PeerTube/server/core/controllers/api/abuse.ts

271 lines
7.8 KiB
TypeScript
Raw Normal View History

2021-08-27 07:32:44 -05:00
import express from 'express'
import { logger } from '@server/helpers/logger.js'
import { createAccountAbuse, createVideoAbuse, createVideoCommentAbuse } from '@server/lib/moderation.js'
import { Notifier } from '@server/lib/notifier/index.js'
import { AbuseMessageModel } from '@server/models/abuse/abuse-message.js'
import { AbuseModel } from '@server/models/abuse/abuse.js'
import { getServerActor } from '@server/models/application/application.js'
import { abusePredefinedReasonsMap } from '@peertube/peertube-core-utils'
import { AbuseCreate, AbuseState, HttpStatusCode, UserRight } from '@peertube/peertube-models'
import { getFormattedObjects } from '../../helpers/utils.js'
import { sequelizeTypescript } from '../../initializers/database.js'
2020-07-01 09:05:30 -05:00
import {
abuseGetValidator,
2020-07-24 08:05:51 -05:00
abuseListForAdminsValidator,
2020-07-01 09:05:30 -05:00
abuseReportValidator,
abusesSortValidator,
abuseUpdateValidator,
2020-07-24 08:05:51 -05:00
addAbuseMessageValidator,
2023-06-20 07:17:34 -05:00
apiRateLimiter,
2020-07-01 09:05:30 -05:00
asyncMiddleware,
asyncRetryTransactionMiddleware,
authenticate,
checkAbuseValidForMessagesValidator,
2020-07-24 08:05:51 -05:00
deleteAbuseMessageValidator,
2020-07-01 09:05:30 -05:00
ensureUserHasRight,
2020-07-24 08:05:51 -05:00
getAbuseValidator,
openapiOperationDoc,
2020-07-01 09:05:30 -05:00
paginationValidator,
setDefaultPagination,
setDefaultSort
} from '../../middlewares/index.js'
import { AccountModel } from '../../models/account/account.js'
2020-07-01 09:05:30 -05:00
const abuseRouter = express.Router()
2023-06-20 07:17:34 -05:00
abuseRouter.use(apiRateLimiter)
2020-07-07 03:57:04 -05:00
abuseRouter.get('/',
openapiOperationDoc({ operationId: 'getAbuses' }),
2020-07-01 09:05:30 -05:00
authenticate,
ensureUserHasRight(UserRight.MANAGE_ABUSES),
paginationValidator,
abusesSortValidator,
setDefaultSort,
setDefaultPagination,
2020-07-24 08:05:51 -05:00
abuseListForAdminsValidator,
asyncMiddleware(listAbusesForAdmins)
2020-07-01 09:05:30 -05:00
)
2020-07-07 03:57:04 -05:00
abuseRouter.put('/:id',
2020-07-01 09:05:30 -05:00
authenticate,
ensureUserHasRight(UserRight.MANAGE_ABUSES),
asyncMiddleware(abuseUpdateValidator),
asyncRetryTransactionMiddleware(updateAbuse)
)
2020-07-07 03:57:04 -05:00
abuseRouter.post('/',
2020-07-01 09:05:30 -05:00
authenticate,
asyncMiddleware(abuseReportValidator),
asyncRetryTransactionMiddleware(reportAbuse)
)
2020-07-07 03:57:04 -05:00
abuseRouter.delete('/:id',
2020-07-01 09:05:30 -05:00
authenticate,
ensureUserHasRight(UserRight.MANAGE_ABUSES),
asyncMiddleware(abuseGetValidator),
asyncRetryTransactionMiddleware(deleteAbuse)
)
2020-07-24 08:05:51 -05:00
abuseRouter.get('/:id/messages',
authenticate,
asyncMiddleware(getAbuseValidator),
checkAbuseValidForMessagesValidator,
2020-07-24 08:05:51 -05:00
asyncRetryTransactionMiddleware(listAbuseMessages)
)
abuseRouter.post('/:id/messages',
authenticate,
asyncMiddleware(getAbuseValidator),
checkAbuseValidForMessagesValidator,
2020-07-24 08:05:51 -05:00
addAbuseMessageValidator,
asyncRetryTransactionMiddleware(addAbuseMessage)
)
abuseRouter.delete('/:id/messages/:messageId',
authenticate,
asyncMiddleware(getAbuseValidator),
checkAbuseValidForMessagesValidator,
2020-07-24 08:05:51 -05:00
asyncMiddleware(deleteAbuseMessageValidator),
asyncRetryTransactionMiddleware(deleteAbuseMessage)
)
2020-07-01 09:05:30 -05:00
// ---------------------------------------------------------------------------
export {
2020-11-10 07:41:20 -06:00
abuseRouter
2020-07-01 09:05:30 -05:00
}
// ---------------------------------------------------------------------------
2020-07-24 08:05:51 -05:00
async function listAbusesForAdmins (req: express.Request, res: express.Response) {
2020-07-01 09:05:30 -05:00
const user = res.locals.oauth.token.user
const serverActor = await getServerActor()
2020-07-24 08:05:51 -05:00
const resultList = await AbuseModel.listForAdminApi({
2020-07-01 09:05:30 -05:00
start: req.query.start,
count: req.query.count,
sort: req.query.sort,
id: req.query.id,
2020-07-07 03:57:04 -05:00
filter: req.query.filter,
2020-07-01 09:05:30 -05:00
predefinedReason: req.query.predefinedReason,
search: req.query.search,
state: req.query.state,
videoIs: req.query.videoIs,
searchReporter: req.query.searchReporter,
searchReportee: req.query.searchReportee,
searchVideo: req.query.searchVideo,
searchVideoChannel: req.query.searchVideoChannel,
