24 files changed, 464 insertions, 234 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c573b12ed..cd9f2036d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### IMPORTANT NOTES
 
- * **/!\ VERY IMPORTANT /!\\** You need to execute manually a script (can be executed after your upgrade, while your PeerTube instance is running) to create HLS video torrents:
+ * **/!\ VERY IMPORTANT /!\\** You need to execute manually a script (must be executed after the upgrade and a PeerTube restart, while your instance is running) to create HLS video torrents:
    * `cd /var/www/peertube/peertube-latest && sudo -u peertube NODE_CONFIG_DIR=/var/www/peertube/config NODE_ENV=production node dist/scripts/migrations/peertube-2.1.js`
  * **/!\ VERY IMPORTANT /!\\** In the next PeerTube release (v2.2.0), we'll add a unique index on actors usernames to fix some federation bugs.
  Please check now if you have conflicts using:
diff --git a/package.json b/package.json
index 0a5484d2a..cec311a18 100644
--- a/package.json
+++ b/package.json
@@ -95,7 +95,7 @@
     "deep-object-diff": "^1.1.0",
     "express": "^4.12.4",
     "express-oauth-server": "^2.0.0",
-    "express-rate-limit": "^4.0.4",
+    "express-rate-limit": "^5.0.0",
     "express-validator": "^6.4.0",
     "flat": "^5.0.0",
     "fluent-ffmpeg": "^2.1.0",
diff --git a/server/controllers/activitypub/client.ts b/server/controllers/activitypub/client.ts
index 2812bfe1e..84828e7e0 100644
--- a/server/controllers/activitypub/client.ts
+++ b/server/controllers/activitypub/client.ts
@@ -1,4 +1,3 @@
-// Intercept ActivityPub client requests
 import * as express from 'express'
 import { VideoPrivacy, VideoRateType } from '../../../shared/models/videos'
 import { activityPubCollectionPagination, activityPubContextify } from '../../helpers/activitypub'
@@ -37,10 +36,12 @@ import { buildDislikeActivity } from '../../lib/activitypub/send/send-dislike'
 import { videoPlaylistElementAPGetValidator, videoPlaylistsGetValidator } from '../../middlewares/validators/videos/video-playlists'
 import { VideoPlaylistModel } from '../../models/video/video-playlist'
 import { VideoPlaylistPrivacy } from '../../../shared/models/videos/playlist/video-playlist-privacy.model'
-import { MAccountId, MActorId, MVideo, MVideoAPWithoutCaption } from '@server/typings/models'
+import { MAccountId, MActorId, MVideoAPWithoutCaption, MVideoId } from '@server/typings/models'
 
 const activityPubClientRouter = express.Router()
 
+// Intercept ActivityPub client requests
+
 activityPubClientRouter.get('/accounts?/:name',
   executeIfActivityPub,
   asyncMiddleware(localAccountValidator),
@@ -85,7 +86,7 @@ activityPubClientRouter.get('/videos/watch/:id/activity',
 )
 activityPubClientRouter.get('/videos/watch/:id/announces',
   executeIfActivityPub,
-  asyncMiddleware(videosCustomGetValidator('only-video')),
+  asyncMiddleware(videosCustomGetValidator('only-immutable-attributes')),
   asyncMiddleware(videoAnnouncesController)
 )
 activityPubClientRouter.get('/videos/watch/:id/announces/:actorId',
@@ -95,17 +96,17 @@ activityPubClientRouter.get('/videos/watch/:id/announces/:actorId',
 )
 activityPubClientRouter.get('/videos/watch/:id/likes',
   executeIfActivityPub,
-  asyncMiddleware(videosCustomGetValidator('only-video')),
+  asyncMiddleware(videosCustomGetValidator('only-immutable-attributes')),
   asyncMiddleware(videoLikesController)
 )
 activityPubClientRouter.get('/videos/watch/:id/dislikes',
   executeIfActivityPub,
-  asyncMiddleware(videosCustomGetValidator('only-video')),
+  asyncMiddleware(videosCustomGetValidator('only-immutable-attributes')),
   asyncMiddleware(videoDislikesController)
 )
 activityPubClientRouter.get('/videos/watch/:id/comments',
   executeIfActivityPub,
-  asyncMiddleware(videosCustomGetValidator('only-video')),
+  asyncMiddleware(videosCustomGetValidator('only-immutable-attributes')),
   asyncMiddleware(videoCommentsController)
 )
 activityPubClientRouter.get('/videos/watch/:videoId/comments/:commentId',
@@ -238,7 +239,7 @@ async function videoAnnounceController (req: express.Request, res: express.Respo
 }
 
 async function videoAnnouncesController (req: express.Request, res: express.Response) {
-  const video = res.locals.onlyVideo
+  const video = res.locals.onlyImmutableVideo
 
   const handler = async (start: number, count: number) => {
     const result = await VideoShareModel.listAndCountByVideoId(video.id, start, count)
@@ -253,21 +254,21 @@ async function videoAnnouncesController (req: express.Request, res: express.Resp
 }
 
 async function videoLikesController (req: express.Request, res: express.Response) {
-  const video = res.locals.onlyVideo
+  const video = res.locals.onlyImmutableVideo
   const json = await videoRates(req, 'like', video, getVideoLikesActivityPubUrl(video))
 
   return activityPubResponse(activityPubContextify(json), res)
 }
 
 async function videoDislikesController (req: express.Request, res: express.Response) {
-  const video = res.locals.onlyVideo
+  const video = res.locals.onlyImmutableVideo
   const json = await videoRates(req, 'dislike', video, getVideoDislikesActivityPubUrl(video))
 
   return activityPubResponse(activityPubContextify(json), res)
 }
 
 async function videoCommentsController (req: express.Request, res: express.Response) {
-  const video = res.locals.onlyVideo
+  const video = res.locals.onlyImmutableVideo
 
   const handler = async (start: number, count: number) => {
     const result = await VideoCommentModel.listAndCountByVideoId(video.id, start, count)
@@ -334,10 +335,10 @@ async function videoRedundancyController (req: express.Request, res: express.Res
 
   if (req.path.endsWith('/activity')) {
     const data = buildCreateActivity(videoRedundancy.url, serverActor, object, audience)
-    return activityPubResponse(activityPubContextify(data), res)
+    return activityPubResponse(activityPubContextify(data, 'CacheFile'), res)
   }
 
-  return activityPubResponse(activityPubContextify(object), res)
+  return activityPubResponse(activityPubContextify(object, 'CacheFile'), res)
 }
 
 async function videoPlaylistController (req: express.Request, res: express.Response) {
@@ -386,7 +387,7 @@ async function actorPlaylists (req: express.Request, account: MAccountId) {
   return activityPubCollectionPagination(WEBSERVER.URL + req.path, handler, req.query.page)
 }
 
