peertube/server/middlewares/validators/video-channels.ts

import { body, param } from 'express-validator/check'
import * as express from 'express'

import { checkErrors } from './utils'
import { database as db } from '../../initializers'
import {
  logger,
  isIdOrUUIDValid,
  isVideoChannelDescriptionValid,
  isVideoChannelNameValid,
  checkVideoChannelExists,
  checkVideoAuthorExists
} from '../../helpers'
import { UserInstance } from '../../models'
import { UserRight } from '../../../shared'

const listVideoAuthorChannelsValidator = [
  param('authorId').custom(isIdOrUUIDValid).withMessage('Should have a valid author id'),

  (req: express.Request, res: express.Response, next: express.NextFunction) => {
    logger.debug('Checking listVideoAuthorChannelsValidator parameters', { parameters: req.body })

    checkErrors(req, res, () => {
      checkVideoAuthorExists(req.params.authorId, res, next)
    })
  }
]

const videoChannelsAddValidator = [
  body('name').custom(isVideoChannelNameValid).withMessage('Should have a valid name'),
  body('description').custom(isVideoChannelDescriptionValid).withMessage('Should have a valid description'),

  (req: express.Request, res: express.Response, next: express.NextFunction) => {
    logger.debug('Checking videoChannelsAdd parameters', { parameters: req.body })

    checkErrors(req, res, next)
  }
]

const videoChannelsUpdateValidator = [
  param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
  body('name').optional().custom(isVideoChannelNameValid).withMessage('Should have a valid name'),
  body('description').optional().custom(isVideoChannelDescriptionValid).withMessage('Should have a valid description'),

  (req: express.Request, res: express.Response, next: express.NextFunction) => {
    logger.debug('Checking videoChannelsUpdate parameters', { parameters: req.body })

    checkErrors(req, res, () => {
      checkVideoChannelExists(req.params.id, res, () => {
        // We need to make additional checks
        if (res.locals.videoChannel.isOwned() === false) {
          return res.status(403)
            .json({ error: 'Cannot update video channel of another pod' })
            .end()
        }

        if (res.locals.videoChannel.Author.userId !== res.locals.oauth.token.User.id) {
          return res.status(403)
            .json({ error: 'Cannot update video channel of another user' })
            .end()
        }

        next()
      })
    })
  }
]

const videoChannelsRemoveValidator = [
  param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),

  (req: express.Request, res: express.Response, next: express.NextFunction) => {
    logger.debug('Checking videoChannelsRemove parameters', { parameters: req.params })

    checkErrors(req, res, () => {
      checkVideoChannelExists(req.params.id, res, () => {
        // Check if the user who did the request is able to delete the video
        checkUserCanDeleteVideoChannel(res, () => {
          checkVideoChannelIsNotTheLastOne(res, next)
        })
      })
    })
  }
]

const videoChannelGetValidator = [
  param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),

  (req: express.Request, res: express.Response, next: express.NextFunction) => {
    logger.debug('Checking videoChannelsGet parameters', { parameters: req.params })

    checkErrors(req, res, () => {
      checkVideoChannelExists(req.params.id, res, next)
    })
  }
]

// ---------------------------------------------------------------------------

export {
  listVideoAuthorChannelsValidator,
  videoChannelsAddValidator,
  videoChannelsUpdateValidator,
  videoChannelsRemoveValidator,
  videoChannelGetValidator
}

// ---------------------------------------------------------------------------

function checkUserCanDeleteVideoChannel (res: express.Response, callback: () => void) {
  const user: UserInstance = res.locals.oauth.token.User

  // Retrieve the user who did the request
  if (res.locals.videoChannel.isOwned() === false) {
    return res.status(403)
              .json({ error: 'Cannot remove video channel of another pod.' })
              .end()
  }

  // Check if the user can delete the video channel
  // The user can delete it if s/he is an admin
  // Or if s/he is the video channel's author
  if (user.hasRight(UserRight.REMOVE_ANY_VIDEO_CHANNEL) === false && res.locals.videoChannel.Author.userId !== user.id) {
    return res.status(403)
              .json({ error: 'Cannot remove video channel of another user' })
              .end()
  }

  // If we reach this comment, we can delete the video
  callback()
}

function checkVideoChannelIsNotTheLastOne (res: express.Response, callback: () => void) {
  db.VideoChannel.countByAuthor(res.locals.oauth.token.User.Author.id)
    .then(count => {
      if (count <= 1) {
        return res.status(409)
          .json({ error: 'Cannot remove the last channel of this user' })
          .end()
      }

      callback()
    })
}