diff options
Diffstat (limited to 'server/middlewares/validators/video-channels.ts')
-rw-r--r-- | server/middlewares/validators/video-channels.ts | 129 |
1 files changed, 67 insertions, 62 deletions
diff --git a/server/middlewares/validators/video-channels.ts b/server/middlewares/validators/video-channels.ts index f30fbf0dc..4683c91e1 100644 --- a/server/middlewares/validators/video-channels.ts +++ b/server/middlewares/validators/video-channels.ts | |||
@@ -1,29 +1,30 @@ | |||
1 | import * as express from 'express' | 1 | import * as express from 'express' |
2 | import { body, param } from 'express-validator/check' | 2 | import { body, param } from 'express-validator/check' |
3 | import { UserRight } from '../../../shared' | 3 | import { UserRight } from '../../../shared' |
4 | import { checkAccountIdExists } from '../../helpers/custom-validators/accounts' | ||
5 | import { isIdValid } from '../../helpers/custom-validators/misc' | 4 | import { isIdValid } from '../../helpers/custom-validators/misc' |
6 | import { | 5 | import { |
7 | checkVideoChannelExists, | ||
8 | isVideoChannelDescriptionValid, | 6 | isVideoChannelDescriptionValid, |
9 | isVideoChannelExistsPromise, | 7 | isVideoChannelExist, |
10 | isVideoChannelNameValid | 8 | isVideoChannelNameValid |
11 | } from '../../helpers/custom-validators/video-channels' | 9 | } from '../../helpers/custom-validators/video-channels' |
12 | import { isIdOrUUIDValid } from '../../helpers/index' | 10 | import { isIdOrUUIDValid } from '../../helpers/index' |
13 | import { logger } from '../../helpers/logger' | 11 | import { logger } from '../../helpers/logger' |
14 | import { database as db } from '../../initializers' | 12 | import { database as db } from '../../initializers' |
15 | import { UserInstance } from '../../models' | 13 | import { UserInstance } from '../../models' |
16 | import { areValidationErrors, checkErrors } from './utils' | 14 | import { areValidationErrors } from './utils' |
15 | import { isAccountIdExist } from '../../helpers/custom-validators/accounts' | ||
16 | import { VideoChannelInstance } from '../../models/video/video-channel-interface' | ||
17 | 17 | ||
18 | const listVideoAccountChannelsValidator = [ | 18 | const listVideoAccountChannelsValidator = [ |
19 | param('accountId').custom(isIdOrUUIDValid).withMessage('Should have a valid account id'), | 19 | param('accountId').custom(isIdOrUUIDValid).withMessage('Should have a valid account id'), |
20 | 20 | ||
21 | (req: express.Request, res: express.Response, next: express.NextFunction) => { | 21 | async (req: express.Request, res: express.Response, next: express.NextFunction) => { |
22 | logger.debug('Checking listVideoAccountChannelsValidator parameters', { parameters: req.body }) | 22 | logger.debug('Checking listVideoAccountChannelsValidator parameters', { parameters: req.body }) |
23 | 23 | ||
24 | checkErrors(req, res, () => { | 24 | if (areValidationErrors(req, res)) return |
25 | checkAccountIdExists(req.params.accountId, res, next) | 25 | if (!await isAccountIdExist(req.params.accountId, res)) return |
26 | }) | 26 | |
27 | return next() | ||
27 | } | 28 | } |
28 | ] | 29 | ] |
29 | 30 | ||
@@ -34,7 +35,9 @@ const videoChannelsAddValidator = [ | |||
34 | (req: express.Request, res: express.Response, next: express.NextFunction) => { | 35 | (req: express.Request, res: express.Response, next: express.NextFunction) => { |
35 | logger.debug('Checking videoChannelsAdd parameters', { parameters: req.body }) | 36 | logger.debug('Checking videoChannelsAdd parameters', { parameters: req.body }) |
36 | 37 | ||
37 | checkErrors(req, res, next) | 38 | if (areValidationErrors(req, res)) return |
39 | |||
40 | return next() | ||
38 | } | 41 | } |
39 | ] | 42 | ] |
40 | 43 | ||
@@ -43,56 +46,56 @@ const videoChannelsUpdateValidator = [ | |||
43 | body('name').optional().custom(isVideoChannelNameValid).withMessage('Should have a valid name'), | 46 | body('name').optional().custom(isVideoChannelNameValid).withMessage('Should have a valid name'), |