serverAccountId: serverActor.Account.id,
user
})
2020-07-24 08:05:51 -05:00
return res.json({
total: resultList.total,
data: resultList.data.map(d => d.toFormattedAdminJSON())
})
2020-07-01 09:05:30 -05:00
}
async function updateAbuse (req: express.Request, res: express.Response) {
const abuse = res.locals.abuse
let stateUpdated = false
2020-07-01 09:05:30 -05:00
if (req.body.moderationComment !== undefined) abuse.moderationComment = req.body.moderationComment
if (req.body.state !== undefined) {
abuse.state = req.body.state
// We consider the abuse has been processed when its state change
if (!abuse.processedAt) abuse.processedAt = new Date()
stateUpdated = true
}
2020-07-01 09:05:30 -05:00
await sequelizeTypescript.transaction(t => {
return abuse.save({ transaction: t })
})
if (stateUpdated === true) {
AbuseModel.loadFull(abuse.id)
.then(abuseFull => Notifier.Instance.notifyOnAbuseStateChange(abuseFull))
.catch(err => logger.error('Cannot notify on abuse state change', { err }))
}
2020-07-24 08:05:51 -05:00
2020-07-08 08:51:46 -05:00
// Do not send the delete to other instances, we updated OUR copy of this abuse
2020-07-01 09:05:30 -05:00
return res.status(HttpStatusCode.NO_CONTENT_204).end()
2020-07-01 09:05:30 -05:00
}
async function deleteAbuse (req: express.Request, res: express.Response) {
const abuse = res.locals.abuse
await sequelizeTypescript.transaction(t => {
return abuse.destroy({ transaction: t })
})
2020-07-08 08:51:46 -05:00
// Do not send the delete to other instances, we delete OUR copy of this abuse
2020-07-01 09:05:30 -05:00
return res.status(HttpStatusCode.NO_CONTENT_204).end()
2020-07-01 09:05:30 -05:00
}
async function reportAbuse (req: express.Request, res: express.Response) {
const videoInstance = res.locals.videoAll
const commentInstance = res.locals.videoCommentFull
const accountInstance = res.locals.account
const body: AbuseCreate = req.body
const { id } = await sequelizeTypescript.transaction(async t => {
2021-12-09 07:27:32 -06:00
const user = res.locals.oauth.token.User
// Don't send abuse notification if reporter is an admin/moderator
const skipNotification = user.hasRight(UserRight.MANAGE_ABUSES)
const reporterAccount = await AccountModel.load(user.Account.id, t)
2020-07-01 09:05:30 -05:00
const predefinedReasons = body.predefinedReasons?.map(r => abusePredefinedReasonsMap[r])
const baseAbuse = {
reporterAccountId: reporterAccount.id,
reason: body.reason,
state: AbuseState.PENDING,
predefinedReasons
}
if (body.video) {
return createVideoAbuse({
baseAbuse,
videoInstance,
reporterAccount,
transaction: t,
startAt: body.video.startAt,
2021-12-09 07:27:32 -06:00
endAt: body.video.endAt,
skipNotification
2020-07-01 09:05:30 -05:00
})
}
if (body.comment) {
return createVideoCommentAbuse({
baseAbuse,
commentInstance,
reporterAccount,
2021-12-09 07:27:32 -06:00
transaction: t,
skipNotification
2020-07-01 09:05:30 -05:00
})
}
// Account report
return createAccountAbuse({
baseAbuse,
accountInstance,
reporterAccount,
2021-12-09 07:27:32 -06:00
transaction: t,
skipNotification
2020-07-01 09:05:30 -05:00
})
})
return res.json({ abuse: { id } })
}
2020-07-24 08:05:51 -05:00
async function listAbuseMessages (req: express.Request, res: express.Response) {
const abuse = res.locals.abuse
const resultList = await AbuseMessageModel.listForApi(abuse.id)
return res.json(getFormattedObjects(resultList.data, resultList.total))
}
async function addAbuseMessage (req: express.Request, res: express.Response) {
const abuse = res.locals.abuse
const user = res.locals.oauth.token.user
const byModerator = abuse.reporterAccountId !== user.Account.id
2020-07-24 08:05:51 -05:00
const abuseMessage = await AbuseMessageModel.create({
message: req.body.message,
byModerator,
2020-07-24 08:05:51 -05:00
accountId: user.Account.id,
abuseId: abuse.id
})
// If a moderator created an abuse message, we consider it as processed
if (byModerator && !abuse.processedAt) {
abuse.processedAt = new Date()
await abuse.save()
}
AbuseModel.loadFull(abuse.id)
.then(abuseFull => Notifier.Instance.notifyOnAbuseMessage(abuseFull, abuseMessage))
.catch(err => logger.error('Cannot notify on new abuse message', { err }))
2020-07-24 08:05:51 -05:00
return res.json({
abuseMessage: {
id: abuseMessage.id
}
})
}
async function deleteAbuseMessage (req: express.Request, res: express.Response) {
const abuseMessage = res.locals.abuseMessage
await sequelizeTypescript.transaction(t => {
return abuseMessage.destroy({ transaction: t })
})
return res.status(HttpStatusCode.NO_CONTENT_204).end()
2020-07-24 08:05:51 -05:00
}