-function videoRates (req: express.Request, rateType: VideoRateType, video: MVideo, url: string) {
+function videoRates (req: express.Request, rateType: VideoRateType, video: MVideoId, url: string) {
   const handler = async (start: number, count: number) => {
     const result = await AccountVideoRateModel.listAndCountAccountUrlsByVideoId(rateType, video.id, start, count)
     return {
diff --git a/server/controllers/api/index.ts b/server/controllers/api/index.ts
index 6138a32de..7bec6c527 100644
--- a/server/controllers/api/index.ts
+++ b/server/controllers/api/index.ts
@@ -1,5 +1,4 @@
 import * as express from 'express'
-import * as RateLimit from 'express-rate-limit'
 import { configRouter } from './config'
 import { jobsRouter } from './jobs'
 import { oauthClientsRouter } from './oauth-clients'
@@ -15,6 +14,7 @@ import { overviewsRouter } from './overviews'
 import { videoPlaylistRouter } from './video-playlist'
 import { CONFIG } from '../../initializers/config'
 import { pluginRouter } from './plugins'
+import * as RateLimit from 'express-rate-limit'
 
 const apiRouter = express.Router()
 
@@ -24,8 +24,6 @@ apiRouter.use(cors({
   credentials: true
 }))
 
-// FIXME: https://github.com/nfriedly/express-rate-limit/issues/138
-// @ts-ignore
 const apiRateLimiter = RateLimit({
   windowMs: CONFIG.RATES_LIMIT.API.WINDOW_MS,
   max: CONFIG.RATES_LIMIT.API.MAX
diff --git a/server/controllers/api/users/index.ts b/server/controllers/api/users/index.ts
index b960e80c1..0b7012537 100644
--- a/server/controllers/api/users/index.ts
+++ b/server/controllers/api/users/index.ts
@@ -53,8 +53,6 @@ import { Hooks } from '@server/lib/plugins/hooks'
 
 const auditLogger = auditLoggerFactory('users')
 
-// FIXME: https://github.com/nfriedly/express-rate-limit/issues/138
-// @ts-ignore
 const loginRateLimiter = RateLimit({
   windowMs: CONFIG.RATES_LIMIT.LOGIN.WINDOW_MS,
   max: CONFIG.RATES_LIMIT.LOGIN.MAX
diff --git a/server/controllers/api/videos/index.ts b/server/controllers/api/videos/index.ts
index 1d61f8427..eb46ea01f 100644
--- a/server/controllers/api/videos/index.ts
+++ b/server/controllers/api/videos/index.ts
@@ -135,7 +135,7 @@ videosRouter.get('/:id',
   asyncMiddleware(getVideo)
 )
 videosRouter.post('/:id/views',
-  asyncMiddleware(videosGetValidator),
+  asyncMiddleware(videosCustomGetValidator('only-immutable-attributes')),
   asyncMiddleware(viewVideo)
 )
 
@@ -458,7 +458,7 @@ async function getVideo (req: express.Request, res: express.Response) {
 }
 
 async function viewVideo (req: express.Request, res: express.Response) {
-  const videoInstance = res.locals.videoAll
+  const videoInstance = res.locals.onlyImmutableVideo
 
   const ip = req.ip
   const exists = await Redis.Instance.doesVideoIPViewExist(ip, videoInstance.uuid)
diff --git a/server/helpers/activitypub.ts b/server/helpers/activitypub.ts
index 326785b68..2d49e6869 100644
--- a/server/helpers/activitypub.ts
+++ b/server/helpers/activitypub.ts
@@ -8,102 +8,117 @@ import { pageToStartAndCount } from './core-utils'
 import { URL } from 'url'
 import { MActor, MVideoAccountLight } from '../typings/models'
 
-export type ContextType = 'All' | 'View' | 'Announce'
+export type ContextType = 'All' | 'View' | 'Announce' | 'CacheFile'
+
+function getContextData (type: ContextType) {
+  const context: any[] = [
+    'https://www.w3.org/ns/activitystreams',
+    'https://w3id.org/security/v1',
+    {
+      RsaSignature2017: 'https://w3id.org/security#RsaSignature2017'
+    }
+  ]
 
-function activityPubContextify <T> (data: T, type: ContextType = 'All') {
-  const base = {
-    RsaSignature2017: 'https://w3id.org/security#RsaSignature2017'
+  if (type !== 'View' && type !== 'Announce') {
+    const additional = {
+      pt: 'https://joinpeertube.org/ns#',
+      sc: 'http://schema.org#'
+    }
+
+    if (type === 'CacheFile') {
+      Object.assign(additional, {
+        expires: 'sc:expires',
+        CacheFile: 'pt:CacheFile'
+      })
+    } else {
+      Object.assign(additional, {
+        Hashtag: 'as:Hashtag',
+        uuid: 'sc:identifier',
+        category: 'sc:category',
+        licence: 'sc:license',
+        subtitleLanguage: 'sc:subtitleLanguage',
+        sensitive: 'as:sensitive',
+        language: 'sc:inLanguage',
+
+        Infohash: 'pt:Infohash',
+        originallyPublishedAt: 'sc:datePublished',
+        views: {
+          '@type': 'sc:Number',
+          '@id': 'pt:views'
+        },
+        state: {
+          '@type': 'sc:Number',
+          '@id': 'pt:state'
+        },
+        size: {
+          '@type': 'sc:Number',
+          '@id': 'pt:size'
+        },
+        fps: {
+          '@type': 'sc:Number',
+          '@id': 'pt:fps'
+        },
+        startTimestamp: {
+          '@type': 'sc:Number',
+          '@id': 'pt:startTimestamp'
+        },
+        stopTimestamp: {
+          '@type': 'sc:Number',
+          '@id': 'pt:stopTimestamp'
+        },
+        position: {
+          '@type': 'sc:Number',
+          '@id': 'pt:position'
+        },
+        commentsEnabled: {
+          '@type': 'sc:Boolean',
+          '@id': 'pt:commentsEnabled'
+        },
+        downloadEnabled: {
+          '@type': 'sc:Boolean',
+          '@id': 'pt:downloadEnabled'
+        },
+        waitTranscoding: {
+          '@type': 'sc:Boolean',
+          '@id': 'pt:waitTranscoding'
+        },
+        support: {
+          '@type': 'sc:Text',
+          '@id': 'pt:support'
+        },
+        likes: {
+          '@id': 'as:likes',
+          '@type': '@id'
+        },
+        dislikes: {
+          '@id': 'as:dislikes',
+          '@type': '@id'
+        },
+        playlists: {
+          '@id': 'pt:playlists',
+          '@type': '@id'
+        },
+        shares: {
+          '@id': 'as:shares',
+          '@type': '@id'
+        },
+        comments: {
+          '@id': 'as:comments',
+          '@type': '@id'
+        }
+      })
+    }
+
+    context.push(additional)
   }
 
