2017-06-10 15:15:25 -05:00
|
|
|
import * as express from 'express'
|
2020-03-27 09:19:03 -05:00
|
|
|
import { body, param, query } from 'express-validator'
|
2018-01-30 06:27:07 -06:00
|
|
|
import { omit } from 'lodash'
|
2020-12-08 07:30:29 -06:00
|
|
|
import { Hooks } from '@server/lib/plugins/hooks'
|
|
|
|
import { MUserDefault } from '@server/types/models'
|
|
|
|
import { HttpStatusCode } from '../../../shared/core-utils/miscs/http-error-codes'
|
|
|
|
import { UserRole } from '../../../shared/models/users'
|
|
|
|
import { UserRegister } from '../../../shared/models/users/user-register.model'
|
|
|
|
import { isActorPreferredUsernameValid } from '../../helpers/custom-validators/activitypub/actor'
|
2021-06-28 10:30:59 -05:00
|
|
|
import { toBooleanOrNull, toIntOrNull } from '../../helpers/custom-validators/misc'
|
2020-12-08 07:30:29 -06:00
|
|
|
import { isThemeNameValid } from '../../helpers/custom-validators/plugins'
|
2017-09-15 05:17:08 -05:00
|
|
|
import {
|
2019-09-24 03:19:55 -05:00
|
|
|
isNoInstanceConfigWarningModal,
|
|
|
|
isNoWelcomeModal,
|
2019-04-15 03:49:46 -05:00
|
|
|
isUserAdminFlagsValid,
|
2019-09-24 03:19:55 -05:00
|
|
|
isUserAutoPlayNextVideoValid,
|
2018-12-18 10:18:25 -06:00
|
|
|
isUserAutoPlayVideoValid,
|
|
|
|
isUserBlockedReasonValid,
|
2018-06-29 04:29:23 -05:00
|
|
|
isUserDescriptionValid,
|
|
|
|
isUserDisplayNameValid,
|
2018-04-19 04:01:34 -05:00
|
|
|
isUserNSFWPolicyValid,
|
2018-01-30 06:27:07 -06:00
|
|
|
isUserPasswordValid,
|
2020-02-17 03:16:52 -06:00
|
|
|
isUserPasswordValidOrEmpty,
|
2018-01-30 06:27:07 -06:00
|
|
|
isUserRoleValid,
|
2019-07-23 03:40:39 -05:00
|
|
|
isUserUsernameValid,
|
|
|
|
isUserVideoLanguages,
|
2018-12-18 10:18:25 -06:00
|
|
|
isUserVideoQuotaDailyValid,
|
2019-03-19 04:35:15 -05:00
|
|
|
isUserVideoQuotaValid,
|
|
|
|
isUserVideosHistoryEnabledValid
|
2017-12-12 10:53:50 -06:00
|
|
|
} from '../../helpers/custom-validators/users'
|
2020-12-08 07:30:29 -06:00
|
|
|
import { isVideoChannelNameValid } from '../../helpers/custom-validators/video-channels'
|
2017-12-28 04:16:08 -06:00
|
|
|
import { logger } from '../../helpers/logger'
|
2020-12-08 07:30:29 -06:00
|
|
|
import { isThemeRegistered } from '../../lib/plugins/theme-utils'
|
2018-01-30 06:27:07 -06:00
|
|
|
import { Redis } from '../../lib/redis'
|
2021-06-03 10:33:44 -05:00
|
|
|
import { isSignupAllowed, isSignupAllowedForCurrentIP } from '../../lib/signup'
|
2021-05-11 04:15:29 -05:00
|
|
|
import { ActorModel } from '../../models/actor/actor'
|
2021-06-03 10:33:44 -05:00
|
|
|
import { UserModel } from '../../models/user/user'
|
2021-06-28 10:30:59 -05:00
|
|
|
import { areValidationErrors, doesVideoExist, isValidVideoIdParam } from './shared'
|
2016-08-04 15:32:36 -05:00
|
|
|
|
2020-07-02 15:49:51 -05:00
|
|
|
const usersListValidator = [
|
|
|
|
query('blocked')
|
|
|
|
.optional()
|
2020-11-16 04:55:17 -06:00
|
|
|
.customSanitizer(toBooleanOrNull)
|
2020-07-02 15:49:51 -05:00
|
|
|
.isBoolean().withMessage('Should be a valid boolean banned state'),
|
|
|
|
|
2020-07-03 03:28:19 -05:00
|
|
|
(req: express.Request, res: express.Response, next: express.NextFunction) => {
|
2020-07-02 15:49:51 -05:00
|
|
|
logger.debug('Checking usersList parameters', { parameters: req.query })
|
|
|
|
|
|
|
|
