server/middlewares/validators/videos/video-playlists.ts

   1 import express from 'express'
   2 import { body, param, query, ValidationChain } from 'express-validator'
   3 import { ExpressPromiseHandler } from '@server/types/express-handler'
   4 import { MUserAccountId } from '@server/types/models'
   5 import {
   6   HttpStatusCode,
   7   UserRight,
   8   VideoPlaylistCreate,
   9   VideoPlaylistPrivacy,
  10   VideoPlaylistType,
  11   VideoPlaylistUpdate
  12 } from '@shared/models'
  13 import {
  14   isArrayOf,
  15   isIdOrUUIDValid,
  16   isIdValid,
  17   isUUIDValid,
  18   toCompleteUUID,
  19   toIntArray,
  20   toIntOrNull,
  21   toValueOrNull
  22 } from '../../../helpers/custom-validators/misc'
  23 import {
  24   isVideoPlaylistDescriptionValid,
  25   isVideoPlaylistNameValid,
  26   isVideoPlaylistPrivacyValid,
  27   isVideoPlaylistTimestampValid,
  28   isVideoPlaylistTypeValid
  29 } from '../../../helpers/custom-validators/video-playlists'
  30 import { isVideoImageValid } from '../../../helpers/custom-validators/videos'
  31 import { cleanUpReqFiles } from '../../../helpers/express-utils'
  32 import { CONSTRAINTS_FIELDS } from '../../../initializers/constants'
  33 import { VideoPlaylistElementModel } from '../../../models/video/video-playlist-element'
  34 import { MVideoPlaylist } from '../../../types/models/video/video-playlist'
  35 import { authenticatePromise } from '../../auth'
  36 import {
  37   areValidationErrors,
  38   doesVideoChannelIdExist,
  39   doesVideoExist,
  40   doesVideoPlaylistExist,
  41   isValidPlaylistIdParam,
  42   VideoPlaylistFetchType
  43 } from '../shared'
  44
  45 const videoPlaylistsAddValidator = getCommonPlaylistEditAttributes().concat([
  46   body('displayName')
  47     .custom(isVideoPlaylistNameValid),
  48
  49   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
  50     if (areValidationErrors(req, res)) return cleanUpReqFiles(req)
  51
  52     const body: VideoPlaylistCreate = req.body
  53     if (body.videoChannelId && !await doesVideoChannelIdExist(body.videoChannelId, res)) return cleanUpReqFiles(req)
  54
  55     if (
  56       !body.videoChannelId &&
  57       (body.privacy === VideoPlaylistPrivacy.PUBLIC || body.privacy === VideoPlaylistPrivacy.UNLISTED)
  58     ) {
  59       cleanUpReqFiles(req)
  60
  61       return res.fail({ message: 'Cannot set "public" or "unlisted" a playlist that is not assigned to a channel.' })
  62     }
  63
  64     return next()
  65   }
  66 ])
  67
  68 const videoPlaylistsUpdateValidator = getCommonPlaylistEditAttributes().concat([
  69   isValidPlaylistIdParam('playlistId'),
  70
  71   body('displayName')
  72     .optional()
  73     .custom(isVideoPlaylistNameValid),
  74
  75   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
  76     if (areValidationErrors(req, res)) return cleanUpReqFiles(req)
  77
  78     if (!await doesVideoPlaylistExist(req.params.playlistId, res, 'all')) return cleanUpReqFiles(req)
  79
  80     const videoPlaylist = getPlaylist(res)
  81
  82     if (!checkUserCanManageVideoPlaylist(res.locals.oauth.token.User, videoPlaylist, UserRight.REMOVE_ANY_VIDEO_PLAYLIST, res)) {
