7 files changed, 72 insertions, 50 deletions

diff --git a/server/controllers/activitypub/client.ts b/server/controllers/activitypub/client.ts
index d85d0aa5f..71a5b6232 100644
--- a/server/controllers/activitypub/client.ts
+++ b/server/controllers/activitypub/client.ts
@@ -1,8 +1,7 @@
 import * as cors from 'cors'
 import * as express from 'express'
-import { getRateUrl } from '@server/lib/activitypub/video-rates'
 import { getServerActor } from '@server/models/application/application'
-import { MAccountId, MActorId, MChannelId, MVideoId } from '@server/types/models'
+import { MAccountId, MActorId, MChannelId, MVideoId, MVideoUrl } from '@server/types/models'
 import { VideoPrivacy, VideoRateType } from '../../../shared/models/videos'
 import { VideoPlaylistPrivacy } from '../../../shared/models/videos/playlist/video-playlist-privacy.model'
 import { activityPubCollectionPagination, activityPubContextify } from '../../helpers/activitypub'
@@ -12,10 +11,10 @@ import { buildAnnounceWithVideoAudience, buildLikeActivity } from '../../lib/act
 import { buildCreateActivity } from '../../lib/activitypub/send/send-create'
 import { buildDislikeActivity } from '../../lib/activitypub/send/send-dislike'
 import {
-  getVideoCommentsActivityPubUrl,
-  getVideoDislikesActivityPubUrl,
-  getVideoLikesActivityPubUrl,
-  getVideoSharesActivityPubUrl
+  getLocalVideoCommentsActivityPubUrl,
+  getLocalVideoDislikesActivityPubUrl,
+  getLocalVideoLikesActivityPubUrl,
+  getLocalVideoSharesActivityPubUrl
 } from '../../lib/activitypub/url'
 import {
   asyncMiddleware,
@@ -212,10 +211,9 @@ function getAccountVideoRateFactory (rateType: VideoRateType) {
     const accountVideoRate = res.locals.accountVideoRate
 
     const byActor = accountVideoRate.Account.Actor
-    const url = getRateUrl(rateType, byActor, accountVideoRate.Video)
     const APObject = rateType === 'like'
-      ? buildLikeActivity(url, byActor, accountVideoRate.Video)
-      : buildDislikeActivity(url, byActor, accountVideoRate.Video)
+      ? buildLikeActivity(accountVideoRate.url, byActor, accountVideoRate.Video)
+      : buildDislikeActivity(accountVideoRate.url, byActor, accountVideoRate.Video)
 
     return activityPubResponse(activityPubContextify(APObject), res)
   }
@@ -225,7 +223,7 @@ async function videoController (req: express.Request, res: express.Response) {
   // We need more attributes
   const video = await VideoModel.loadAndPopulateAccountAndServerAndTags(res.locals.onlyVideoWithRights.id)
 
-  if (video.url.startsWith(WEBSERVER.URL) === false) return res.redirect(video.url)
+  if (redirectIfNotOwned(video.url, res)) return
 
   // We need captions to render AP object
   const captions = await VideoCaptionModel.listVideoCaptions(video.id)
@@ -245,7 +243,7 @@ async function videoController (req: express.Request, res: express.Response) {
 async function videoAnnounceController (req: express.Request, res: express.Response) {
   const share = res.locals.videoShare
 
-  if (share.url.startsWith(WEBSERVER.URL) === false) return res.redirect(share.url)
+  if (redirectIfNotOwned(share.url, res)) return
 
   const { activity } = await buildAnnounceWithVideoAudience(share.Actor, share, res.locals.videoAll, undefined)
 
@@ -255,6 +253,8 @@ async function videoAnnounceController (req: express.Request, res: express.Respo
 async function videoAnnouncesController (req: express.Request, res: express.Response) {
   const video = res.locals.onlyImmutableVideo
 
