlist.' })
 114       }
 115
 116       return next()
 117     }
 118
 119     return next()
 120   }
 121 ]
 122
 123 const videoPlaylistsAddVideoValidator = [
 124   param('playlistId')
 125     .custom(isIdOrUUIDValid).withMessage('Should have a valid playlist id/uuid'),
 126   body('videoId')
 127     .custom(isIdOrUUIDValid).withMessage('Should have a valid video id/uuid'),
 128   body('startTimestamp')
 129     .optional()
 130     .isInt({ min: 0 }).withMessage('Should have a valid start timestamp'),
 131   body('stopTimestamp')
 132     .optional()
 133     .isInt({ min: 0 }).withMessage('Should have a valid stop timestamp'),
 134
 135   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
 136     logger.debug('Checking videoPlaylistsAddVideoValidator parameters', { parameters: req.params })
 137
 138     if (areValidationErrors(req, res)) return
 139
 140     if (!await isVideoPlaylistExist(req.params.playlistId, res)) return
 141     if (!await isVideoExist(req.body.videoId, res, 'only-video')) return
 142
 143     const videoPlaylist: VideoPlaylistModel = res.locals.videoPlaylist
 144     const video: VideoModel = res.locals.video
 145
 146     const videoPlaylistElement = await VideoPlaylistElementModel.loadByPlaylistAndVideo(videoPlaylist.id, video.id)
 147     if (videoPlaylistElement) {
 148       res.status(409)
 149          .json({ error: 'This video in this playlist already exists' })
 150          .end()
 151
 152       return
 153     }
 154
 155     if (!checkUserCanManageVideoPlaylist(res.locals.oauth.token.User, res.locals.videoPlaylist, UserRight.UPDATE_ANY_VIDEO_PLAYLIST, res)) {
 156       return
 157     }
 158
 159     return next()
 160   }
 161 ]
 162
 163 const videoPlaylistsUpdateOrRemoveVideoValidator = [
 164   param('playlistId')
 165     .custom(isIdOrUUIDValid).withMessage('Should have a valid playlist id/uuid'),
 166   param('videoId')
 167     .custom(isIdOrUUIDValid).withMessage('Should have an video id/uuid'),
 168   body('startTimestamp')
 169     .optional()
 170     .isInt({ min: 0 }).withMessage('Should have a valid start timestamp'),
 171   body('stopTimestamp')
 172     .optional()
 173     .isInt({ min: 0 }).withMessage('Should have a valid stop timestamp'),
 174
 175   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
 176     logger.debug('Checking videoPlaylistsRemoveVideoValidator parameters', { parameters: req.params })
 177
 178     if (areValidationErrors(req, res)) return
 179
 180     if (!await isVideoPlaylistExist(req.params.playlistId, res)) return
 181     if (!await isVideoExist(req.params.videoId, res, 'id')) return
 182
 183     const videoPlaylist: VideoPlaylistModel = res.locals.videoPlaylist
 184     const video: VideoModel = res.locals.video
 185
 186     const videoPlaylistElement = await VideoPlaylistElementModel.loadByPlaylistAndVideo(videoPlaylist.id, video.id)
 187     if (!videoPlaylistElement) {
 188       res.status(404)
 189          .json({ error: 'Video playlist element not found' })
 190          .end()
 191
 192       return
 193     }
 194     res.locals.videoPlaylistElement = videoPlaylistElement
 195
 196     if (!checkUserCanManageVideoPlaylist(res.locals.oauth.token.User, videoPlaylist, UserRight.UPDATE_ANY_VIDEO_PLAYLIST, res)) return
 197
 198     return next()
 199   }
 200 ]
 201
 202 const videoPlaylistElementAPGetValidator = [
 203   param('playlistId')
 204     .custom(isIdOrUUIDValid).withMessage('Should have a valid playlist id/uuid'),
 205   param('videoId')
 206     .custom(isIdOrUUIDValid).withMessage('Should have an video id/uuid'),
 207
 208   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
 209     logger.debug('Checking videoPlaylistElementAPGetValidator parameters', { parameters: req.params })
 210
 211     if (areValidationErrors(req, res)) return
 212
 213     const videoPlaylistElement = await VideoPlaylistElementModel.loadByPlaylistAndVideoForAP(req.params.playlistId, req.params.videoId)
 214     if (!videoPlaylistElement) {
 215       res.status(404)
 216          .json({ error: 'Video playlist element not found' })
 217          .end()
 218
 219       return
 220     }
 221
 222     if (videoPlaylistElement.VideoPlaylist.privacy === VideoPlaylistPrivacy.PRIVATE) {
 223       return res.status(403).end()
 224     }
 225
 226     res.locals.videoPlaylistElement = videoPlaylistElement
 227
 228     return next()