44 | body('description').optional().custom(isVideoChannelDescriptionValid).withMessage('Should have a valid description'), | 47 | body('description').optional().custom(isVideoChannelDescriptionValid).withMessage('Should have a valid description'), |
45 | 48 | ||
46 | (req: express.Request, res: express.Response, next: express.NextFunction) => { | 49 | async (req: express.Request, res: express.Response, next: express.NextFunction) => { |
47 | logger.debug('Checking videoChannelsUpdate parameters', { parameters: req.body }) | 50 | logger.debug('Checking videoChannelsUpdate parameters', { parameters: req.body }) |
48 | 51 | ||
49 | checkErrors(req, res, () => { | 52 | if (areValidationErrors(req, res)) return |
50 | checkVideoChannelExists(req.params.id, res, () => { | 53 | if (!await isVideoChannelExist(req.params.id, res)) return |
51 | // We need to make additional checks | 54 | |
52 | if (res.locals.videoChannel.isOwned() === false) { | 55 | // We need to make additional checks |
53 | return res.status(403) | 56 | if (res.locals.videoChannel.isOwned() === false) { |
54 | .json({ error: 'Cannot update video channel of another server' }) | 57 | return res.status(403) |
55 | .end() | 58 | .json({ error: 'Cannot update video channel of another server' }) |
56 | } | 59 | .end() |
57 | 60 | } | |
58 | if (res.locals.videoChannel.Account.userId !== res.locals.oauth.token.User.id) { | 61 | |
59 | return res.status(403) | 62 | if (res.locals.videoChannel.Account.userId !== res.locals.oauth.token.User.id) { |
60 | .json({ error: 'Cannot update video channel of another user' }) | 63 | return res.status(403) |
61 | .end() | 64 | .json({ error: 'Cannot update video channel of another user' }) |
62 | } | 65 | .end() |
63 | 66 | } | |
64 | next() | 67 | |
65 | }) | 68 | return next() |
66 | }) | ||
67 | } | 69 | } |
68 | ] | 70 | ] |
69 | 71 | ||
70 | const videoChannelsRemoveValidator = [ | 72 | const videoChannelsRemoveValidator = [ |
71 | param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'), | 73 | param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'), |
72 | 74 | ||
73 | (req: express.Request, res: express.Response, next: express.NextFunction) => { | 75 | async (req: express.Request, res: express.Response, next: express.NextFunction) => { |
74 | logger.debug('Checking videoChannelsRemove parameters', { parameters: req.params }) | 76 | logger.debug('Checking videoChannelsRemove parameters', { parameters: req.params }) |
75 | 77 | ||
76 | checkErrors(req, res, () => { | 78 | if (areValidationErrors(req, res)) return |
77 | checkVideoChannelExists(req.params.id, res, () => { | 79 | if (!await isVideoChannelExist(req.params.id, res)) return |
78 | // Check if the user who did the request is able to delete the video | 80 | |
79 | checkUserCanDeleteVideoChannel(res, () => { | 81 | // Check if the user who did the request is able to delete the video |
80 | checkVideoChannelIsNotTheLastOne(res, next) | 82 | if (!checkUserCanDeleteVideoChannel(res.locals.user, res.locals.videoChannel, res)) return |
81 | }) | 83 | if (!await checkVideoChannelIsNotTheLastOne(res)) return |
82 | }) | 84 | |
83 | }) | 85 | return next() |
84 | } | 86 | } |
85 | ] | 87 | ] |
86 | 88 | ||
87 | const videoChannelsGetValidator = [ | 89 | const videoChannelsGetValidator = [ |
88 | param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'), | 90 | param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'), |
89 | 91 | ||
90 | (req: express.Request, res: express.Response, next: express.NextFunction) => { | 92 | async (req: express.Request, res: express.Response, next: express.NextFunction) => { |
91 | logger.debug('Checking videoChannelsGet parameters', { parameters: req.params }) | 93 | logger.debug('Checking videoChannelsGet parameters', { parameters: req.params }) |
92 | 94 | ||
