import * as express from 'express'
import 'express-validator'
import { body, param, ValidationChain } from 'express-validator/check'
-import { UserRight, VideoPrivacy } from '../../../shared'
+import { UserRight, VideoChangeOwnershipStatus, VideoPrivacy } from '../../../shared'
import {
isBooleanValid,
isDateValid,
import { cleanUpReqFiles } from '../../helpers/express-utils'
import { VideoModel } from '../../models/video/video'
import { UserModel } from '../../models/account/user'
+import { checkUserCanTerminateOwnershipChange, doesChangeVideoOwnershipExist } from '../../helpers/custom-validators/video-ownership'
+import { VideoChangeOwnershipAccept } from '../../../shared/models/videos/video-change-ownership-accept.model'
+import { VideoChangeOwnershipModel } from '../../models/video/video-change-ownership'
+import { AccountModel } from '../../models/account/account'
+import { VideoFetchType } from '../../helpers/video'
const videosAddValidator = getCommonVideoAttributes().concat([
body('videofile')
}
])
-const videosGetValidator = [
- param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
-
- async (req: express.Request, res: express.Response, next: express.NextFunction) => {
- logger.debug('Checking videosGet parameters', { parameters: req.params })
+const videosCustomGetValidator = (fetchType: VideoFetchType) => {
+ return [
+ param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
- if (areValidationErrors(req, res)) return
- if (!await isVideoExist(req.params.id, res)) return
+ async (req: express.Request, res: express.Response, next: express.NextFunction) => {
+ logger.debug('Checking videosGet parameters', { parameters: req.params })
- const video: VideoModel = res.locals.video
+ if (areValidationErrors(req, res)) return
+ if (!await isVideoExist(req.params.id, res, fetchType)) return
- // Video private or blacklisted
- if (video.privacy === VideoPrivacy.PRIVATE || video.VideoBlacklist) {
- authenticate(req, res, () => {
- const user: UserModel = res.locals.oauth.token.User
+ const video: VideoModel = res.locals.video
- // Only the owner or a user that have blacklist rights can see the video
- if (video.VideoChannel.Account.userId !== user.id && !user.hasRight(UserRight.MANAGE_VIDEO_BLACKLIST)) {
- return res.status(403)
- .json({ error: 'Cannot get this private or blacklisted video.' })
- .end()
- }
+ // Video private or blacklisted
+ if (video.privacy === VideoPrivacy.PRIVATE || video.VideoBlacklist) {
+ return authenticate(req, res, () => {
+ const user: UserModel = res.locals.oauth.token.User
- return next()
- })
+ // Only the owner or a user that have blacklist rights can see the video
+ if (video.VideoChannel.Account.userId !== user.id && !user.hasRight(UserRight.MANAGE_VIDEO_BLACKLIST)) {
+ return res.status(403)
+ .json({ error: 'Cannot get this private or blacklisted video.' })
+ .end()
+ }
- return
- }
+ return next()
+ })
+ }
- // Video is public, anyone can access it
- if (video.privacy === VideoPrivacy.PUBLIC) return next()
+ // Video is public, anyone can access it
+ if (video.privacy === VideoPrivacy.PUBLIC) return next()
- // Video is unlisted, check we used the uuid to fetch it
- if (video.privacy === VideoPrivacy.UNLISTED) {
- if (isUUIDValid(req.params.id)) return next()
+ // Video is unlisted, check we used the uuid to fetch it
+ if (video.privacy === VideoPrivacy.UNLISTED) {
+ if (isUUIDValid(req.params.id)) return next()
- // Don't leak this unlisted video
- return res.status(404).end()
+ // Don't leak this unlisted video
+ return res.status(404).end()
+ }
}
- }
-]
+ ]
+}
+
+const videosGetValidator = videosCustomGetValidator('all')
const videosRemoveValidator = [
param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
}
]
+const videosChangeOwnershipValidator = [
+ param('videoId').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
+
+ async (req: express.Request, res: express.Response, next: express.NextFunction) => {
+ logger.debug('Checking changeOwnership parameters', { parameters: req.params })
+
+ if (areValidationErrors(req, res)) return
+ if (!await isVideoExist(req.params.videoId, res)) return
+
+ // Check if the user who did the request is able to change the ownership of the video
+ if (!checkUserCanManageVideo(res.locals.oauth.token.User, res.locals.video, UserRight.CHANGE_VIDEO_OWNERSHIP, res)) return
+
+ const nextOwner = await AccountModel.loadLocalByName(req.body.username)
+ if (!nextOwner) {
+ res.status(400)
+ .type('json')
+ .end()
+ return
+ }
+ res.locals.nextOwner = nextOwner
+
+ return next()
+ }
+]
+
+const videosTerminateChangeOwnershipValidator = [
+ param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
+
+ async (req: express.Request, res: express.Response, next: express.NextFunction) => {
+ logger.debug('Checking changeOwnership parameters', { parameters: req.params })
+
+ if (areValidationErrors(req, res)) return
+ if (!await doesChangeVideoOwnershipExist(req.params.id, res)) return
+
+ // Check if the user who did the request is able to change the ownership of the video
+ if (!checkUserCanTerminateOwnershipChange(res.locals.oauth.token.User, res.locals.videoChangeOwnership, res)) return
+
+ return next()
+ },
+ async (req: express.Request, res: express.Response, next: express.NextFunction) => {
+ const videoChangeOwnership = res.locals.videoChangeOwnership as VideoChangeOwnershipModel
+
+ if (videoChangeOwnership.status === VideoChangeOwnershipStatus.WAITING) {
+ return next()
+ } else {
+ res.status(403)
+ .json({ error: 'Ownership already accepted or refused' })
+ .end()
+ return
+ }
+ }
+]
+
+const videosAcceptChangeOwnershipValidator = [
+ async (req: express.Request, res: express.Response, next: express.NextFunction) => {
+ const body = req.body as VideoChangeOwnershipAccept
+ if (!await isVideoChannelOfAccountExist(body.channelId, res.locals.oauth.token.User, res)) return
+
+ const user = res.locals.oauth.token.User
+ const videoChangeOwnership = res.locals.videoChangeOwnership as VideoChangeOwnershipModel
+ const isAble = await user.isAbleToUploadVideo(videoChangeOwnership.Video.getOriginalFile())
+ if (isAble === false) {
+ res.status(403)
+ .json({ error: 'The user video quota is exceeded with this video.' })
+ .end()
+ return
+ }
+
+ return next()
+ }
+]
+
function getCommonVideoAttributes () {
return [
body('thumbnailfile')
videosAddValidator,
videosUpdateValidator,
videosGetValidator,
+ videosCustomGetValidator,
videosRemoveValidator,
videosShareValidator,
videoRateValidator,
+ videosChangeOwnershipValidator,
+ videosTerminateChangeOwnershipValidator,
+ videosAcceptChangeOwnershipValidator,
+
getCommonVideoAttributes
}
projects / github / Chocobozzz / PeerTube.git / blobdiff