if (areValidationErrors(req, res)) return
|
|
|
|
|
|
|
|
return next()
|
|
|
|
}
|
|
|
|
]
|
|
|
|
|
2017-09-15 05:17:08 -05:00
|
|
|
const usersAddValidator = [
|
2017-11-04 12:32:38 -05:00
|
|
|
body('username').custom(isUserUsernameValid).withMessage('Should have a valid username (lowercase alphanumeric characters)'),
|
2020-02-17 03:16:52 -06:00
|
|
|
body('password').custom(isUserPasswordValidOrEmpty).withMessage('Should have a valid password'),
|
2017-09-15 05:17:08 -05:00
|
|
|
body('email').isEmail().withMessage('Should have a valid email'),
|
2020-07-29 13:10:03 -05:00
|
|
|
body('channelName').optional().custom(isActorPreferredUsernameValid).withMessage('Should have a valid channel name'),
|
2017-09-15 05:17:08 -05:00
|
|
|
body('videoQuota').custom(isUserVideoQuotaValid).withMessage('Should have a valid user quota'),
|
2018-08-28 02:01:35 -05:00
|
|
|
body('videoQuotaDaily').custom(isUserVideoQuotaDailyValid).withMessage('Should have a valid daily user quota'),
|
2019-08-22 03:59:14 -05:00
|
|
|
body('role')
|
|
|
|
.customSanitizer(toIntOrNull)
|
|
|
|
.custom(isUserRoleValid).withMessage('Should have a valid role'),
|
2019-04-15 03:49:46 -05:00
|
|
|
body('adminFlags').optional().custom(isUserAdminFlagsValid).withMessage('Should have a valid admin flags'),
|
2016-08-04 15:32:36 -05:00
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
|
2018-01-26 06:55:27 -06:00
|
|
|
logger.debug('Checking usersAdd parameters', { parameters: omit(req.body, 'password') })
|
2016-08-04 15:32:36 -05:00
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
if (areValidationErrors(req, res)) return
|
|
|
|
if (!await checkUserNameOrEmailDoesNotAlreadyExist(req.body.username, req.body.email, res)) return
|
|
|
|
|
2019-07-30 02:59:19 -05:00
|
|
|
const authUser = res.locals.oauth.token.User
|
|
|
|
if (authUser.role !== UserRole.ADMINISTRATOR && req.body.role !== UserRole.USER) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({
|
|
|
|
status: HttpStatusCode.FORBIDDEN_403,
|
|
|
|
message: 'You can only create users (and not administrators or moderators)'
|
|
|
|
})
|
2019-07-30 02:59:19 -05:00
|
|
|
}
|
|
|
|
|
2020-07-29 13:10:03 -05:00
|
|
|
if (req.body.channelName) {
|
|
|
|
if (req.body.channelName === req.body.username) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({ message: 'Channel name cannot be the same as user username.' })
|
2020-07-29 13:10:03 -05:00
|
|
|
}
|
2020-07-29 09:23:42 -05:00
|
|
|
|
2020-07-29 13:10:03 -05:00
|
|
|
const existing = await ActorModel.loadLocalByName(req.body.channelName)
|
|
|
|
if (existing) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({
|
|
|
|
status: HttpStatusCode.CONFLICT_409,
|
|
|
|
message: `Channel with name ${req.body.channelName} already exists.`
|
|
|
|
})
|
2020-07-29 13:10:03 -05:00
|
|
|
}
|
2020-07-29 09:23:42 -05:00
|
|
|
}
|
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
return next()
|
2017-09-15 05:17:08 -05:00
|
|
|
}
|
|
|
|
]
|
2017-07-05 06:26:25 -05:00
|
|
|
|
2017-09-15 05:17:08 -05:00
|
|
|
const usersRegisterValidator = [
|
|
|
|
body('username').custom(isUserUsernameValid).withMessage('Should have a valid username'),
|
|
|
|
body('password').custom(isUserPasswordValid).withMessage('Should have a valid password'),
|
|
|
|
body('email').isEmail().withMessage('Should have a valid email'),