93 | checkErrors(req, res, () => { | 95 | if (areValidationErrors(req, res)) return |
94 | checkVideoChannelExists(req.params.id, res, next) | 96 | if (!await isVideoChannelExist(req.params.id, res)) return |
95 | }) | 97 | |
98 | return next() | ||
96 | } | 99 | } |
97 | ] | 100 | ] |
98 | 101 | ||
@@ -104,7 +107,7 @@ const videoChannelsShareValidator = [ | |||
104 | logger.debug('Checking videoChannelShare parameters', { parameters: req.params }) | 107 | logger.debug('Checking videoChannelShare parameters', { parameters: req.params }) |
105 | 108 | ||
106 | if (areValidationErrors(req, res)) return | 109 | if (areValidationErrors(req, res)) return |
107 | if (!await isVideoChannelExistsPromise(req.params.id, res)) return | 110 | if (!await isVideoChannelExist(req.params.id, res)) return |
108 | 111 | ||
109 | const share = await db.VideoChannelShare.load(res.locals.video.id, req.params.accountId) | 112 | const share = await db.VideoChannelShare.load(res.locals.video.id, req.params.accountId) |
110 | if (!share) { | 113 | if (!share) { |
@@ -131,38 +134,40 @@ export { | |||
131 | 134 | ||
132 | // --------------------------------------------------------------------------- | 135 | // --------------------------------------------------------------------------- |
133 | 136 | ||
134 | function checkUserCanDeleteVideoChannel (res: express.Response, callback: () => void) { | 137 | function checkUserCanDeleteVideoChannel (user: UserInstance, videoChannel: VideoChannelInstance, res: express.Response) { |
135 | const user: UserInstance = res.locals.oauth.token.User | ||
136 | |||
137 | // Retrieve the user who did the request | 138 | // Retrieve the user who did the request |
138 | if (res.locals.videoChannel.isOwned() === false) { | 139 | if (videoChannel.isOwned() === false) { |
139 | return res.status(403) | 140 | res.status(403) |
140 | .json({ error: 'Cannot remove video channel of another server.' }) | 141 | .json({ error: 'Cannot remove video channel of another server.' }) |
141 | .end() | 142 | .end() |
143 | |||
144 | return false | ||
142 | } | 145 | } |
143 | 146 | ||
144 | // Check if the user can delete the video channel | 147 | // Check if the user can delete the video channel |
145 | // The user can delete it if s/he is an admin | 148 | // The user can delete it if s/he is an admin |
146 | // Or if s/he is the video channel's account | 149 | // Or if s/he is the video channel's account |
147 | if (user.hasRight(UserRight.REMOVE_ANY_VIDEO_CHANNEL) === false && res.locals.videoChannel.Account.userId !== user.id) { | 150 | if (user.hasRight(UserRight.REMOVE_ANY_VIDEO_CHANNEL) === false && videoChannel.Account.userId !== user.id) { |
148 | return res.status(403) | 151 | res.status(403) |
149 | .json({ error: 'Cannot remove video channel of another user' }) | 152 | .json({ error: 'Cannot remove video channel of another user' }) |
150 | .end() | 153 | .end() |
154 | |||
155 | return false | ||
151 | } | 156 | } |
152 | 157 | ||
153 | // If we reach this comment, we can delete the video | 158 | return true |
154 | callback() | ||
155 | } | 159 | } |
156 | 160 | ||
157 | function checkVideoChannelIsNotTheLastOne (res: express.Response, callback: () => void) { | 161 | async function checkVideoChannelIsNotTheLastOne (res: express.Response) { |
158 | db.VideoChannel.countByAccount(res.locals.oauth.token.User.Account.id) | 162 | const count = await db.VideoChannel.countByAccount(res.locals.oauth.token.User.Account.id) |
159 | .then(count => { | 163 | |
160 | if (count <= 1) { | 164 | if (count <= 1) { |
161 | return res.status(409) | 165 | res.status(409) |
162 | .json({ error: 'Cannot remove the last channel of this user' }) | 166 | .json({ error: 'Cannot remove the last channel of this user' }) |
163 | .end() | 167 | .end() |
164 | } | 168 | |
165 | 169 | return false | |
166 | callback() | 170 | } |
167 | }) | 171 | |
172 | return true | ||
168 | } | 173 | } |