import express from 'express' import { body, param, query, ValidationChain } from 'express-validator' import { exists, isBooleanValid, isIdValid, toBooleanOrNull } from '@server/helpers/custom-validators/misc' import { isRegistrationModerationResponseValid, isRegistrationReasonValid } from '@server/helpers/custom-validators/user-registration' import { CONFIG } from '@server/initializers/config' import { Hooks } from '@server/lib/plugins/hooks' import { HttpStatusCode, UserRegister, UserRegistrationRequest, UserRegistrationState } from '@shared/models' import { isUserDisplayNameValid, isUserPasswordValid, isUserUsernameValid } from '../../helpers/custom-validators/users' import { isVideoChannelDisplayNameValid, isVideoChannelUsernameValid } from '../../helpers/custom-validators/video-channels' import { isSignupAllowed, isSignupAllowedForCurrentIP, SignupMode } from '../../lib/signup' import { ActorModel } from '../../models/actor/actor' import { areValidationErrors, checkUserNameOrEmailDoNotAlreadyExist } from './shared' import { checkRegistrationHandlesDoNotAlreadyExist, checkRegistrationIdExist } from './shared/user-registrations' const usersDirectRegistrationValidator = usersCommonRegistrationValidatorFactory() const usersRequestRegistrationValidator = [ ...usersCommonRegistrationValidatorFactory([ body('registrationReason') .custom(isRegistrationReasonValid) ]), async (req: express.Request, res: express.Response, next: express.NextFunction) => { const body: UserRegistrationRequest = req.body if (CONFIG.SIGNUP.REQUIRES_APPROVAL !== true) { return res.fail({ status: HttpStatusCode.BAD_REQUEST_400, message: 'Signup approval is not enabled on this instance' }) } const options = { username: body.username, email: body.email, channelHandle: body.channel?.name, res } if (!await checkRegistrationHandlesDoNotAlreadyExist(options)) return return next() } ] // --------------------------------------------------------------------------- function ensureUserRegistrationAllowedFactory (signupMode: SignupMode) { return async (req: express.Request, res: express.Response, next: express.NextFunction) => { const allowedParams = { body: req.body, ip: req.ip, signupMode } const allowedResult = await Hooks.wrapPromiseFun( isSignupAllowed, allowedParams, signupMode === 'direct-registration' ? 'filter:api.user.signup.allowed.result' : 'filter:api.user.request-signup.allowed.result' ) if (allowedResult.allowed === false) { return res.fail({ status: HttpStatusCode.FORBIDDEN_403, message: allowedResult.errorMessage || 'User registration is not allowed' }) } return next() } } const ensureUserRegistrationAllowedForIP = [ (req: express.Request, res: express.Response, next: express.NextFunction) => { const allowed = isSignupAllowedForCurrentIP(req.ip) if (allowed === false) { return res.fail({ status: HttpStatusCode.FORBIDDEN_403, message: 'You are not on a network authorized for registration.' }) } return next() } ] // --------------------------------------------------------------------------- const acceptOrRejectRegistrationValidator = [ param('registrationId') .custom(isIdValid), body('moderationResponse') .custom(isRegistrationModerationResponseValid), body('preventEmailDelivery') .optional() .customSanitizer(toBooleanOrNull) .custom(isBooleanValid).withMessage('Should have preventEmailDelivery boolean'), async (req: express.Request, res: express.Response, next: express.NextFunction) => { if (areValidationErrors(req, res)) return if (!await checkRegistrationIdExist(req.params.registrationId, res)) return if (res.locals.userRegistration.state !== UserRegistrationState.PENDING) { return res.fail({ status: HttpStatusCode.CONFLICT_409, message: 'This registration is already accepted or rejected.' }) } return next() } ] // --------------------------------------------------------------------------- const getRegistrationValidator = [ param('registrationId') .custom(isIdValid), async (req: express.Request, res: express.Response, next: express.NextFunction) => { if (areValidationErrors(req, res)) return if (!await checkRegistrationIdExist(req.params.registrationId, res)) return return next() } ] // --------------------------------------------------------------------------- const listRegistrationsValidator = [ query('search') .optional() .custom(exists), (req: express.Request, res: express.Response, next: express.NextFunction) => { if (areValidationErrors(req, res)) return return next() } ] // --------------------------------------------------------------------------- export { usersDirectRegistrationValidator, usersRequestRegistrationValidator, ensureUserRegistrationAllowedFactory, ensureUserRegistrationAllowedForIP, getRegistrationValidator, listRegistrationsValidator, acceptOrRejectRegistrationValidator } // --------------------------------------------------------------------------- function usersCommonRegistrationValidatorFactory (additionalValidationChain: ValidationChain[] = []) { return [ body('username') .custom(isUserUsernameValid), body('password') .custom(isUserPasswordValid), body('email') .isEmail(), body('displayName') .optional() .custom(isUserDisplayNameValid), body('channel.name') .optional() .custom(isVideoChannelUsernameValid), body('channel.displayName') .optional() .custom(isVideoChannelDisplayNameValid), ...additionalValidationChain, async (req: express.Request, res: express.Response, next: express.NextFunction) => { if (areValidationErrors(req, res, { omitBodyLog: true })) return const body: UserRegister | UserRegistrationRequest = req.body if (!await checkUserNameOrEmailDoNotAlreadyExist(body.username, body.email, res)) return if (body.channel) { if (!body.channel.name || !body.channel.displayName) { return res.fail({ message: 'Channel is optional but if you specify it, channel.name and channel.displayName are required.' }) } if (body.channel.name === body.username) { return res.fail({ message: 'Channel name cannot be the same as user username.' }) } const existing = await ActorModel.loadLocalByName(body.channel.name) if (existing) { return res.fail({ status: HttpStatusCode.CONFLICT_409, message: `Channel with name ${body.channel.name} already exists.` }) } } return next() } ] }