-  if (type === 'All') {
-    Object.assign(base, {
-      pt: 'https://joinpeertube.org/ns#',
-      sc: 'http://schema.org#',
-      Hashtag: 'as:Hashtag',
-      uuid: 'sc:identifier',
-      category: 'sc:category',
-      licence: 'sc:license',
-      subtitleLanguage: 'sc:subtitleLanguage',
-      sensitive: 'as:sensitive',
-      language: 'sc:inLanguage',
-      expires: 'sc:expires',
-      CacheFile: 'pt:CacheFile',
-      Infohash: 'pt:Infohash',
-      originallyPublishedAt: 'sc:datePublished',
-      views: {
-        '@type': 'sc:Number',
-        '@id': 'pt:views'
-      },
-      state: {
-        '@type': 'sc:Number',
-        '@id': 'pt:state'
-      },
-      size: {
-        '@type': 'sc:Number',
-        '@id': 'pt:size'
-      },
-      fps: {
-        '@type': 'sc:Number',
-        '@id': 'pt:fps'
-      },
-      startTimestamp: {
-        '@type': 'sc:Number',
-        '@id': 'pt:startTimestamp'
-      },
-      stopTimestamp: {
-        '@type': 'sc:Number',
-        '@id': 'pt:stopTimestamp'
-      },
-      position: {
-        '@type': 'sc:Number',
-        '@id': 'pt:position'
-      },
-      commentsEnabled: {
-        '@type': 'sc:Boolean',
-        '@id': 'pt:commentsEnabled'
-      },
-      downloadEnabled: {
-        '@type': 'sc:Boolean',
-        '@id': 'pt:downloadEnabled'
-      },
-      waitTranscoding: {
-        '@type': 'sc:Boolean',
-        '@id': 'pt:waitTranscoding'
-      },
-      support: {
-        '@type': 'sc:Text',
-        '@id': 'pt:support'
-      },
-      likes: {
-        '@id': 'as:likes',
-        '@type': '@id'
-      },
-      dislikes: {
-        '@id': 'as:dislikes',
-        '@type': '@id'
-      },
-      playlists: {
-        '@id': 'pt:playlists',
-        '@type': '@id'
-      },
-      shares: {
-        '@id': 'as:shares',
-        '@type': '@id'
-      },
-      comments: {
-        '@id': 'as:comments',
-        '@type': '@id'
-      }
-    })
+  return {
+    '@context': context
   }
+}
 
-  return Object.assign({}, data, {
-    '@context': [
-      'https://www.w3.org/ns/activitystreams',
-      'https://w3id.org/security/v1',
-      base
-    ]
-  })
+function activityPubContextify <T> (data: T, type: ContextType = 'All') {
+  return Object.assign({}, data, getContextData(type))
 }
 
 type ActivityPubCollectionPaginationHandler = (start: number, count: number) => Bluebird<ResultList<any>> | Promise<ResultList<any>>
diff --git a/server/helpers/middlewares/videos.ts b/server/helpers/middlewares/videos.ts
index 74f529804..409f78650 100644
--- a/server/helpers/middlewares/videos.ts
+++ b/server/helpers/middlewares/videos.ts
@@ -2,7 +2,16 @@ import { Response } from 'express'
 import { fetchVideo, VideoFetchType } from '../video'
 import { UserRight } from '../../../shared/models/users'
 import { VideoChannelModel } from '../../models/video/video-channel'
-import { MUser, MUserAccountId, MVideoAccountLight, MVideoFullLight, MVideoThumbnail, MVideoWithRights } from '@server/typings/models'
+import {
+  MUser,
+  MUserAccountId,
+  MVideoAccountLight,
+  MVideoFullLight,
+  MVideoIdThumbnail,
+  MVideoImmutable,
+  MVideoThumbnail,
+  MVideoWithRights
+} from '@server/typings/models'
 
 async function doesVideoExist (id: number | string, res: Response, fetchType: VideoFetchType = 'all') {
   const userId = res.locals.oauth ? res.locals.oauth.token.User.id : undefined
@@ -22,8 +31,12 @@ async function doesVideoExist (id: number | string, res: Response, fetchType: Vi
       res.locals.videoAll = video as MVideoFullLight
       break
 
+    case 'only-immutable-attributes':
+      res.locals.onlyImmutableVideo = video as MVideoImmutable
+      break
+
     case 'id':
-      res.locals.videoId = video
+      res.locals.videoId = video as MVideoIdThumbnail
       break
 
     case 'only-video':
diff --git a/server/helpers/video.ts b/server/helpers/video.ts
index 5b9c026b1..4fe2a60f0 100644
--- a/server/helpers/video.ts
+++ b/server/helpers/video.ts
@@ -5,13 +5,15 @@ import {
   MVideoFullLight,
   MVideoIdThumbnail,
   MVideoThumbnail,
-  MVideoWithRights
+  MVideoWithRights,
+  MVideoImmutable
 } from '@server/typings/models'
 import { Response } from 'express'
 
-type VideoFetchType = 'all' | 'only-video' | 'only-video-with-rights' | 'id' | 'none'
+type VideoFetchType = 'all' | 'only-video' | 'only-video-with-rights' | 'id' | 'none' | 'only-immutable-attributes'
 
 function fetchVideo (id: number | string, fetchType: 'all', userId?: number): Bluebird<MVideoFullLight>
+function fetchVideo (id: number | string, fetchType: 'only-immutable-attributes'): Bluebird<MVideoImmutable>
 function fetchVideo (id: number | string, fetchType: 'only-video', userId?: number): Bluebird<MVideoThumbnail>
 function fetchVideo (id: number | string, fetchType: 'only-video-with-rights', userId?: number): Bluebird<MVideoWithRights>
 function fetchVideo (id: number | string, fetchType: 'id' | 'none', userId?: number): Bluebird<MVideoIdThumbnail>
@@ -19,14 +21,16 @@ function fetchVideo (
   id: number | string,
   fetchType: VideoFetchType,
   userId?: number
-): Bluebird<MVideoFullLight | MVideoThumbnail | MVideoWithRights | MVideoIdThumbnail>
+): Bluebird<MVideoFullLight | MVideoThumbnail | MVideoWithRights | MVideoIdThumbnail | MVideoImmutable>
 function fetchVideo (
   id: number | string,
   fetchType: VideoFetchType,
   userId?: number
-): Bluebird<MVideoFullLight | MVideoThumbnail | MVideoWithRights | MVideoIdThumbnail> {
+): Bluebird<MVideoFullLight | MVideoThumbnail | MVideoWithRights | MVideoIdThumbnail | MVideoImmutable> {
   if (fetchType === 'all') return VideoModel.loadAndPopulateAccountAndServerAndTags(id, undefined, userId)
 
