Migrate server to ESM

Sorry for the very big commit that may lead to git log issues and merge
conflicts, but it's a major step forward:

 * Server can be faster at startup because imports() are async and we can
   easily lazy import big modules
 * Angular doesn't seem to support ES import (with .js extension), so we
   had to correctly organize peertube into a monorepo:
    * Use yarn workspace feature
    * Use typescript reference projects for dependencies
    * Shared projects have been moved into "packages", each one is now a
      node module (with a dedicated package.json/tsconfig.json)
    * server/tools have been moved into apps/ and is now a dedicated app
      bundled and published on NPM so users don't have to build peertube
      cli tools manually
    * server/tests have been moved into packages/ so we don't compile
      them every time we want to run the server
 * Use isolatedModule option:
   * Had to move from const enum to const
     (https://www.typescriptlang.org/docs/handbook/enums.html#objects-vs-enums)
   * Had to explictely specify "type" imports when used in decorators
 * Prefer tsx (that uses esbuild under the hood) instead of ts-node to
   load typescript files (tests with mocha or scripts):
     * To reduce test complexity as esbuild doesn't support decorator
       metadata, we only test server files that do not import server
       models
     * We still build tests files into js files for a faster CI
 * Remove unmaintained peertube CLI import script
 * Removed some barrels to speed up execution (less imports)