|
2019-06-07 09:59:53 -05:00
|
|
|
body('displayName')
|
|
|
|
.optional()
|
|
|
|
.custom(isUserDisplayNameValid).withMessage('Should have a valid display name'),
|
|
|
|
|
|
|
|
body('channel.name')
|
|
|
|
.optional()
|
|
|
|
.custom(isActorPreferredUsernameValid).withMessage('Should have a valid channel name'),
|
|
|
|
body('channel.displayName')
|
|
|
|
.optional()
|
|
|
|
.custom(isVideoChannelNameValid).withMessage('Should have a valid display name'),
|
2017-09-06 09:35:40 -05:00
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
|
2018-01-26 06:55:27 -06:00
|
|
|
logger.debug('Checking usersRegister parameters', { parameters: omit(req.body, 'password') })
|
2017-09-06 09:35:40 -05:00
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
if (areValidationErrors(req, res)) return
|
|
|
|
if (!await checkUserNameOrEmailDoesNotAlreadyExist(req.body.username, req.body.email, res)) return
|
|
|
|
|
2019-05-28 03:46:32 -05:00
|
|
|
const body: UserRegister = req.body
|
|
|
|
if (body.channel) {
|
|
|
|
if (!body.channel.name || !body.channel.displayName) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({ message: 'Channel is optional but if you specify it, channel.name and channel.displayName are required.' })
|
2019-05-28 03:46:32 -05:00
|
|
|
}
|
|
|
|
|
2019-05-29 04:03:01 -05:00
|
|
|
if (body.channel.name === body.username) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({ message: 'Channel name cannot be the same as user username.' })
|
2019-05-29 04:03:01 -05:00
|
|
|
}
|
|
|
|
|
2019-05-28 03:46:32 -05:00
|
|
|
const existing = await ActorModel.loadLocalByName(body.channel.name)
|
|
|
|
if (existing) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({
|
|
|
|
status: HttpStatusCode.CONFLICT_409,
|
|
|
|
message: `Channel with name ${body.channel.name} already exists.`
|
|
|
|
})
|
2019-05-28 03:46:32 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
return next()
|
2017-09-15 05:17:08 -05:00
|
|
|
}
|
|
|
|
]
|
2016-08-04 15:32:36 -05:00
|
|
|
|
2017-09-15 05:17:08 -05:00
|
|
|
const usersRemoveValidator = [
|
|
|
|
param('id').isInt().not().isEmpty().withMessage('Should have a valid id'),
|
2016-08-04 15:32:36 -05:00
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
|
2017-09-15 05:17:08 -05:00
|
|
|
logger.debug('Checking usersRemove parameters', { parameters: req.params })
|
2016-08-04 15:32:36 -05:00
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
if (areValidationErrors(req, res)) return
|
|
|
|
if (!await checkUserIdExist(req.params.id, res)) return
|
|
|
|
|
|
|
|
const user = res.locals.user
|
|
|
|
if (user.username === 'root') {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({ message: 'Cannot remove the root user' })
|
2017-11-27 10:30:46 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
return next()
|
2017-09-15 05:17:08 -05:00
|
|
|
}
|
|
|
|
]
|
2017-09-05 14:29:39 -05:00
|
|
|
|
2018-08-08 07:58:21 -05:00
|
|
|
const usersBlockingValidator = [
|
|
|
|
param('id').isInt().not().isEmpty().withMessage('Should have a valid id'),
|
2018-08-08 10:36:10 -05:00
|
|
|
body('reason').optional().custom(isUserBlockedReasonValid).withMessage('Should have a valid blocking reason'),
|
2018-08-08 07:58:21 -05:00
|
|
|
|
|
|
|
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
|