+  if (fetchType === 'only-immutable-attributes') return VideoModel.loadImmutableAttributes(id)
+
   if (fetchType === 'only-video-with-rights') return VideoModel.loadWithRights(id)
 
   if (fetchType === 'only-video') return VideoModel.load(id)
@@ -34,14 +38,23 @@ function fetchVideo (
   if (fetchType === 'id' || fetchType === 'none') return VideoModel.loadOnlyId(id)
 }
 
-type VideoFetchByUrlType = 'all' | 'only-video'
+type VideoFetchByUrlType = 'all' | 'only-video' | 'only-immutable-attributes'
 
 function fetchVideoByUrl (url: string, fetchType: 'all'): Bluebird<MVideoAccountLightBlacklistAllFiles>
+function fetchVideoByUrl (url: string, fetchType: 'only-immutable-attributes'): Bluebird<MVideoImmutable>
 function fetchVideoByUrl (url: string, fetchType: 'only-video'): Bluebird<MVideoThumbnail>
-function fetchVideoByUrl (url: string, fetchType: VideoFetchByUrlType): Bluebird<MVideoAccountLightBlacklistAllFiles | MVideoThumbnail>
-function fetchVideoByUrl (url: string, fetchType: VideoFetchByUrlType): Bluebird<MVideoAccountLightBlacklistAllFiles | MVideoThumbnail> {
+function fetchVideoByUrl (
+  url: string,
+  fetchType: VideoFetchByUrlType
+): Bluebird<MVideoAccountLightBlacklistAllFiles | MVideoThumbnail | MVideoImmutable>
+function fetchVideoByUrl (
+  url: string,
+  fetchType: VideoFetchByUrlType
+): Bluebird<MVideoAccountLightBlacklistAllFiles | MVideoThumbnail | MVideoImmutable> {
   if (fetchType === 'all') return VideoModel.loadByUrlAndPopulateAccount(url)
 
+  if (fetchType === 'only-immutable-attributes') return VideoModel.loadByUrlImmutableAttributes(url)
+
   if (fetchType === 'only-video') return VideoModel.loadByUrl(url)
 }
 
diff --git a/server/lib/activitypub/audience.ts b/server/lib/activitypub/audience.ts
index f2ab54cf7..9933ae2b5 100644
--- a/server/lib/activitypub/audience.ts
+++ b/server/lib/activitypub/audience.ts
@@ -4,11 +4,11 @@ import { ACTIVITY_PUB } from '../../initializers/constants'
 import { ActorModel } from '../../models/activitypub/actor'
 import { VideoModel } from '../../models/video/video'
 import { VideoShareModel } from '../../models/video/video-share'
-import { MActorFollowersUrl, MActorLight, MCommentOwner, MCommentOwnerVideo, MVideo, MVideoAccountLight } from '../../typings/models'
+import { MActorFollowersUrl, MActorLight, MActorUrl, MCommentOwner, MCommentOwnerVideo, MVideoId } from '../../typings/models'
 
-function getRemoteVideoAudience (video: MVideoAccountLight, actorsInvolvedInVideo: MActorFollowersUrl[]): ActivityAudience {
+function getRemoteVideoAudience (accountActor: MActorUrl, actorsInvolvedInVideo: MActorFollowersUrl[]): ActivityAudience {
   return {
-    to: [ video.VideoChannel.Account.Actor.url ],
+    to: [ accountActor.url ],
     cc: actorsInvolvedInVideo.map(a => a.followersUrl)
   }
 }
@@ -48,7 +48,7 @@ function getAudienceFromFollowersOf (actorsInvolvedInObject: MActorFollowersUrl[
   }
 }
 
-async function getActorsInvolvedInVideo (video: MVideo, t: Transaction) {
+async function getActorsInvolvedInVideo (video: MVideoId, t: Transaction) {
   const actors: MActorLight[] = await VideoShareModel.loadActorsByShare(video.id, t)
 
   const videoAll = video as VideoModel
diff --git a/server/lib/activitypub/process/process-view.ts b/server/lib/activitypub/process/process-view.ts
index df29ee968..b3b6c933d 100644
--- a/server/lib/activitypub/process/process-view.ts
+++ b/server/lib/activitypub/process/process-view.ts
@@ -23,7 +23,8 @@ async function processCreateView (activity: ActivityView | ActivityCreate, byAct
 
   const options = {
     videoObject,
-    fetchType: 'only-video' as 'only-video'
+    fetchType: 'only-immutable-attributes' as 'only-immutable-attributes',
+    allowRefresh: false as false
   }
   const { video } = await getOrCreateVideoAndAccountAndChannel(options)
 
diff --git a/server/lib/activitypub/send/send-create.ts b/server/lib/activitypub/send/send-create.ts
index 3585d704a..8bdcf6417 100644
--- a/server/lib/activitypub/send/send-create.ts
+++ b/server/lib/activitypub/send/send-create.ts
@@ -16,6 +16,7 @@ import {
   MVideoRedundancyFileVideo,
   MVideoRedundancyStreamingPlaylistVideo
 } from '../../../typings/models'
+import { ContextType } from '@server/helpers/activitypub'
 
 async function sendCreateVideo (video: MVideoAP, t: Transaction) {
   if (!video.hasPrivacyForFederation()) return undefined
@@ -42,7 +43,8 @@ async function sendCreateCacheFile (
     byActor,
     video,
     url: fileRedundancy.url,
-    object: fileRedundancy.toActivityPubObject()
+    object: fileRedundancy.toActivityPubObject(),
+    contextType: 'CacheFile'
   })
 }
 
@@ -135,6 +137,7 @@ async function sendVideoRelatedCreateActivity (options: {
   url: string
   object: any
   transaction?: Transaction
+  contextType?: ContextType
 }) {
   const activityBuilder = (audience: ActivityAudience) => {
     return buildCreateActivity(options.url, options.byActor, options.object, audience)
diff --git a/server/lib/activitypub/send/send-update.ts b/server/lib/activitypub/send/send-update.ts
index cb500bd34..2b01ca5e7 100644
--- a/server/lib/activitypub/send/send-update.ts
+++ b/server/lib/activitypub/send/send-update.ts
@@ -84,7 +84,7 @@ async function sendUpdateCacheFile (byActor: MActorLight, redundancyModel: MVide
     return buildUpdateActivity(url, byActor, redundancyObject, audience)
   }
 
