+ await authenticatePromise(req, res, authenticateInQuery)
+
+ const user = res.locals.oauth?.token.User
+ if (!user) return fail()
+
+ const videoWithRights = (video as MVideoWithRights).VideoChannel?.Account?.userId
+ ? video as MVideoWithRights
+ : await VideoModel.loadFull(video.id)
+
+ const privacy = videoWithRights.privacy
+
+ if (privacy === VideoPrivacy.INTERNAL) {
+ // We know we have a user
+ return true
+ }
+
+ const isOwnedByUser = videoWithRights.VideoChannel.Account.userId === user.id
+
+ if (videoWithRights.isBlacklisted()) {
+ if (isOwnedByUser || user.hasRight(UserRight.MANAGE_VIDEO_BLACKLIST)) return true
+
+ return fail()
+ }
+
+ if (privacy === VideoPrivacy.PRIVATE || privacy === VideoPrivacy.UNLISTED) {
+ if (isOwnedByUser || user.hasRight(UserRight.SEE_ALL_VIDEOS)) return true
+
+ return fail()
+ }
+
+ // Should not happen
+ return fail()