 229   }
 230 ]
 231
 232 const videoPlaylistsReorderVideosValidator = [
 233   param('playlistId')
 234     .custom(isIdOrUUIDValid).withMessage('Should have a valid playlist id/uuid'),
 235   body('startPosition')
 236     .isInt({ min: 1 }).withMessage('Should have a valid start position'),
 237   body('insertAfterPosition')
 238     .isInt({ min: 0 }).withMessage('Should have a valid insert after position'),
 239   body('reorderLength')
 240     .optional()
 241     .isInt({ min: 1 }).withMessage('Should have a valid range length'),
 242
 243   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
 244     logger.debug('Checking videoPlaylistsReorderVideosValidator parameters', { parameters: req.params })
 245
 246     if (areValidationErrors(req, res)) return
 247
 248     if (!await isVideoPlaylistExist(req.params.playlistId, res)) return
 249
 250     const videoPlaylist: VideoPlaylistModel = res.locals.videoPlaylist
 251     if (!checkUserCanManageVideoPlaylist(res.locals.oauth.token.User, videoPlaylist, UserRight.UPDATE_ANY_VIDEO_PLAYLIST, res)) return
 252
 253     const nextPosition = await VideoPlaylistElementModel.getNextPositionOf(videoPlaylist.id)
 254     const startPosition: number = req.body.startPosition
 255     const insertAfterPosition: number = req.body.insertAfterPosition
 256     const reorderLength: number = req.body.reorderLength
 257
 258     if (startPosition >= nextPosition || insertAfterPosition >= nextPosition) {
 259       res.status(400)
 260          .json({ error: `Start position or insert after position exceed the playlist limits (max: ${nextPosition - 1})` })
 261          .end()
 262
 263       return
 264     }
 265
 266     if (reorderLength && reorderLength + startPosition > nextPosition) {
 267       res.status(400)
 268          .json({ error: `Reorder length with this start position exceeds the playlist limits (max: ${nextPosition - startPosition})` })
 269          .end()
 270
 271       return
 272     }
 273
 274     return next()
 275   }
 276 ]
 277
 278 // ---------------------------------------------------------------------------
 279
 280 export {
 281   videoPlaylistsAddValidator,
 282   videoPlaylistsUpdateValidator,
 283   videoPlaylistsDeleteValidator,
 284   videoPlaylistsGetValidator,
 285
 286   videoPlaylistsAddVideoValidator,
 287   videoPlaylistsUpdateOrRemoveVideoValidator,
 288   videoPlaylistsReorderVideosValidator,
 289
 290   videoPlaylistElementAPGetValidator
 291 }
 292
 293 // ---------------------------------------------------------------------------
 294
 295 function getCommonPlaylistEditAttributes () {
 296   return [
 297     body('thumbnailfile')
 298       .custom((value, { req }) => isVideoImage(req.files, 'thumbnailfile')).withMessage(
 299       'This thumbnail file is not supported or too large. Please, make sure it is of the following type: '
 300       + CONSTRAINTS_FIELDS.VIDEO_PLAYLISTS.IMAGE.EXTNAME.join(', ')
 301     ),
 302
 303     body('displayName')
 304       .custom(isVideoPlaylistNameValid).withMessage('Should have a valid display name'),
 305     body('description')
 306       .optional()
 307       .customSanitizer(toValueOrNull)
 308       .custom(isVideoPlaylistDescriptionValid).withMessage('Should have a valid description'),
 309     body('privacy')
 310       .optional()
 311       .toInt()
 312       .custom(isVideoPlaylistPrivacyValid).withMessage('Should have correct playlist privacy'),
 313     body('videoChannelId')
 314       .optional()
 315       .toInt()
 316   ] as (ValidationChain | express.Handler)[]
 317 }
 318
 319 function checkUserCanManageVideoPlaylist (user: UserModel, videoPlaylist: VideoPlaylistModel, right: UserRight, res: express.Response) {
 320   if (videoPlaylist.isOwned() === false) {
 321     res.status(403)
 322        .json({ error: 'Cannot manage video playlist of another server.' })
 323        .end()
 324
 325     return false
 326   }
 327
 328   // Check if the user can manage the video playlist
 329   // The user can delete it if s/he is an admin
 330   // Or if s/he is the video playlist's owner
 331   if (user.hasRight(right) === false && videoPlaylist.ownerAccountId !== user.Account.id) {
 332     res.status(403)
 333        .json({ error: 'Cannot manage video playlist of another user' })
 334        .end()
 335
 336     return false
 337   }
 338
 339   return true
 340 }