-  return sendVideoRelatedActivity(activityBuilder, { byActor, video })
+  return sendVideoRelatedActivity(activityBuilder, { byActor, video, contextType: 'CacheFile' })
 }
 
 async function sendUpdateVideoPlaylist (videoPlaylist: MVideoPlaylistFull, t: Transaction) {
diff --git a/server/lib/activitypub/send/send-view.ts b/server/lib/activitypub/send/send-view.ts
index 47482b9a9..1f864ea52 100644
--- a/server/lib/activitypub/send/send-view.ts
+++ b/server/lib/activitypub/send/send-view.ts
@@ -5,9 +5,9 @@ import { getVideoLikeActivityPubUrl } from '../url'
 import { sendVideoRelatedActivity } from './utils'
 import { audiencify, getAudience } from '../audience'
 import { logger } from '../../../helpers/logger'
-import { MActorAudience, MVideoAccountLight, MVideoUrl } from '@server/typings/models'
+import { MActorAudience, MVideoImmutable, MVideoUrl } from '@server/typings/models'
 
-async function sendView (byActor: ActorModel, video: MVideoAccountLight, t: Transaction) {
+async function sendView (byActor: ActorModel, video: MVideoImmutable, t: Transaction) {
   logger.info('Creating job to send view of %s.', video.url)
 
   const activityBuilder = (audience: ActivityAudience) => {
diff --git a/server/lib/activitypub/send/utils.ts b/server/lib/activitypub/send/utils.ts
index 0d67bb3d6..b57bae8fd 100644
--- a/server/lib/activitypub/send/utils.ts
+++ b/server/lib/activitypub/send/utils.ts
@@ -7,12 +7,12 @@ import { JobQueue } from '../../job-queue'
 import { getActorsInvolvedInVideo, getAudienceFromFollowersOf, getRemoteVideoAudience } from '../audience'
 import { getServerActor } from '../../../helpers/utils'
 import { afterCommitIfTransaction } from '../../../helpers/database-utils'
-import { MActorWithInboxes, MActor, MActorId, MActorLight, MVideo, MVideoAccountLight } from '../../../typings/models'
+import { MActor, MActorId, MActorLight, MActorWithInboxes, MVideoAccountLight, MVideoId, MVideoImmutable } from '../../../typings/models'
 import { ContextType } from '@server/helpers/activitypub'
 
 async function sendVideoRelatedActivity (activityBuilder: (audience: ActivityAudience) => Activity, options: {
   byActor: MActorLight
-  video: MVideoAccountLight
+  video: MVideoImmutable | MVideoAccountLight
   transaction?: Transaction
   contextType?: ContextType
 }) {
@@ -22,11 +22,13 @@ async function sendVideoRelatedActivity (activityBuilder: (audience: ActivityAud
 
   // Send to origin
   if (video.isOwned() === false) {
-    const audience = getRemoteVideoAudience(video, actorsInvolvedInVideo)
+    const accountActor = (video as MVideoAccountLight).VideoChannel?.Account?.Actor || await ActorModel.loadAccountActorByVideoId(video.id)
+
+    const audience = getRemoteVideoAudience(accountActor, actorsInvolvedInVideo)
     const activity = activityBuilder(audience)
 
     return afterCommitIfTransaction(transaction, () => {
-      return unicastTo(activity, byActor, video.VideoChannel.Account.Actor.getSharedInbox(), contextType)
+      return unicastTo(activity, byActor, accountActor.getSharedInbox(), contextType)
     })
   }
 
@@ -43,7 +45,7 @@ async function forwardVideoRelatedActivity (
   activity: Activity,
   t: Transaction,
   followersException: MActorWithInboxes[] = [],
-  video: MVideo
+  video: MVideoId
 ) {
   // Mastodon does not add our announces in audience, so we forward to them manually
   const additionalActors = await getActorsInvolvedInVideo(video, t)
diff --git a/server/lib/activitypub/videos.ts b/server/lib/activitypub/videos.ts
index 9e43caa20..7d8296e45 100644
--- a/server/lib/activitypub/videos.ts
+++ b/server/lib/activitypub/videos.ts
@@ -68,7 +68,7 @@ import {
   MVideoAPWithoutCaption,
   MVideoFile,
   MVideoFullLight,
-  MVideoId,
+  MVideoId, MVideoImmutable,
   MVideoThumbnail
 } from '../../typings/models'
 import { MThumbnail } from '../../typings/models/video/thumbnail'
@@ -200,24 +200,41 @@ async function syncVideoExternalAttributes (video: MVideo, fetchedVideo: VideoTo
   await Bluebird.map(jobPayloads, payload => JobQueue.Instance.createJobWithPromise({ type: 'activitypub-http-fetcher', payload }))
 }
 
-function getOrCreateVideoAndAccountAndChannel (options: {
+type GetVideoResult <T> = Promise<{
+  video: T
+  created: boolean
+  autoBlacklisted?: boolean
+}>
+
+type GetVideoParamAll = {
   videoObject: { id: string } | string
   syncParam?: SyncParam
   fetchType?: 'all'
   allowRefresh?: boolean
-}): Promise<{ video: MVideoAccountLightBlacklistAllFiles, created: boolean, autoBlacklisted?: boolean }>
-function getOrCreateVideoAndAccountAndChannel (options: {
+}
+
+type GetVideoParamImmutable = {
   videoObject: { id: string } | string
   syncParam?: SyncParam
-  fetchType?: VideoFetchByUrlType
-  allowRefresh?: boolean
-}): Promise<{ video: MVideoAccountLightBlacklistAllFiles | MVideoThumbnail, created: boolean, autoBlacklisted?: boolean }>
-async function getOrCreateVideoAndAccountAndChannel (options: {
+  fetchType: 'only-immutable-attributes'
+  allowRefresh: false
+}
+
+type GetVideoParamOther = {
   videoObject: { id: string } | string
   syncParam?: SyncParam
-  fetchType?: VideoFetchByUrlType
-  allowRefresh?: boolean // true by default
-}): Promise<{ video: MVideoAccountLightBlacklistAllFiles | MVideoThumbnail, created: boolean, autoBlacklisted?: boolean }> {
+  fetchType?: 'all' | 'only-video'
+  allowRefresh?: boolean
+}
+
+function getOrCreateVideoAndAccountAndChannel (options: GetVideoParamAll): GetVideoResult<MVideoAccountLightBlacklistAllFiles>
+function getOrCreateVideoAndAccountAndChannel (options: GetVideoParamImmutable): GetVideoResult<MVideoImmutable>
+function getOrCreateVideoAndAccountAndChannel (
+  options: GetVideoParamOther
+): GetVideoResult<MVideoAccountLightBlacklistAllFiles | MVideoThumbnail>
+async function getOrCreateVideoAndAccountAndChannel (
+  options: GetVideoParamAll | GetVideoParamImmutable | GetVideoParamOther
+): GetVideoResult<MVideoAccountLightBlacklistAllFiles | MVideoThumbnail | MVideoImmutable> {
   // Default params
   const syncParam = options.syncParam || { likes: true, dislikes: true, shares: true, comments: true, thumbnail: true, refreshVideo: false }
   const fetchType = options.fetchType || 'all'
@@ -225,12 +242,13 @@ async function getOrCreateVideoAndAccountAndChannel (options: {
 