+  if (redirectIfNotOwned(video.url, res)) return
+
   const handler = async (start: number, count: number) => {
     const result = await VideoShareModel.listAndCountByVideoId(video.id, start, count)
     return {
@@ -262,21 +262,27 @@ async function videoAnnouncesController (req: express.Request, res: express.Resp
       data: result.rows.map(r => r.url)
     }
   }
-  const json = await activityPubCollectionPagination(getVideoSharesActivityPubUrl(video), handler, req.query.page)
+  const json = await activityPubCollectionPagination(getLocalVideoSharesActivityPubUrl(video), handler, req.query.page)
 
   return activityPubResponse(activityPubContextify(json), res)
 }
 
 async function videoLikesController (req: express.Request, res: express.Response) {
   const video = res.locals.onlyImmutableVideo
-  const json = await videoRates(req, 'like', video, getVideoLikesActivityPubUrl(video))
+
+  if (redirectIfNotOwned(video.url, res)) return
+
+  const json = await videoRates(req, 'like', video, getLocalVideoLikesActivityPubUrl(video))
 
   return activityPubResponse(activityPubContextify(json), res)
 }
 
 async function videoDislikesController (req: express.Request, res: express.Response) {
   const video = res.locals.onlyImmutableVideo
-  const json = await videoRates(req, 'dislike', video, getVideoDislikesActivityPubUrl(video))
+
+  if (redirectIfNotOwned(video.url, res)) return
+
+  const json = await videoRates(req, 'dislike', video, getLocalVideoDislikesActivityPubUrl(video))
 
   return activityPubResponse(activityPubContextify(json), res)
 }
@@ -284,6 +290,8 @@ async function videoDislikesController (req: express.Request, res: express.Respo
 async function videoCommentsController (req: express.Request, res: express.Response) {
   const video = res.locals.onlyImmutableVideo
 
+  if (redirectIfNotOwned(video.url, res)) return
+
   const handler = async (start: number, count: number) => {
     const result = await VideoCommentModel.listAndCountByVideoForAP(video, start, count)
     return {
@@ -291,7 +299,7 @@ async function videoCommentsController (req: express.Request, res: express.Respo
       data: result.rows.map(r => r.url)
     }
   }
-  const json = await activityPubCollectionPagination(getVideoCommentsActivityPubUrl(video), handler, req.query.page)
+  const json = await activityPubCollectionPagination(getLocalVideoCommentsActivityPubUrl(video), handler, req.query.page)
 
   return activityPubResponse(activityPubContextify(json), res)
 }
@@ -319,7 +327,7 @@ async function videoChannelFollowingController (req: express.Request, res: expre
 async function videoCommentController (req: express.Request, res: express.Response) {
   const videoComment = res.locals.videoCommentFull
 
-  if (videoComment.url.startsWith(WEBSERVER.URL) === false) return res.redirect(videoComment.url)
+  if (redirectIfNotOwned(videoComment.url, res)) return
 
   const threadParentComments = await VideoCommentModel.listThreadParentComments(videoComment, undefined)
   const isPublic = true // Comments are always public
@@ -340,7 +348,8 @@ async function videoCommentController (req: express.Request, res: express.Respon
 
 async function videoRedundancyController (req: express.Request, res: express.Response) {
   const videoRedundancy = res.locals.videoRedundancy
-  if (videoRedundancy.url.startsWith(WEBSERVER.URL) === false) return res.redirect(videoRedundancy.url)
+
+  if (redirectIfNotOwned(videoRedundancy.url, res)) return
 
   const serverActor = await getServerActor()
 
@@ -358,6 +367,8 @@ async function videoRedundancyController (req: express.Request, res: express.Res
 async function videoPlaylistController (req: express.Request, res: express.Response) {
   const playlist = res.locals.videoPlaylistFull
 
+  if (redirectIfNotOwned(playlist.url, res)) return
+
   // We need more attributes
   playlist.OwnerAccount = await AccountModel.load(playlist.ownerAccountId)
 
@@ -371,6 +382,8 @@ async function videoPlaylistController (req: express.Request, res: express.Respo
 function videoPlaylistElementController (req: express.Request, res: express.Response) {
   const videoPlaylistElement = res.locals.videoPlaylistElementAP
 
+  if (redirectIfNotOwned(videoPlaylistElement.url, res)) return
+
   const json = videoPlaylistElement.toActivityPubObject()
   return activityPubResponse(activityPubContextify(json), res)
 }
@@ -411,3 +424,12 @@ function videoRates (req: express.Request, rateType: VideoRateType, video: MVide
   }
   return activityPubCollectionPagination(url, handler, req.query.page)
 }
+
+function redirectIfNotOwned (url: string, res: express.Response) {
+  if (url.startsWith(WEBSERVER.URL) === false) {
+    res.redirect(url)
+    return true
+  }
+
+  return false
+}
diff --git a/server/controllers/api/server/follows.ts b/server/controllers/api/server/follows.ts
index 23823c9fb..517d1897e 100644
--- a/server/controllers/api/server/follows.ts
+++ b/server/controllers/api/server/follows.ts
@@ -165,7 +165,7 @@ async function removeFollowing (req: express.Request, res: express.Response) {
 async function removeOrRejectFollower (req: express.Request, res: express.Response) {
   const follow = res.locals.follow
 
