+const ensureAuthUserOwnsChannelValidator = [
+ (req: express.Request, res: express.Response, next: express.NextFunction) => {
+ const user = res.locals.oauth.token.User
+
+ if (res.locals.videoChannel.Account.userId !== user.id) {
+ return res.fail({
+ status: HttpStatusCode.FORBIDDEN_403,
+ message: 'Only owner of this video channel can access this ressource'
+ })
+ }
+
+ return next()
+ }
+]
+
+const ensureCanManageUser = [
+ (req: express.Request, res: express.Response, next: express.NextFunction) => {
+ const authUser = res.locals.oauth.token.User
+ const onUser = res.locals.user
+
+ if (authUser.role === UserRole.ADMINISTRATOR) return next()
+ if (authUser.role === UserRole.MODERATOR && onUser.role === UserRole.USER) return next()
+
+ return res.fail({
+ status: HttpStatusCode.FORBIDDEN_403,
+ message: 'A moderator can only manager users.'
+ })
+ }
+]
+