   // Get video url
   const videoUrl = getAPId(options.videoObject)
-
   let videoFromDatabase = await fetchVideoByUrl(videoUrl, fetchType)
+
   if (videoFromDatabase) {
-    if (videoFromDatabase.isOutdated() && allowRefresh === true) {
+    // If allowRefresh is true, we could not call this function using 'only-immutable-attributes' fetch type
+    if (allowRefresh === true && (videoFromDatabase as MVideoThumbnail).isOutdated()) {
       const refreshOptions = {
-        video: videoFromDatabase,
+        video: videoFromDatabase as MVideoThumbnail,
         fetchedType: fetchType,
         syncParam
       }
diff --git a/server/middlewares/validators/videos/videos.ts b/server/middlewares/validators/videos/videos.ts
index 11dd02706..a027c4840 100644
--- a/server/middlewares/validators/videos/videos.ts
+++ b/server/middlewares/validators/videos/videos.ts
@@ -147,7 +147,10 @@ async function checkVideoFollowConstraints (req: express.Request, res: express.R
             })
 }
 
-const videosCustomGetValidator = (fetchType: 'all' | 'only-video' | 'only-video-with-rights', authenticateInQuery = false) => {
+const videosCustomGetValidator = (
+  fetchType: 'all' | 'only-video' | 'only-video-with-rights' | 'only-immutable-attributes',
+  authenticateInQuery = false
+) => {
   return [
     param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
 
@@ -157,6 +160,9 @@ const videosCustomGetValidator = (fetchType: 'all' | 'only-video' | 'only-video-
       if (areValidationErrors(req, res)) return
       if (!await doesVideoExist(req.params.id, res, fetchType)) return
 
+      // Controllers does not need to check video rights
+      if (fetchType === 'only-immutable-attributes') return next()
+
       const video = getVideoWithAttributes(res)
       const videoAll = video as MVideoFullLight
 
diff --git a/server/models/account/account.ts b/server/models/account/account.ts
index 0905a0fb2..a0081f259 100644
--- a/server/models/account/account.ts
+++ b/server/models/account/account.ts
@@ -32,8 +32,9 @@ import { FindOptions, IncludeOptions, Op, Transaction, WhereOptions } from 'sequ
 import { AccountBlocklistModel } from './account-blocklist'
 import { ServerBlocklistModel } from '../server/server-blocklist'
 import { ActorFollowModel } from '../activitypub/actor-follow'
-import { MAccountActor, MAccountDefault, MAccountSummaryFormattable, MAccountFormattable, MAccountAP } from '../../typings/models'
+import { MAccountActor, MAccountAP, MAccountDefault, MAccountFormattable, MAccountSummaryFormattable } from '../../typings/models'
 import * as Bluebird from 'bluebird'
+import { ModelCache } from '@server/models/model-cache'
 
 export enum ScopeNames {
   SUMMARY = 'SUMMARY'
@@ -218,8 +219,6 @@ export class AccountModel extends Model<AccountModel> {
   })
   BlockedAccounts: AccountBlocklistModel[]
 
-  private static cache: { [ id: string ]: any } = {}
-
   @BeforeDestroy
   static async sendDeleteIfOwned (instance: AccountModel, options) {
     if (!instance.Actor) {
@@ -247,45 +246,43 @@ export class AccountModel extends Model<AccountModel> {
   }
 
   static loadLocalByName (name: string): Bluebird<MAccountDefault> {
-    // The server actor never change, so we can easily cache it
-    if (name === SERVER_ACTOR_NAME && AccountModel.cache[name]) {
-      return Bluebird.resolve(AccountModel.cache[name])
-    }
-
-    const query = {
-      where: {
-        [Op.or]: [
-          {
-            userId: {
-              [Op.ne]: null
+    const fun = () => {
+      const query = {
+        where: {
+          [Op.or]: [
+            {
+              userId: {
+                [Op.ne]: null
+              }
+            },
+            {
+              applicationId: {
+                [Op.ne]: null
+              }
             }
-          },
+          ]
+        },
+        include: [
           {
-            applicationId: {
-              [Op.ne]: null
+            model: ActorModel,
+            required: true,
+            where: {
+              preferredUsername: name
             }
           }
         ]
-      },
-      include: [
-        {
-          model: ActorModel,
-          required: true,
-          where: {
-            preferredUsername: name
-          }
-        }
-      ]
-    }
+      }
 
-    return AccountModel.findOne(query)
-      .then(account => {
-        if (name === SERVER_ACTOR_NAME) {
-          AccountModel.cache[name] = account
-        }
+      return AccountModel.findOne(query)
+    }
 
-        return account
-      })
+    return ModelCache.Instance.doCache({
+      cacheType: 'local-account-name',
+      key: name,
+      fun,
+      // The server actor never change, so we can easily cache it
+      whitelist: () => name === SERVER_ACTOR_NAME
+    })
   }
 
   static loadByNameAndHost (name: string, host: string): Bluebird<MAccountDefault> {
diff --git a/server/models/activitypub/actor.ts b/server/models/activitypub/actor.ts
index 00e8dc954..e547d2c0c 100644
--- a/server/models/activitypub/actor.ts
+++ b/server/models/activitypub/actor.ts
@@ -48,6 +48,7 @@ import {
 } from '../../typings/models'
 import * as Bluebird from 'bluebird'
 import { Op, Transaction, literal } from 'sequelize'
+import { ModelCache } from '@server/models/model-cache'
 
 enum ScopeNames {
   FULL = 'FULL'
@@ -276,9 +277,6 @@ export class ActorModel extends Model<ActorModel> {
   })
   VideoChannel: VideoChannelModel
 
-  private static localNameCache: { [ id: string ]: any } = {}
-  private static localUrlCache: { [ id: string ]: any } = {}
-
   static load (id: number): Bluebird<MActor> {
     return ActorModel.unscoped().findByPk(id)
   }
@@ -345,54 +343,50 @@ export class ActorModel extends Model<ActorModel> {
   }
 
   static loadLocalByName (preferredUsername: string, transaction?: Transaction): Bluebird<MActorFull> {
-    // The server actor never change, so we can easily cache it
-    if (preferredUsername === SERVER_ACTOR_NAME && ActorModel.localNameCache[preferredUsername]) {
-      return Bluebird.resolve(ActorModel.localNameCache[preferredUsername])
-    }
+    const fun = () => {
+      const query = {
+        where: {
+          preferredUsername,
+          serverId: null
+        },
+        transaction
+      }
 
