From 9ab330b90decf4edf152ff8e1d2948c065766b2c Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Wed, 19 Oct 2022 10:43:53 +0200 Subject: Use private ACL for private videos in s3 --- server/models/video/video-file.ts | 62 +++++++++++++++++++------ server/models/video/video-streaming-playlist.ts | 28 +++++++++-- server/models/video/video.ts | 34 +++++++++++--- 3 files changed, 102 insertions(+), 22 deletions(-) (limited to 'server/models') diff --git a/server/models/video/video-file.ts b/server/models/video/video-file.ts index 1a608932f..c20c90c1b 100644 --- a/server/models/video/video-file.ts +++ b/server/models/video/video-file.ts @@ -22,7 +22,12 @@ import validator from 'validator' import { logger } from '@server/helpers/logger' import { extractVideo } from '@server/helpers/video' import { buildRemoteVideoBaseUrl } from '@server/lib/activitypub/url' -import { getHLSPublicFileUrl, getWebTorrentPublicFileUrl } from '@server/lib/object-storage' +import { + getHLSPrivateFileUrl, + getHLSPublicFileUrl, + getWebTorrentPrivateFileUrl, + getWebTorrentPublicFileUrl +} from '@server/lib/object-storage' import { getFSTorrentFilePath } from '@server/lib/paths' import { isVideoInPrivateDirectory } from '@server/lib/video-privacy' import { isStreamingPlaylist, MStreamingPlaylistVideo, MVideo, MVideoWithHost } from '@server/types/models' @@ -503,7 +508,25 @@ export class VideoFileModel extends Model return !!this.videoStreamingPlaylistId } - getObjectStorageUrl () { + // --------------------------------------------------------------------------- + + getObjectStorageUrl (video: MVideo) { + if (video.hasPrivateStaticPath()) { + return this.getPrivateObjectStorageUrl(video) + } + + return this.getPublicObjectStorageUrl() + } + + private getPrivateObjectStorageUrl (video: MVideo) { + if (this.isHLS()) { + return getHLSPrivateFileUrl(video, this.filename) + } + + return getWebTorrentPrivateFileUrl(this.filename) + } + + private getPublicObjectStorageUrl () { if (this.isHLS()) { return getHLSPublicFileUrl(this.fileUrl) } @@ -511,26 +534,29 @@ export class VideoFileModel extends Model return getWebTorrentPublicFileUrl(this.fileUrl) } + // --------------------------------------------------------------------------- + getFileUrl (video: MVideo) { - if (this.storage === VideoStorage.OBJECT_STORAGE) { - return this.getObjectStorageUrl() - } + if (video.isOwned()) { + if (this.storage === VideoStorage.OBJECT_STORAGE) { + return this.getObjectStorageUrl(video) + } - if (!this.Video) this.Video = video as VideoModel - if (video.isOwned()) return WEBSERVER.URL + this.getFileStaticPath(video) + return WEBSERVER.URL + this.getFileStaticPath(video) + } return this.fileUrl } + // --------------------------------------------------------------------------- + getFileStaticPath (video: MVideo) { - if (this.isHLS()) { - if (isVideoInPrivateDirectory(video.privacy)) { - return join(STATIC_PATHS.STREAMING_PLAYLISTS.PRIVATE_HLS, video.uuid, this.filename) - } + if (this.isHLS()) return this.getHLSFileStaticPath(video) - return join(STATIC_PATHS.STREAMING_PLAYLISTS.HLS, video.uuid, this.filename) - } + return this.getWebTorrentFileStaticPath(video) + } + private getWebTorrentFileStaticPath (video: MVideo) { if (isVideoInPrivateDirectory(video.privacy)) { return join(STATIC_PATHS.PRIVATE_WEBSEED, this.filename) } @@ -538,6 +564,16 @@ export class VideoFileModel extends Model return join(STATIC_PATHS.WEBSEED, this.filename) } + private getHLSFileStaticPath (video: MVideo) { + if (isVideoInPrivateDirectory(video.privacy)) { + return join(STATIC_PATHS.STREAMING_PLAYLISTS.PRIVATE_HLS, video.uuid, this.filename) + } + + return join(STATIC_PATHS.STREAMING_PLAYLISTS.HLS, video.uuid, this.filename) + } + + // --------------------------------------------------------------------------- + getFileDownloadUrl (video: MVideoWithHost) { const path = this.isHLS() ? join(STATIC_DOWNLOAD_PATHS.HLS_VIDEOS, `${video.uuid}-${this.resolution}-fragmented${this.extname}`) diff --git a/server/models/video/video-streaming-playlist.ts b/server/models/video/video-streaming-playlist.ts index b919046ed..1318a4dae 100644 --- a/server/models/video/video-streaming-playlist.ts +++ b/server/models/video/video-streaming-playlist.ts @@ -15,7 +15,7 @@ import { Table, UpdatedAt } from 'sequelize-typescript' -import { getHLSPublicFileUrl } from '@server/lib/object-storage' +import { getHLSPrivateFileUrl, getHLSPublicFileUrl } from '@server/lib/object-storage' import { generateHLSMasterPlaylistFilename, generateHlsSha256SegmentsFilename } from '@server/lib/paths' import { isVideoInPrivateDirectory } from '@server/lib/video-privacy' import { VideoFileModel } from '@server/models/video/video-file' @@ -245,10 +245,12 @@ export class VideoStreamingPlaylistModel extends Model>> { const playlist = this.VideoStreamingPlaylists.find(p => p.type === VideoStreamingPlaylistType.HLS) if (!playlist) return undefined - playlist.Video = this - - return playlist + return playlist.withVideo(this) } setHLSPlaylist (playlist: MStreamingPlaylist) { @@ -1868,16 +1867,39 @@ export class VideoModel extends Model>> { return setAsUpdated('video', this.id, transaction) } - requiresAuth (paramId: string) { + // --------------------------------------------------------------------------- + + requiresAuth (options: { + urlParamId: string + checkBlacklist: boolean + }) { + const { urlParamId, checkBlacklist } = options + + if (this.privacy === VideoPrivacy.PRIVATE || this.privacy === VideoPrivacy.INTERNAL) { + return true + } + if (this.privacy === VideoPrivacy.UNLISTED) { - if (!isUUIDValid(paramId)) return true + if (urlParamId && !isUUIDValid(urlParamId)) return true return false } - return this.privacy === VideoPrivacy.PRIVATE || this.privacy === VideoPrivacy.INTERNAL || !!this.VideoBlacklist + if (checkBlacklist && this.VideoBlacklist) return true + + if (this.privacy !== VideoPrivacy.PUBLIC) { + throw new Error(`Unknown video privacy ${this.privacy} to know if the video requires auth`) + } + + return false } + hasPrivateStaticPath () { + return isVideoInPrivateDirectory(this.privacy) + } + + // --------------------------------------------------------------------------- + async setNewState (newState: VideoState, isNewVideo: boolean, transaction: Transaction) { if (this.state === newState) throw new Error('Cannot use same state ' + newState) -- cgit v1.2.3