Fix runner api rate limit bypass

[github/Chocobozzz/PeerTube.git] / server / controllers / api / accounts.ts

diff --git a/server/controllers/api/accounts.ts b/server/controllers/api/accounts.ts
index 75679b0f44a0bbc1b0f0f067cdb148570578584a..96f36bf6fe9db79225516eb691b791c77adac9ed 100644 (file)
--- a/server/controllers/api/accounts.ts
+++ b/server/controllers/api/accounts.ts
@@ -1,11 +1,15 @@
 import express from 'express'
 import { pickCommonVideoQuery } from '@server/helpers/query'
+import { ActorFollowModel } from '@server/models/actor/actor-follow'
 import { getServerActor } from '@server/models/application/application'
+import { guessAdditionalAttributesFromQuery } from '@server/models/video/formatter/video-format-utils'
+import { VideoChannelSyncModel } from '@server/models/video/video-channel-sync'
 import { buildNSFWFilter, getCountVideos, isUserAbleToSearchRemoteURI } from '../../helpers/express-utils'
 import { getFormattedObjects } from '../../helpers/utils'
 import { JobQueue } from '../../lib/job-queue'
 import { Hooks } from '../../lib/plugins/hooks'
 import {
+  apiRateLimiter,
   asyncMiddleware,
   authenticate,
   commonVideosFiltersValidator,
@@ -20,10 +24,13 @@ import {
 } from '../../middlewares'
 import {
   accountNameWithHostGetValidator,
+  accountsFollowersSortValidator,
   accountsSortValidator,
   ensureAuthUserOwnsAccountValidator,
+  ensureCanManageChannelOrAccount,
   videoChannelsSortValidator,
   videoChannelStatsValidator,
+  videoChannelSyncsSortValidator,
   videosSortValidator
 } from '../../middlewares/validators'
 import { commonVideoPlaylistFiltersValidator, videoPlaylistsSearchValidator } from '../../middlewares/validators/videos/video-playlists'
@@ -35,6 +42,8 @@ import { VideoPlaylistModel } from '../../models/video/video-playlist'
 
 const accountsRouter = express.Router()
 
+accountsRouter.use(apiRateLimiter)
+
 accountsRouter.get('/',
   paginationValidator,
   accountsSortValidator,
@@ -69,6 +78,17 @@ accountsRouter.get('/:accountName/video-channels',
   asyncMiddleware(listAccountChannels)
 )
 
+accountsRouter.get('/:accountName/video-channel-syncs',
+  authenticate,
+  asyncMiddleware(accountNameWithHostGetValidator),
+  ensureCanManageChannelOrAccount,
+  paginationValidator,
+  videoChannelSyncsSortValidator,
+  setDefaultSort,
+  setDefaultPagination,
+  asyncMiddleware(listAccountChannelsSync)
+)
+
 accountsRouter.get('/:accountName/video-playlists',
   optionalAuthenticate,
   asyncMiddleware(accountNameWithHostGetValidator),
@@ -93,6 +113,17 @@ accountsRouter.get('/:accountName/ratings',
   asyncMiddleware(listAccountRatings)
 )
 
+accountsRouter.get('/:accountName/followers',
+  authenticate,
+  asyncMiddleware(accountNameWithHostGetValidator),
+  ensureAuthUserOwnsAccountValidator,
+  paginationValidator,
+  accountsFollowersSortValidator,
+  setDefaultSort,
+  setDefaultPagination,
+  asyncMiddleware(listAccountFollowers)
+)
+
 // ---------------------------------------------------------------------------
 
 export {
@@ -105,7 +136,7 @@ function getAccount (req: express.Request, res: express.Response) {
   const account = res.locals.account
 
   if (account.isOutdated()) {
-    JobQueue.Instance.createJob({ type: 'activitypub-refresher', payload: { type: 'actor', url: account.Actor.url } })
+    JobQueue.Instance.createJobAsync({ type: 'activitypub-refresher', payload: { type: 'actor', url: account.Actor.url } })
   }
 
   return res.json(account.toFormattedJSON())
@@ -127,7 +158,21 @@ async function listAccountChannels (req: express.Request, res: express.Response)
     search: req.query.search
   }
 
-  const resultList = await VideoChannelModel.listByAccount(options)
+  const resultList = await VideoChannelModel.listByAccountForAPI(options)
+
+  return res.json(getFormattedObjects(resultList.data, resultList.total))
+}
+
+async function listAccountChannelsSync (req: express.Request, res: express.Response) {
+  const options = {
+    accountId: res.locals.account.id,
+    start: req.query.start,
+    count: req.query.count,
+    sort: req.query.sort,
+    search: req.query.search
+  }
+
+  const resultList = await VideoChannelSyncModel.listByAccountForAPI(options)
 
   return res.json(getFormattedObjects(resultList.data, resultList.total))
 }
@@ -156,19 +201,25 @@ async function listAccountPlaylists (req: express.Request, res: express.Response
 }
 
 async function listAccountVideos (req: express.Request, res: express.Response) {
+  const serverActor = await getServerActor()
+
   const account = res.locals.account
-  const followerActorId = isUserAbleToSearchRemoteURI(res) ? null : undefined
+
+  const displayOnlyForFollower = isUserAbleToSearchRemoteURI(res)
+    ? null
+    : {
+      actorId: serverActor.id,
+      orLocalVideos: true
+    }
+
   const countVideos = getCountVideos(req)
   const query = pickCommonVideoQuery(req.query)
 
   const apiOptions = await Hooks.wrapObject({
     ...query,
 
-    followerActorId,
-    search: req.query.search,
-    includeLocalVideos: true,
+    displayOnlyForFollower,
     nsfw: buildNSFWFilter(res, query.nsfw),
-    withFiles: false,
     accountId: account.id,
     user: res.locals.oauth ? res.locals.oauth.token.User : undefined,
     countVideos
@@ -180,7 +231,7 @@ async function listAccountVideos (req: express.Request, res: express.Response) {
     'filter:api.accounts.videos.list.result'
   )
 
-  return res.json(getFormattedObjects(resultList.data, resultList.total))
+  return res.json(getFormattedObjects(resultList.data, resultList.total, guessAdditionalAttributesFromQuery(query)))
 }
 
 async function listAccountRatings (req: express.Request, res: express.Response) {
@@ -193,5 +244,23 @@ async function listAccountRatings (req: express.Request, res: express.Response)
     sort: req.query.sort,
     type: req.query.rating
   })
-  return res.json(getFormattedObjects(resultList.rows, resultList.count))
+  return res.json(getFormattedObjects(resultList.data, resultList.total))
+}
+
+async function listAccountFollowers (req: express.Request, res: express.Response) {
+  const account = res.locals.account
+
+  const channels = await VideoChannelModel.listAllByAccount(account.id)
+  const actorIds = [ account.actorId ].concat(channels.map(c => c.actorId))
+
+  const resultList = await ActorFollowModel.listFollowersForApi({
+    actorIds,
+    start: req.query.start,
+    count: req.query.count,
+    sort: req.query.sort,
+    search: req.query.search,
+    state: 'accepted'
+  })
+
+  return res.json(getFormattedObjects(resultList.data, resultList.total))
 }