-    const query = {
-      where: {
-        preferredUsername,
-        serverId: null
-      },
-      transaction
+      return ActorModel.scope(ScopeNames.FULL)
+                       .findOne(query)
     }
 
-    return ActorModel.scope(ScopeNames.FULL)
-                     .findOne(query)
-                     .then(actor => {
-                       if (preferredUsername === SERVER_ACTOR_NAME) {
-                         ActorModel.localNameCache[preferredUsername] = actor
-                       }
-
-                       return actor
-                     })
+    return ModelCache.Instance.doCache({
+      cacheType: 'local-actor-name',
+      key: preferredUsername,
+      // The server actor never change, so we can easily cache it
+      whitelist: () => preferredUsername === SERVER_ACTOR_NAME,
+      fun
+    })
   }
 
   static loadLocalUrlByName (preferredUsername: string, transaction?: Transaction): Bluebird<MActorUrl> {
-    // The server actor never change, so we can easily cache it
-    if (preferredUsername === SERVER_ACTOR_NAME && ActorModel.localUrlCache[preferredUsername]) {
-      return Bluebird.resolve(ActorModel.localUrlCache[preferredUsername])
-    }
+    const fun = () => {
+      const query = {
+        attributes: [ 'url' ],
+        where: {
+          preferredUsername,
+          serverId: null
+        },
+        transaction
+      }
 
-    const query = {
-      attributes: [ 'url' ],
-      where: {
-        preferredUsername,
-        serverId: null
-      },
-      transaction
+      return ActorModel.unscoped()
+                       .findOne(query)
     }
 
-    return ActorModel.unscoped()
-                     .findOne(query)
-                     .then(actor => {
-                       if (preferredUsername === SERVER_ACTOR_NAME) {
-                         ActorModel.localUrlCache[preferredUsername] = actor
-                       }
-
-                       return actor
-                     })
+    return ModelCache.Instance.doCache({
+      cacheType: 'local-actor-name',
+      key: preferredUsername,
+      // The server actor never change, so we can easily cache it
+      whitelist: () => preferredUsername === SERVER_ACTOR_NAME,
+      fun
+    })
   }
 
   static loadByNameAndHost (preferredUsername: string, host: string): Bluebird<MActorFull> {
@@ -468,6 +462,36 @@ export class ActorModel extends Model<ActorModel> {
     }, { where, transaction })
   }
 
+  static loadAccountActorByVideoId (videoId: number): Bluebird<MActor> {
+    const query = {
+      include: [
+        {
+          attributes: [ 'id' ],
+          model: AccountModel.unscoped(),
+          required: true,
+          include: [
+            {
+              attributes: [ 'id', 'accountId' ],
+              model: VideoChannelModel.unscoped(),
+              required: true,
+              include: [
+                {
+                  attributes: [ 'id', 'channelId' ],
+                  model: VideoModel.unscoped(),
+                  where: {
+                    id: videoId
+                  }
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    }
+
+    return ActorModel.unscoped().findOne(query)
+  }
+
   getSharedInbox (this: MActorWithInboxes) {
     return this.sharedInboxUrl || this.inboxUrl
   }
diff --git a/server/models/model-cache.ts b/server/models/model-cache.ts
new file mode 100644
index 000000000..a87f99aa2
--- /dev/null
+++ b/server/models/model-cache.ts
@@ -0,0 +1,91 @@
+import { Model } from 'sequelize-typescript'
+import * as Bluebird from 'bluebird'
+import { logger } from '@server/helpers/logger'
+
+type ModelCacheType =
+  'local-account-name'
+  | 'local-actor-name'
+  | 'local-actor-url'
+  | 'load-video-immutable-id'
+  | 'load-video-immutable-url'
+
+type DeleteKey =
+  'video'
+
+class ModelCache {
+
+  private static instance: ModelCache
+
+  private readonly localCache: { [id in ModelCacheType]: Map<string, any> } = {
+    'local-account-name': new Map(),
+    'local-actor-name': new Map(),
+    'local-actor-url': new Map(),
+    'load-video-immutable-id': new Map(),
+    'load-video-immutable-url': new Map()
+  }
+
+  private readonly deleteIds: {
+    [deleteKey in DeleteKey]: Map<number, { cacheType: ModelCacheType, key: string }[]>
+  } = {
+    video: new Map()
+  }
+
+  private constructor () {
+  }
+
+  static get Instance () {
+    return this.instance || (this.instance = new this())
+  }
+
+  doCache<T extends Model> (options: {
+    cacheType: ModelCacheType
+    key: string
+    fun: () => Bluebird<T>
+    whitelist?: () => boolean
+    deleteKey?: DeleteKey
+  }) {
+    const { cacheType, key, fun, whitelist, deleteKey } = options
+
+    if (whitelist && whitelist() !== true) return fun()
+
+    const cache = this.localCache[cacheType]
+
+    if (cache.has(key)) {
+      logger.debug('Model cache hit for %s -> %s.', cacheType, key)
+      return Bluebird.resolve<T>(cache.get(key))
+    }
+
+    return fun().then(m => {
+      if (!m) return m
+
+      if (!whitelist || whitelist()) cache.set(key, m)
+
+      if (deleteKey) {
+        const map = this.deleteIds[deleteKey]
+        if (!map.has(m.id)) map.set(m.id, [])
+
+        const a = map.get(m.id)
+        a.push({ cacheType, key })
+      }
+
+      return m
+    })
+  }
+
+  invalidateCache (deleteKey: DeleteKey, modelId: number) {
+    const map = this.deleteIds[deleteKey]
+
+    if (!map.has(modelId)) return
+
+    for (const toDelete of map.get(modelId)) {
+      logger.debug('Removing %s -> %d of model cache %s -> %s.', deleteKey, modelId, toDelete.cacheType, toDelete.key)
+      this.localCache[toDelete.cacheType].delete(toDelete.key)
+    }
+
+    map.delete(modelId)
+  }
+}
+
+export {
+  ModelCache
+}
diff --git a/server/models/video/video.ts b/server/models/video/video.ts
index 1ec8d717e..5964526a9 100644
--- a/server/models/video/video.ts
+++ b/server/models/video/video.ts
@@ -120,7 +120,7 @@ import {
   MVideoFormattableDetails,
   MVideoForUser,
   MVideoFullLight,
-  MVideoIdThumbnail,
+  MVideoIdThumbnail, MVideoImmutable,
   MVideoThumbnail,
   MVideoThumbnailBlacklist,
   MVideoWithAllFiles,
@@ -132,6 +132,7 @@ import { MThumbnail } from '../../typings/models/video/thumbnail'
 import { VideoFile } from '@shared/models/videos/video-file.model'
 import { getHLSDirectory, getTorrentFileName, getTorrentFilePath, getVideoFilename, getVideoFilePath } from '@server/lib/video-paths'
 import validator from 'validator'
+import { ModelCache } from '@server/models/model-cache'
 
 export enum ScopeNames {
   AVAILABLE_FOR_LIST_IDS = 'AVAILABLE_FOR_LIST_IDS',
@@ -144,6 +145,7 @@ export enum ScopeNames {
   WITH_USER_HISTORY = 'WITH_USER_HISTORY',
   WITH_STREAMING_PLAYLISTS = 'WITH_STREAMING_PLAYLISTS',
   WITH_USER_ID = 'WITH_USER_ID',
+  WITH_IMMUTABLE_ATTRIBUTES = 'WITH_IMMUTABLE_ATTRIBUTES',
   WITH_THUMBNAILS = 'WITH_THUMBNAILS'
 }
 