  83       return cleanUpReqFiles(req)
  84     }
  85
  86     const body: VideoPlaylistUpdate = req.body
  87
  88     const newPrivacy = body.privacy || videoPlaylist.privacy
  89     if (newPrivacy === VideoPlaylistPrivacy.PUBLIC &&
  90       (
  91         (!videoPlaylist.videoChannelId && !body.videoChannelId) ||
  92         body.videoChannelId === null
  93       )
  94     ) {
  95       cleanUpReqFiles(req)
  96
  97       return res.fail({ message: 'Cannot set "public" a playlist that is not assigned to a channel.' })
  98     }
  99
 100     if (videoPlaylist.type === VideoPlaylistType.WATCH_LATER) {
 101       cleanUpReqFiles(req)
 102
 103       return res.fail({ message: 'Cannot update a watch later playlist.' })
 104     }
 105
 106     if (body.videoChannelId && !await doesVideoChannelIdExist(body.videoChannelId, res)) return cleanUpReqFiles(req)
 107
 108     return next()
 109   }
 110 ])
 111
 112 const videoPlaylistsDeleteValidator = [
 113   isValidPlaylistIdParam('playlistId'),
 114
 115   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
 116     if (areValidationErrors(req, res)) return
 117
 118     if (!await doesVideoPlaylistExist(req.params.playlistId, res)) return
 119
 120     const videoPlaylist = getPlaylist(res)
 121     if (videoPlaylist.type === VideoPlaylistType.WATCH_LATER) {
 122       return res.fail({ message: 'Cannot delete a watch later playlist.' })
 123     }
 124
 125     if (!checkUserCanManageVideoPlaylist(res.locals.oauth.token.User, videoPlaylist, UserRight.REMOVE_ANY_VIDEO_PLAYLIST, res)) {
 126       return
 127     }
 128
 129     return next()
 130   }
 131 ]
 132
 133 const videoPlaylistsGetValidator = (fetchType: VideoPlaylistFetchType) => {
 134   return [
 135     isValidPlaylistIdParam('playlistId'),
 136
 137     async (req: express.Request, res: express.Response, next: express.NextFunction) => {
 138       if (areValidationErrors(req, res)) return
 139
 140       if (!await doesVideoPlaylistExist(req.params.playlistId, res, fetchType)) return
 141
 142       const videoPlaylist = res.locals.videoPlaylistFull || res.locals.videoPlaylistSummary
 143
 144       // Video is unlisted, check we used the uuid to fetch it
 145       if (videoPlaylist.privacy === VideoPlaylistPrivacy.UNLISTED) {
 146         if (isUUIDValid(req.params.playlistId)) return next()
 147
 148         return res.fail({
 149           status: HttpStatusCode.NOT_FOUND_404,
 150           message: 'Playlist not found'
 151         })
 152       }
 153
 154       if (videoPlaylist.privacy === VideoPlaylistPrivacy.PRIVATE) {
 155         await authenticatePromise(req, res)
 156
 157         const user = res.locals.oauth ? res.locals.oauth.token.User : null
 158
 159         if (
 160           !user ||
 161           (videoPlaylist.OwnerAccount.id !== user.Account.id && !user.hasRight(UserRight.UPDATE_ANY_VIDEO_PLAYLIST))
 162         ) {
 163           return res.fail({
 164             status: HttpStatusCode.FORBIDDEN_403,
 165             message: 'Cannot get this private video playlist.'