1 files changed, 0 insertions, 223 deletions

diff --git a/server/lib/auth/oauth.ts b/server/lib/auth/oauth.ts
deleted file mode 100644
index 887c4f7c9..000000000
--- a/server/lib/auth/oauth.ts
+++ /dev/null
@@ -1,223 +0,0 @@
-import express from 'express'
-import OAuth2Server, {
-  InvalidClientError,
-  InvalidGrantError,
-  InvalidRequestError,
-  Request,
-  Response,
-  UnauthorizedClientError,
-  UnsupportedGrantTypeError
-} from '@node-oauth/oauth2-server'
-import { randomBytesPromise } from '@server/helpers/core-utils'
-import { isOTPValid } from '@server/helpers/otp'
-import { CONFIG } from '@server/initializers/config'
-import { UserRegistrationModel } from '@server/models/user/user-registration'
-import { MOAuthClient } from '@server/types/models'
-import { sha1 } from '@shared/extra-utils'
-import { HttpStatusCode, ServerErrorCode, UserRegistrationState } from '@shared/models'
-import { OTP } from '../../initializers/constants'
-import { BypassLogin, getClient, getRefreshToken, getUser, revokeToken, saveToken } from './oauth-model'
-
-class MissingTwoFactorError extends Error {
-  code = HttpStatusCode.UNAUTHORIZED_401
-  name = ServerErrorCode.MISSING_TWO_FACTOR
-}
-
-class InvalidTwoFactorError extends Error {
-  code = HttpStatusCode.BAD_REQUEST_400
-  name = ServerErrorCode.INVALID_TWO_FACTOR
-}
-
-class RegistrationWaitingForApproval extends Error {
-  code = HttpStatusCode.BAD_REQUEST_400
-  name = ServerErrorCode.ACCOUNT_WAITING_FOR_APPROVAL
-}
-
-class RegistrationApprovalRejected extends Error {
-  code = HttpStatusCode.BAD_REQUEST_400
-  name = ServerErrorCode.ACCOUNT_APPROVAL_REJECTED
-}
-
-/**
- *
- * Reimplement some functions of OAuth2Server to inject external auth methods
- *
- */
-const oAuthServer = new OAuth2Server({
-  // Wants seconds
-  accessTokenLifetime: CONFIG.OAUTH2.TOKEN_LIFETIME.ACCESS_TOKEN / 1000,
-  refreshTokenLifetime: CONFIG.OAUTH2.TOKEN_LIFETIME.REFRESH_TOKEN / 1000,
-
-  // See https://github.com/oauthjs/node-oauth2-server/wiki/Model-specification for the model specifications
-  model: require('./oauth-model')
-})
-
-// ---------------------------------------------------------------------------
-
-async function handleOAuthToken (req: express.Request, options: { refreshTokenAuthName?: string, bypassLogin?: BypassLogin }) {
-  const request = new Request(req)
-  const { refreshTokenAuthName, bypassLogin } = options
-
-  if (request.method !== 'POST') {
-    throw new InvalidRequestError('Invalid request: method must be POST')
-  }
-
-  if (!request.is([ 'application/x-www-form-urlencoded' ])) {
-    throw new InvalidRequestError('Invalid request: content must be application/x-www-form-urlencoded')
-  }
-
-  const clientId = request.body.client_id
-  const clientSecret = request.body.client_secret
-
-  if (!clientId || !clientSecret) {
-    throw new InvalidClientError('Invalid client: cannot retrieve client credentials')
-  }
-
-  const client = await getClient(clientId, clientSecret)
-  if (!client) {
-    throw new InvalidClientError('Invalid client: client is invalid')
-  }
-
-  const grantType = request.body.grant_type
-  if (!grantType) {
-    throw new InvalidRequestError('Missing parameter: `grant_type`')
-  }
-
-  if (![ 'password', 'refresh_token' ].includes(grantType)) {
-    throw new UnsupportedGrantTypeError('Unsupported grant type: `grant_type` is invalid')
-  }
-
-  if (!client.grants.includes(grantType)) {
-    throw new UnauthorizedClientError('Unauthorized client: `grant_type` is invalid')
-  }
-
-  if (grantType === 'password') {
-    return handlePasswordGrant({
-      request,
-      client,
-      bypassLogin
-    })
-  }
-
-  return handleRefreshGrant({
-    request,
-    client,
-    refreshTokenAuthName
-  })
-}
-
-function handleOAuthAuthenticate (
-  req: express.Request,
-  res: express.Response
-) {
-  return oAuthServer.authenticate(new Request(req), new Response(res))
-}
-
-export {
-  MissingTwoFactorError,
-  InvalidTwoFactorError,
-
-  handleOAuthToken,
-  handleOAuthAuthenticate
-}
-
-// ---------------------------------------------------------------------------
-
-async function handlePasswordGrant (options: {
-  request: Request
-  client: MOAuthClient
-  bypassLogin?: BypassLogin
-}) {
-  const { request, client, bypassLogin } = options
-
-  if (!request.body.username) {
-    throw new InvalidRequestError('Missing parameter: `username`')
-  }
-
-  if (!bypassLogin && !request.body.password) {
-    throw new InvalidRequestError('Missing parameter: `password`')
-  }
-
-  const user = await getUser(request.body.username, request.body.password, bypassLogin)
-  if (!user) {
-    const registration = await UserRegistrationModel.loadByEmailOrUsername(request.body.username)
-
-    if (registration?.state === UserRegistrationState.REJECTED) {
-      throw new RegistrationApprovalRejected('Registration approval for this account has been rejected')
-    } else if (registration?.state === UserRegistrationState.PENDING) {
-      throw new RegistrationWaitingForApproval('Registration for this account is awaiting approval')
-    }
-
-    throw new InvalidGrantError('Invalid grant: user credentials are invalid')
-  }
-
-  if (user.otpSecret) {
-    if (!request.headers[OTP.HEADER_NAME]) {
-      throw new MissingTwoFactorError('Missing two factor header')
-    }
-
-    if (await isOTPValid({ encryptedSecret: user.otpSecret, token: request.headers[OTP.HEADER_NAME] }) !== true) {
-      throw new InvalidTwoFactorError('Invalid two factor header')
-    }
-  }
-
-  const token = await buildToken()
-
-  return saveToken(token, client, user, { bypassLogin })
-}
-
-async function handleRefreshGrant (options: {
-  request: Request
-  client: MOAuthClient
-  refreshTokenAuthName: string
-}) {
-  const { request, client, refreshTokenAuthName } = options
-
-  if (!request.body.refresh_token) {
-    throw new InvalidRequestError('Missing parameter: `refresh_token`')
-  }
-
-  const refreshToken = await getRefreshToken(request.body.refresh_token)
-
-  if (!refreshToken) {
-    throw new InvalidGrantError('Invalid grant: refresh token is invalid')
-  }
-
-  if (refreshToken.client.id !== client.id) {
-    throw new InvalidGrantError('Invalid grant: refresh token is invalid')
-  }
-
-  if (refreshToken.refreshTokenExpiresAt && refreshToken.refreshTokenExpiresAt < new Date()) {
-    throw new InvalidGrantError('Invalid grant: refresh token has expired')
-  }
-
-  await revokeToken({ refreshToken: refreshToken.refreshToken })
-
-  const token = await buildToken()
-
-  return saveToken(token, client, refreshToken.user, { refreshTokenAuthName })
-}
-
-function generateRandomToken () {
-  return randomBytesPromise(256)
-    .then(buffer => sha1(buffer))
-}
-
-function getTokenExpiresAt (type: 'access' | 'refresh') {
-  const lifetime = type === 'access'
-    ? CONFIG.OAUTH2.TOKEN_LIFETIME.ACCESS_TOKEN
-    : CONFIG.OAUTH2.TOKEN_LIFETIME.REFRESH_TOKEN
-
-  return new Date(Date.now() + lifetime)
-}
-
-async function buildToken () {
-  const [ accessToken, refreshToken ] = await Promise.all([ generateRandomToken(), generateRandomToken() ])
-
-  return {
-    accessToken,
-    refreshToken,
-    accessTokenExpiresAt: getTokenExpiresAt('access'),
-    refreshTokenExpiresAt: getTokenExpiresAt('refresh')
-  }
-}