2018-08-08 10:36:10 -05:00
|
|
|
logger.debug('Checking usersBlocking parameters', { parameters: req.params })
|
2018-08-08 07:58:21 -05:00
|
|
|
|
|
|
|
if (areValidationErrors(req, res)) return
|
|
|
|
if (!await checkUserIdExist(req.params.id, res)) return
|
|
|
|
|
|
|
|
const user = res.locals.user
|
|
|
|
if (user.username === 'root') {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({ message: 'Cannot block the root user' })
|
2018-08-08 07:58:21 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
return next()
|
|
|
|
}
|
|
|
|
]
|
|
|
|
|
2018-08-08 03:55:27 -05:00
|
|
|
const deleteMeValidator = [
|
2020-01-31 09:56:52 -06:00
|
|
|
(req: express.Request, res: express.Response, next: express.NextFunction) => {
|
2019-03-19 04:35:15 -05:00
|
|
|
const user = res.locals.oauth.token.User
|
2018-08-08 03:55:27 -05:00
|
|
|
if (user.username === 'root') {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({ message: 'You cannot delete your root account.' })
|
2018-08-08 03:55:27 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
return next()
|
|
|
|
}
|
|
|
|
]
|
|
|
|
|
2017-09-15 05:17:08 -05:00
|
|
|
const usersUpdateValidator = [
|
|
|
|
param('id').isInt().not().isEmpty().withMessage('Should have a valid id'),
|
2021-05-10 09:09:59 -05:00
|
|
|
|
2019-02-11 02:30:29 -06:00
|
|
|
body('password').optional().custom(isUserPasswordValid).withMessage('Should have a valid password'),
|
2017-09-15 05:17:08 -05:00
|
|
|
body('email').optional().isEmail().withMessage('Should have a valid email attribute'),
|
2018-11-21 01:48:29 -06:00
|
|
|
body('emailVerified').optional().isBoolean().withMessage('Should have a valid email verified attribute'),
|
2017-09-15 05:17:08 -05:00
|
|
|
body('videoQuota').optional().custom(isUserVideoQuotaValid).withMessage('Should have a valid user quota'),
|
2018-08-28 02:01:35 -05:00
|
|
|
body('videoQuotaDaily').optional().custom(isUserVideoQuotaDailyValid).withMessage('Should have a valid daily user quota'),
|
2021-02-01 08:39:13 -06:00
|
|
|
body('pluginAuth').optional(),
|
2019-08-22 03:59:14 -05:00
|
|
|
body('role')
|
|
|
|
.optional()
|
|
|
|
.customSanitizer(toIntOrNull)
|
|
|
|
.custom(isUserRoleValid).withMessage('Should have a valid role'),
|
2019-04-15 03:49:46 -05:00
|
|
|
body('adminFlags').optional().custom(isUserAdminFlagsValid).withMessage('Should have a valid admin flags'),
|
2017-09-05 14:29:39 -05:00
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
|
2017-09-15 05:17:08 -05:00
|
|
|
logger.debug('Checking usersUpdate parameters', { parameters: req.body })
|
2016-08-04 15:32:36 -05:00
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
if (areValidationErrors(req, res)) return
|
|
|
|
if (!await checkUserIdExist(req.params.id, res)) return
|
|
|
|
|
2018-01-23 02:15:36 -06:00
|
|
|
const user = res.locals.user
|
|
|
|
if (user.username === 'root' && req.body.role !== undefined && user.role !== req.body.role) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({ message: 'Cannot change root role.' })
|
2018-01-23 02:15:36 -06:00
|
|
|
}
|
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
return next()
|
2017-09-15 05:17:08 -05:00
|
|
|
}
|
|
|
|
]
|
2016-08-04 15:32:36 -05:00
|
|
|
|
2017-09-15 05:17:08 -05:00
|
|
|
const usersUpdateMeValidator = [
|
2019-06-11 04:54:33 -05:00
|