@@ -187,6 +189,9 @@ export type AvailableForListIDsOptions = {
 }
 
 @Scopes(() => ({
+  [ScopeNames.WITH_IMMUTABLE_ATTRIBUTES]: {
+    attributes: [ 'id', 'url', 'uuid', 'remote' ]
+  },
   [ScopeNames.FOR_API]: (options: ForAPIOptions) => {
     const query: FindOptions = {
       include: [
@@ -1074,6 +1079,11 @@ export class VideoModel extends Model<VideoModel> {
     return undefined
   }
 
+  @BeforeDestroy
+  static invalidateCache (instance: VideoModel) {
+    ModelCache.Instance.invalidateCache('video', instance.id)
+  }
+
   static listLocal (): Bluebird<MVideoWithAllFiles[]> {
     const query = {
       where: {
@@ -1468,6 +1478,24 @@ export class VideoModel extends Model<VideoModel> {
     ]).findOne(options)
   }
 
+  static loadImmutableAttributes (id: number | string, t?: Transaction): Bluebird<MVideoImmutable> {
+    const fun = () => {
+      const query = {
+        where: buildWhereIdOrUUID(id),
+        transaction: t
+      }
+
+      return VideoModel.scope(ScopeNames.WITH_IMMUTABLE_ATTRIBUTES).findOne(query)
+    }
+
+    return ModelCache.Instance.doCache({
+      cacheType: 'load-video-immutable-id',
+      key: '' + id,
+      deleteKey: 'video',
+      fun
+    })
+  }
+
   static loadWithRights (id: number | string, t?: Transaction): Bluebird<MVideoWithRights> {
     const where = buildWhereIdOrUUID(id)
     const options = {
@@ -1531,6 +1559,26 @@ export class VideoModel extends Model<VideoModel> {
     return VideoModel.scope(ScopeNames.WITH_THUMBNAILS).findOne(query)
   }
 
+  static loadByUrlImmutableAttributes (url: string, transaction?: Transaction): Bluebird<MVideoImmutable> {
+    const fun = () => {
+      const query: FindOptions = {
+        where: {
+          url
+        },
+        transaction
+      }
+
+      return VideoModel.scope(ScopeNames.WITH_IMMUTABLE_ATTRIBUTES).findOne(query)
+    }
+
+    return ModelCache.Instance.doCache({
+      cacheType: 'load-video-immutable-url',
+      key: url,
+      deleteKey: 'video',
+      fun
+    })
+  }
+
   static loadByUrlAndPopulateAccount (url: string, transaction?: Transaction): Bluebird<MVideoAccountLightBlacklistAllFiles> {
     const query: FindOptions = {
       where: {
diff --git a/server/typings/express.ts b/server/typings/express.ts
index 43a9b2c99..f4188bf3d 100644
--- a/server/typings/express.ts
+++ b/server/typings/express.ts
@@ -21,7 +21,7 @@ import {
 } from './models'
 import { MVideoPlaylistFull, MVideoPlaylistFullSummary } from './models/video/video-playlist'
 import { MVideoImportDefault } from '@server/typings/models/video/video-import'
-import { MAccountBlocklist, MActorUrl, MStreamingPlaylist, MVideoFile } from '@server/typings/models'
+import { MAccountBlocklist, MActorUrl, MStreamingPlaylist, MVideoFile, MVideoImmutable } from '@server/typings/models'
 import { MVideoPlaylistElement, MVideoPlaylistElementVideoUrlPlaylistPrivacy } from '@server/typings/models/video/video-playlist-element'
 import { MAccountVideoRateAccountVideo } from '@server/typings/models/video/video-rate'
 import { MVideoChangeOwnershipFull } from './models/video/video-change-ownership'
@@ -35,6 +35,7 @@ declare module 'express' {
 
     locals: {
       videoAll?: MVideoFullLight
+      onlyImmutableVideo?: MVideoImmutable
       onlyVideo?: MVideoThumbnail
       onlyVideoWithRights?: MVideoWithRights
       videoId?: MVideoIdThumbnail
diff --git a/server/typings/models/video/video.ts b/server/typings/models/video/video.ts
index 7eff0a913..022a9566d 100644
--- a/server/typings/models/video/video.ts
+++ b/server/typings/models/video/video.ts
@@ -37,6 +37,7 @@ export type MVideoId = Pick<MVideo, 'id'>
 export type MVideoUrl = Pick<MVideo, 'url'>
 export type MVideoUUID = Pick<MVideo, 'uuid'>
 
+export type MVideoImmutable = Pick<MVideo, 'id' | 'url' | 'uuid' | 'remote' | 'isOwned'>
 export type MVideoIdUrl = MVideoId & MVideoUrl
 export type MVideoFeed = Pick<MVideo, 'name' | 'uuid'>
 
diff --git a/yarn.lock b/yarn.lock
index 6e75dab9a..68f281e45 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2282,10 +2282,10 @@ express-oauth-server@^2.0.0:
     express "^4.13.3"
     oauth2-server "3.0.0"
 
-express-rate-limit@^4.0.4:
-  version "4.0.4"
-  resolved "https://registry.yarnpkg.com/express-rate-limit/-/express-rate-limit-4.0.4.tgz#a495338ae9e58c856b66d1346ec0d86f43ba2e43"
-  integrity sha512-DLRj2vMO7Xgai8qWKU9O6ZztF2bdDmfFNFi9k3G9BPzJ+7MG7eWaaBikbe0eBpNGSxU8JziwW0PQKG78aNWa6g==
+express-rate-limit@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/express-rate-limit/-/express-rate-limit-5.0.0.tgz#9a6f4cacc388c1a1da7ba2f65db69f7395e9b04e"
+  integrity sha512-dhT57wqxfqmkOi4HM7NuT4Gd7gbUgSK2ocG27Y6lwm8lbOAw9XQfeANawGq8wLDtlGPO1ZgDj0HmKsykTxfFAg==
 
 express-validator@^6.4.0:
   version "6.4.0"