-  await sendReject(follow.ActorFollower, follow.ActorFollowing)
+  await sendReject(follow.url, follow.ActorFollower, follow.ActorFollowing)
 
   await follow.destroy()
 
diff --git a/server/controllers/api/video-playlist.ts b/server/controllers/api/video-playlist.ts
index 41a0e07ff..fb08a63b2 100644
--- a/server/controllers/api/video-playlist.ts
+++ b/server/controllers/api/video-playlist.ts
@@ -1,5 +1,24 @@
 import * as express from 'express'
+import { join } from 'path'
+import { getServerActor } from '@server/models/application/application'
+import { MVideoPlaylistFull, MVideoPlaylistThumbnail, MVideoThumbnail } from '@server/types/models'
+import { VideoPlaylistCreate } from '../../../shared/models/videos/playlist/video-playlist-create.model'
+import { VideoPlaylistElementCreate } from '../../../shared/models/videos/playlist/video-playlist-element-create.model'
+import { VideoPlaylistElementUpdate } from '../../../shared/models/videos/playlist/video-playlist-element-update.model'
+import { VideoPlaylistPrivacy } from '../../../shared/models/videos/playlist/video-playlist-privacy.model'
+import { VideoPlaylistReorder } from '../../../shared/models/videos/playlist/video-playlist-reorder.model'
+import { VideoPlaylistUpdate } from '../../../shared/models/videos/playlist/video-playlist-update.model'
+import { resetSequelizeInstance } from '../../helpers/database-utils'
+import { buildNSFWFilter, createReqFiles } from '../../helpers/express-utils'
+import { logger } from '../../helpers/logger'
 import { getFormattedObjects } from '../../helpers/utils'
+import { CONFIG } from '../../initializers/config'
+import { MIMETYPES, VIDEO_PLAYLIST_PRIVACIES } from '../../initializers/constants'
+import { sequelizeTypescript } from '../../initializers/database'
+import { sendCreateVideoPlaylist, sendDeleteVideoPlaylist, sendUpdateVideoPlaylist } from '../../lib/activitypub/send'
+import { getLocalVideoPlaylistActivityPubUrl, getLocalVideoPlaylistElementActivityPubUrl } from '../../lib/activitypub/url'
+import { JobQueue } from '../../lib/job-queue'
+import { createPlaylistMiniatureFromExisting } from '../../lib/thumbnail'
 import {
   asyncMiddleware,
   asyncRetryTransactionMiddleware,
@@ -10,11 +29,6 @@ import {
   setDefaultSort
 } from '../../middlewares'
 import { videoPlaylistsSortValidator } from '../../middlewares/validators'
-import { buildNSFWFilter, createReqFiles } from '../../helpers/express-utils'
-import { MIMETYPES, VIDEO_PLAYLIST_PRIVACIES } from '../../initializers/constants'
-import { logger } from '../../helpers/logger'
-import { resetSequelizeInstance } from '../../helpers/database-utils'
-import { VideoPlaylistModel } from '../../models/video/video-playlist'
 import {
   commonVideoPlaylistFiltersValidator,
   videoPlaylistsAddValidator,
@@ -25,23 +39,9 @@ import {
   videoPlaylistsUpdateOrRemoveVideoValidator,
   videoPlaylistsUpdateValidator
 } from '../../middlewares/validators/videos/video-playlists'
-import { VideoPlaylistCreate } from '../../../shared/models/videos/playlist/video-playlist-create.model'
-import { VideoPlaylistPrivacy } from '../../../shared/models/videos/playlist/video-playlist-privacy.model'
-import { join } from 'path'
-import { sendCreateVideoPlaylist, sendDeleteVideoPlaylist, sendUpdateVideoPlaylist } from '../../lib/activitypub/send'
-import { getVideoPlaylistActivityPubUrl, getVideoPlaylistElementActivityPubUrl } from '../../lib/activitypub/url'
-import { VideoPlaylistUpdate } from '../../../shared/models/videos/playlist/video-playlist-update.model'
-import { VideoPlaylistElementModel } from '../../models/video/video-playlist-element'
-import { VideoPlaylistElementCreate } from '../../../shared/models/videos/playlist/video-playlist-element-create.model'
-import { VideoPlaylistElementUpdate } from '../../../shared/models/videos/playlist/video-playlist-element-update.model'
 import { AccountModel } from '../../models/account/account'
-import { VideoPlaylistReorder } from '../../../shared/models/videos/playlist/video-playlist-reorder.model'
-import { JobQueue } from '../../lib/job-queue'
-import { CONFIG } from '../../initializers/config'
-import { sequelizeTypescript } from '../../initializers/database'
-import { createPlaylistMiniatureFromExisting } from '../../lib/thumbnail'
-import { MVideoPlaylistFull, MVideoPlaylistThumbnail, MVideoThumbnail } from '@server/types/models'
-import { getServerActor } from '@server/models/application/application'
+import { VideoPlaylistModel } from '../../models/video/video-playlist'
+import { VideoPlaylistElementModel } from '../../models/video/video-playlist-element'
 