 166           })
 167         }
 168
 169         return next()
 170       }
 171
 172       return next()
 173     }
 174   ]
 175 }
 176
 177 const videoPlaylistsSearchValidator = [
 178   query('search')
 179     .optional()
 180     .not().isEmpty(),
 181
 182   (req: express.Request, res: express.Response, next: express.NextFunction) => {
 183     if (areValidationErrors(req, res)) return
 184
 185     return next()
 186   }
 187 ]
 188
 189 const videoPlaylistsAddVideoValidator = [
 190   isValidPlaylistIdParam('playlistId'),
 191
 192   body('videoId')
 193     .customSanitizer(toCompleteUUID)
 194     .custom(isIdOrUUIDValid).withMessage('Should have a valid video id/uuid/short uuid'),
 195   body('startTimestamp')
 196     .optional()
 197     .custom(isVideoPlaylistTimestampValid),
 198   body('stopTimestamp')
 199     .optional()
 200     .custom(isVideoPlaylistTimestampValid),
 201
 202   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
 203     if (areValidationErrors(req, res)) return
 204
 205     if (!await doesVideoPlaylistExist(req.params.playlistId, res, 'all')) return
 206     if (!await doesVideoExist(req.body.videoId, res, 'only-video')) return
 207
 208     const videoPlaylist = getPlaylist(res)
 209
 210     if (!checkUserCanManageVideoPlaylist(res.locals.oauth.token.User, videoPlaylist, UserRight.UPDATE_ANY_VIDEO_PLAYLIST, res)) {
 211       return
 212     }
 213
 214     return next()
 215   }
 216 ]
 217
 218 const videoPlaylistsUpdateOrRemoveVideoValidator = [
 219   isValidPlaylistIdParam('playlistId'),
 220   param('playlistElementId')
 221     .customSanitizer(toCompleteUUID)
 222     .custom(isIdValid).withMessage('Should have an element id/uuid/short uuid'),
 223   body('startTimestamp')
 224     .optional()
 225     .custom(isVideoPlaylistTimestampValid),
 226   body('stopTimestamp')
 227     .optional()
 228     .custom(isVideoPlaylistTimestampValid),
 229
 230   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
 231     if (areValidationErrors(req, res)) return
 232
 233     if (!await doesVideoPlaylistExist(req.params.playlistId, res, 'all')) return
 234
 235     const videoPlaylist = getPlaylist(res)
 236
 237     const videoPlaylistElement = await VideoPlaylistElementModel.loadById(req.params.playlistElementId)
 238     if (!videoPlaylistElement) {
 239       res.fail({
 240         status: HttpStatusCode.NOT_FOUND_404,
 241         message: 'Video playlist element not found'
 242       })
 243       return
 244     }
 245     res.locals.videoPlaylistElement = videoPlaylistElement
 246
 247     if (!checkUserCanManageVideoPlaylist(res.locals.oauth.token.User, videoPlaylist, UserRight.UPDATE_ANY_VIDEO_PLAYLIST, res)) return
 248
 249     return next()
 250   }
 251 ]
 252
 253 const videoPlaylistElementAPGetValidator = [
 254   isValidPlaylistIdParam('playlistId'),
 255   param('playlistElementId')
 256     .custom(isIdValid),
 257
 258   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
 259     if (areValidationErrors(req, res)) return
 260
 261     const playlistElementId = parseInt(req.params.playlistElementId + '', 10)
 262     const playlistId = req.params.playlistId
 263
 264     const videoPlaylistElement = await VideoPlaylistElementModel.loadByPlaylistAndElementIdForAP(playlistId, playlistElementId)
 265     if (!videoPlaylistElement) {
 266       res.fail({
 267         status: HttpStatusCode.NOT_FOUND_404,
 268         message: 'Video playlist element not found'
 269       })
 270       return
 271     }
 272
 273     if (videoPlaylistElement.VideoPlaylist.privacy === VideoPlaylistPrivacy.PRIVATE) {
 274       return res.fail({
 275         status: HttpStatusCode.FORBIDDEN_403,
 276         message: 'Cannot get this private video playlist.'