|
|
body('displayName')
|
|
|
|
.optional()
|
|
|
|
.custom(isUserDisplayNameValid).withMessage('Should have a valid display name'),
|
|
|
|
body('description')
|
|
|
|
.optional()
|
|
|
|
.custom(isUserDescriptionValid).withMessage('Should have a valid description'),
|
|
|
|
body('currentPassword')
|
|
|
|
.optional()
|
|
|
|
.custom(isUserPasswordValid).withMessage('Should have a valid current password'),
|
|
|
|
body('password')
|
|
|
|
.optional()
|
|
|
|
.custom(isUserPasswordValid).withMessage('Should have a valid password'),
|
|
|
|
body('email')
|
|
|
|
.optional()
|
|
|
|
.isEmail().withMessage('Should have a valid email attribute'),
|
|
|
|
body('nsfwPolicy')
|
|
|
|
.optional()
|
|
|
|
.custom(isUserNSFWPolicyValid).withMessage('Should have a valid display Not Safe For Work policy'),
|
|
|
|
body('autoPlayVideo')
|
|
|
|
.optional()
|
|
|
|
.custom(isUserAutoPlayVideoValid).withMessage('Should have a valid automatically plays video attribute'),
|
2019-06-19 07:55:58 -05:00
|
|
|
body('videoLanguages')
|
|
|
|
.optional()
|
|
|
|
.custom(isUserVideoLanguages).withMessage('Should have a valid video languages attribute'),
|
2018-12-18 10:18:25 -06:00
|
|
|
body('videosHistoryEnabled')
|
|
|
|
.optional()
|
|
|
|
.custom(isUserVideosHistoryEnabledValid).withMessage('Should have a valid videos history enabled attribute'),
|
2019-07-09 04:45:19 -05:00
|
|
|
body('theme')
|
|
|
|
.optional()
|
2019-07-15 08:41:56 -05:00
|
|
|
.custom(v => isThemeNameValid(v) && isThemeRegistered(v)).withMessage('Should have a valid theme'),
|
2019-08-28 07:40:06 -05:00
|
|
|
body('noInstanceConfigWarningModal')
|
|
|
|
.optional()
|
|
|
|
.custom(v => isNoInstanceConfigWarningModal(v)).withMessage('Should have a valid noInstanceConfigWarningModal boolean'),
|
|
|
|
body('noWelcomeModal')
|
|
|
|
.optional()
|
|
|
|
.custom(v => isNoWelcomeModal(v)).withMessage('Should have a valid noWelcomeModal boolean'),
|
2019-09-24 03:19:55 -05:00
|
|
|
body('autoPlayNextVideo')
|
|
|
|
.optional()
|
|
|
|
.custom(v => isUserAutoPlayNextVideoValid(v)).withMessage('Should have a valid autoPlayNextVideo boolean'),
|
2016-08-04 15:32:36 -05:00
|
|
|
|
2018-09-26 09:28:15 -05:00
|
|
|
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
|
2018-01-26 06:55:27 -06:00
|
|
|
logger.debug('Checking usersUpdateMe parameters', { parameters: omit(req.body, 'password') })
|
2017-09-05 14:29:39 -05:00
|
|
|
|
2020-05-20 03:04:44 -05:00
|
|
|
const user = res.locals.oauth.token.User
|
|
|
|
|
2019-06-11 07:30:49 -05:00
|
|
|
if (req.body.password || req.body.email) {
|
2020-05-20 03:04:44 -05:00
|
|
|
if (user.pluginAuth !== null) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({ message: 'You cannot update your email or password that is associated with an external auth system.' })
|
2020-05-20 03:04:44 -05:00
|
|
|
}
|
|
|
|
|
2018-09-26 09:28:15 -05:00
|
|
|
if (!req.body.currentPassword) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({ message: 'currentPassword parameter is missing.' })
|
2018-09-26 09:28:15 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
if (await user.isPasswordMatch(req.body.currentPassword) !== true) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({
|
|
|
|
status: HttpStatusCode.UNAUTHORIZED_401,
|
|
|
|
message: 'currentPassword is invalid.'