 const reqThumbnailFile = createReqFiles([ 'thumbnailfile' ], MIMETYPES.IMAGE.MIMETYPE_EXT, { thumbnailfile: CONFIG.STORAGE.TMP_DIR })
 
@@ -161,7 +161,7 @@ async function addVideoPlaylist (req: express.Request, res: express.Response) {
     ownerAccountId: user.Account.id
   }) as MVideoPlaylistFull
 
-  videoPlaylist.url = getVideoPlaylistActivityPubUrl(videoPlaylist) // We use the UUID, so set the URL after building the object
+  videoPlaylist.url = getLocalVideoPlaylistActivityPubUrl(videoPlaylist) // We use the UUID, so set the URL after building the object
 
   if (videoPlaylistInfo.videoChannelId) {
     const videoChannel = res.locals.videoChannel
@@ -304,7 +304,7 @@ async function addVideoInPlaylist (req: express.Request, res: express.Response)
       videoId: video.id
     }, { transaction: t })
 
-    playlistElement.url = getVideoPlaylistElementActivityPubUrl(videoPlaylist, playlistElement)
+    playlistElement.url = getLocalVideoPlaylistElementActivityPubUrl(videoPlaylist, playlistElement)
     await playlistElement.save({ transaction: t })
 
     videoPlaylist.changed('updatedAt', true)
diff --git a/server/controllers/api/videos/import.ts b/server/controllers/api/videos/import.ts
index 5840cd063..bc5fea7aa 100644
--- a/server/controllers/api/videos/import.ts
+++ b/server/controllers/api/videos/import.ts
@@ -28,7 +28,7 @@ import { getYoutubeDLInfo, getYoutubeDLSubs, YoutubeDLInfo } from '../../../help
 import { CONFIG } from '../../../initializers/config'
 import { MIMETYPES } from '../../../initializers/constants'
 import { sequelizeTypescript } from '../../../initializers/database'
-import { getVideoActivityPubUrl } from '../../../lib/activitypub/url'
+import { getLocalVideoActivityPubUrl } from '../../../lib/activitypub/url'
 import { JobQueue } from '../../../lib/job-queue/job-queue'
 import { createVideoMiniatureFromExisting, createVideoMiniatureFromUrl } from '../../../lib/thumbnail'
 import { autoBlacklistVideoIfNeeded } from '../../../lib/video-blacklist'
@@ -250,7 +250,7 @@ function buildVideo (channelId: number, body: VideoImportCreate, importData: You
     originallyPublishedAt: body.originallyPublishedAt || importData.originallyPublishedAt
   }
   const video = new VideoModel(videoData)
-  video.url = getVideoActivityPubUrl(video)
+  video.url = getLocalVideoActivityPubUrl(video)
 
   return video
 }
diff --git a/server/controllers/api/videos/index.ts b/server/controllers/api/videos/index.ts
index bfebc54ed..b5ff2e72e 100644
--- a/server/controllers/api/videos/index.ts
+++ b/server/controllers/api/videos/index.ts
@@ -5,7 +5,7 @@ import toInt from 'validator/lib/toInt'
 import { addOptimizeOrMergeAudioJob } from '@server/helpers/video'
 import { createTorrentAndSetInfoHash } from '@server/helpers/webtorrent'
 import { changeVideoChannelShare } from '@server/lib/activitypub/share'
-import { getVideoActivityPubUrl } from '@server/lib/activitypub/url'
+import { getLocalVideoActivityPubUrl } from '@server/lib/activitypub/url'
 import { LiveManager } from '@server/lib/live-manager'
 import { buildLocalVideoFromReq, buildVideoThumbnailsFromReq, setVideoTags } from '@server/lib/video'
 import { getVideoFilePath } from '@server/lib/video-paths'
@@ -189,7 +189,7 @@ async function addVideo (req: express.Request, res: express.Response) {
   videoData.duration = videoPhysicalFile['duration'] // duration was added by a previous middleware
 