 277       })
 278     }
 279
 280     res.locals.videoPlaylistElementAP = videoPlaylistElement
 281
 282     return next()
 283   }
 284 ]
 285
 286 const videoPlaylistsReorderVideosValidator = [
 287   isValidPlaylistIdParam('playlistId'),
 288
 289   body('startPosition')
 290     .isInt({ min: 1 }),
 291   body('insertAfterPosition')
 292     .isInt({ min: 0 }),
 293   body('reorderLength')
 294     .optional()
 295     .isInt({ min: 1 }),
 296
 297   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
 298     if (areValidationErrors(req, res)) return
 299
 300     if (!await doesVideoPlaylistExist(req.params.playlistId, res, 'all')) return
 301
 302     const videoPlaylist = getPlaylist(res)
 303     if (!checkUserCanManageVideoPlaylist(res.locals.oauth.token.User, videoPlaylist, UserRight.UPDATE_ANY_VIDEO_PLAYLIST, res)) return
 304
 305     const nextPosition = await VideoPlaylistElementModel.getNextPositionOf(videoPlaylist.id)
 306     const startPosition: number = req.body.startPosition
 307     const insertAfterPosition: number = req.body.insertAfterPosition
 308     const reorderLength: number = req.body.reorderLength
 309
 310     if (startPosition >= nextPosition || insertAfterPosition >= nextPosition) {
 311       res.fail({ message: `Start position or insert after position exceed the playlist limits (max: ${nextPosition - 1})` })
 312       return
 313     }
 314
 315     if (reorderLength && reorderLength + startPosition > nextPosition) {
 316       res.fail({ message: `Reorder length with this start position exceeds the playlist limits (max: ${nextPosition - startPosition})` })
 317       return
 318     }
 319
 320     return next()
 321   }
 322 ]
 323
 324 const commonVideoPlaylistFiltersValidator = [
 325   query('playlistType')
 326     .optional()
 327     .custom(isVideoPlaylistTypeValid),
 328
 329   (req: express.Request, res: express.Response, next: express.NextFunction) => {
 330     if (areValidationErrors(req, res)) return
 331
 332     return next()
 333   }
 334 ]
 335
 336 const doVideosInPlaylistExistValidator = [
 337   query('videoIds')
 338     .customSanitizer(toIntArray)
 339     .custom(v => isArrayOf(v, isIdValid)).withMessage('Should have a valid video ids array'),
 340
 341   (req: express.Request, res: express.Response, next: express.NextFunction) => {
 342     if (areValidationErrors(req, res)) return
 343
 344     return next()
 345   }
 346 ]
 347
 348 // ---------------------------------------------------------------------------
 349
 350 export {
 351   videoPlaylistsAddValidator,
 352   videoPlaylistsUpdateValidator,
 353   videoPlaylistsDeleteValidator,
 354   videoPlaylistsGetValidator,
 355   videoPlaylistsSearchValidator,
 356
 357   videoPlaylistsAddVideoValidator,
 358   videoPlaylistsUpdateOrRemoveVideoValidator,
 359   videoPlaylistsReorderVideosValidator,
 360
 361   videoPlaylistElementAPGetValidator,
 362
 363   commonVideoPlaylistFiltersValidator,
 364
 365   doVideosInPlaylistExistValidator
 366 }
 367
 368 // ---------------------------------------------------------------------------
 369
 370 function getCommonPlaylistEditAttributes () {
 371   return [
 372     body('thumbnailfile')
 373       .custom((value, { req }) => isVideoImageValid(req.files, 'thumbnailfile'))
 374       .withMessage(
 375         'This thumbnail file is not supported or too large. Please, make sure it is of the following type: ' +
 376         CONSTRAINTS_FIELDS.VIDEO_PLAYLISTS.IMAGE.EXTNAME.join(', ')
 377       ),
 378
 379     body('description')
 380       .optional()
 381       .customSanitizer(toValueOrNull)
 382       .custom(isVideoPlaylistDescriptionValid),
 383     body('privacy')
 384       .optional()
 385       .customSanitizer(toIntOrNull)
 386       .custom(isVideoPlaylistPrivacyValid),
 387     body('videoChannelId')
 388       .optional()
 389       .customSanitizer(toIntOrNull)
 390   ] as (ValidationChain | ExpressPromiseHandler)[]
 391 }
 392
 393 function checkUserCanManageVideoPlaylist (user: MUserAccountId, videoPlaylist: MVideoPlaylist, right: UserRight, res: express.Response) {
 394   if (videoPlaylist.isOwned() === false) {
 395     res.fail({
 396       status: HttpStatusCode.FORBIDDEN_403,
 397       message: 'Cannot manage video playlist of another server.'
 398     })
 399     return false
 400   }
 401
 402   // Check if the user can manage the video playlist
 403   // The user can delete it if s/he is an admin
 404   // Or if s/he is the video playlist's owner
 405   if (user.hasRight(right) === false && videoPlaylist.ownerAccountId !== user.Account.id) {
 406     res.fail({
 407       status: HttpStatusCode.FORBIDDEN_403,
 408       message: 'Cannot manage video playlist of another user'
 409     })
 410     return false
 411   }
 412
 413   return true
 414 }
 415
 416 function getPlaylist (res: express.Response) {
 417   return res.locals.videoPlaylistFull || res.locals.videoPlaylistSummary
 418 }