   const video = new VideoModel(videoData) as MVideoFullLight
-  video.url = getVideoActivityPubUrl(video) // We use the UUID, so set the URL after building the object
+  video.url = getLocalVideoActivityPubUrl(video) // We use the UUID, so set the URL after building the object
 
   const videoFile = new VideoFileModel({
     extname: extname(videoPhysicalFile.filename),
diff --git a/server/controllers/api/videos/live.ts b/server/controllers/api/videos/live.ts
index d438b6f3a..a6f00c1bd 100644
--- a/server/controllers/api/videos/live.ts
+++ b/server/controllers/api/videos/live.ts
@@ -3,7 +3,7 @@ import { v4 as uuidv4 } from 'uuid'
 import { createReqFiles } from '@server/helpers/express-utils'
 import { CONFIG } from '@server/initializers/config'
 import { ASSETS_PATH, MIMETYPES } from '@server/initializers/constants'
-import { getVideoActivityPubUrl } from '@server/lib/activitypub/url'
+import { getLocalVideoActivityPubUrl } from '@server/lib/activitypub/url'
 import { federateVideoIfNeeded } from '@server/lib/activitypub/videos'
 import { Hooks } from '@server/lib/plugins/hooks'
 import { buildLocalVideoFromReq, buildVideoThumbnailsFromReq, setVideoTags } from '@server/lib/video'
@@ -86,7 +86,7 @@ async function addLiveVideo (req: express.Request, res: express.Response) {
   videoData.duration = 0
 
   const video = new VideoModel(videoData) as MVideoDetails
-  video.url = getVideoActivityPubUrl(video) // We use the UUID, so set the URL after building the object
+  video.url = getLocalVideoActivityPubUrl(video) // We use the UUID, so set the URL after building the object
 
   const videoLive = new VideoLiveModel()
   videoLive.saveReplay = videoInfo.saveReplay || false
diff --git a/server/controllers/api/videos/rate.ts b/server/controllers/api/videos/rate.ts
index 3ee365289..df1eddb4f 100644
--- a/server/controllers/api/videos/rate.ts
+++ b/server/controllers/api/videos/rate.ts
@@ -2,7 +2,7 @@ import * as express from 'express'
 import { UserVideoRateUpdate } from '../../../../shared'
 import { logger } from '../../../helpers/logger'
 import { VIDEO_RATE_TYPES } from '../../../initializers/constants'
-import { getRateUrl, sendVideoRateChange } from '../../../lib/activitypub/video-rates'
+import { getLocalRateUrl, sendVideoRateChange } from '../../../lib/activitypub/video-rates'
 import { asyncMiddleware, asyncRetryTransactionMiddleware, authenticate, videoUpdateRateValidator } from '../../../middlewares'
 import { AccountModel } from '../../../models/account/account'
 import { AccountVideoRateModel } from '../../../models/account/account-video-rate'
@@ -52,7 +52,7 @@ async function rateVideo (req: express.Request, res: express.Response) {
         await previousRate.destroy(sequelizeOptions)
       } else { // Update previous rate
         previousRate.type = rateType
-        previousRate.url = getRateUrl(rateType, userAccount.Actor, videoInstance)
+        previousRate.url = getLocalRateUrl(rateType, userAccount.Actor, videoInstance)
         await previousRate.save(sequelizeOptions)
       }
     } else if (rateType !== 'none') { // There was not a previous rate, insert a new one if there is a rate
@@ -60,7 +60,7 @@ async function rateVideo (req: express.Request, res: express.Response) {
         accountId: accountInstance.id,
         videoId: videoInstance.id,
         type: rateType,
-        url: getRateUrl(rateType, userAccount.Actor, videoInstance)
+        url: getLocalRateUrl(rateType, userAccount.Actor, videoInstance)
       }
 
       await AccountVideoRateModel.create(query, sequelizeOptions)