|
|
|
|
})
|
2018-09-26 09:28:15 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
if (areValidationErrors(req, res)) return
|
|
|
|
|
|
|
|
return next()
|
2017-09-15 05:17:08 -05:00
|
|
|
}
|
|
|
|
]
|
2017-09-05 14:29:39 -05:00
|
|
|
|
2017-09-15 05:17:08 -05:00
|
|
|
const usersGetValidator = [
|
|
|
|
param('id').isInt().not().isEmpty().withMessage('Should have a valid id'),
|
2020-03-27 09:19:03 -05:00
|
|
|
query('withStats').optional().isBoolean().withMessage('Should have a valid stats flag'),
|
2017-03-08 14:35:43 -06:00
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
|
2018-01-26 06:55:27 -06:00
|
|
|
logger.debug('Checking usersGet parameters', { parameters: req.params })
|
2017-11-27 10:30:46 -06:00
|
|
|
|
|
|
|
if (areValidationErrors(req, res)) return
|
2020-03-27 09:19:03 -05:00
|
|
|
if (!await checkUserIdExist(req.params.id, res, req.query.withStats)) return
|
2017-11-27 10:30:46 -06:00
|
|
|
|
|
|
|
return next()
|
2017-09-15 05:17:08 -05:00
|
|
|
}
|
|
|
|
]
|
2017-03-08 14:35:43 -06:00
|
|
|
|
2017-09-15 05:17:08 -05:00
|
|
|
const usersVideoRatingValidator = [
|
2021-06-28 10:30:59 -05:00
|
|
|
isValidVideoIdParam('videoId'),
|
2017-07-11 09:01:56 -05:00
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
|
2017-09-15 05:17:08 -05:00
|
|
|
logger.debug('Checking usersVideoRating parameters', { parameters: req.params })
|
2017-07-11 09:01:56 -05:00
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
if (areValidationErrors(req, res)) return
|
2019-03-19 03:26:50 -05:00
|
|
|
if (!await doesVideoExist(req.params.videoId, res, 'id')) return
|
2017-11-27 10:30:46 -06:00
|
|
|
|
|
|
|
return next()
|
2017-09-15 05:17:08 -05:00
|
|
|
}
|
|
|
|
]
|
|
|
|
|
|
|
|
const ensureUserRegistrationAllowed = [
|
2017-11-27 10:30:46 -06:00
|
|
|
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
|
2019-10-25 06:54:32 -05:00
|
|
|
const allowedParams = {
|
2019-11-25 04:16:12 -06:00
|
|
|
body: req.body,
|
|
|
|
ip: req.ip
|
2019-10-25 06:54:32 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
const allowedResult = await Hooks.wrapPromiseFun(
|
|
|
|
isSignupAllowed,
|
|
|
|
allowedParams,
|
|
|
|
'filter:api.user.signup.allowed.result'
|
|
|
|
)
|
|
|
|
|
|
|
|
if (allowedResult.allowed === false) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({
|
|
|
|
status: HttpStatusCode.FORBIDDEN_403,
|
|
|
|
message: allowedResult.errorMessage || 'User registration is not enabled or user limit is reached.'
|
|
|
|
})
|
2017-11-27 10:30:46 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
return next()
|
2017-09-15 05:17:08 -05:00
|
|
|
}
|
|
|
|
]
|
2017-07-25 13:17:28 -05:00
|
|
|
|
2018-05-22 12:43:13 -05:00
|
|
|
const ensureUserRegistrationAllowedForIP = [
|
2020-01-31 09:56:52 -06:00
|
|
|
(req: express.Request, res: express.Response, next: express.NextFunction) => {
|
2018-05-22 12:43:13 -05:00
|
|
|
const allowed = isSignupAllowedForCurrentIP(req.ip)
|
|
|
|
|
|
|
|
if (allowed === false) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({
|
|
|
|
status: HttpStatusCode.FORBIDDEN_403,
|
|
|
|
message: 'You are not on a network authorized for registration.'
|
|
|
|
})
|
2018-05-22 12:43:13 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
return next()
|
|
|
|
}
|
|
|
|
]
|
|
|
|
|
2018-01-30 06:27:07 -06:00
|
|
|
const usersAskResetPasswordValidator = [
|
|
|
|
body('email').isEmail().not().isEmpty().withMessage('Should have a valid email'),
|
|
|
|
|
|
|
|
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
|
|
|
|
logger.debug('Checking usersAskResetPassword parameters', { parameters: req.body })
|
|
|
|
|
|
|
|
if (areValidationErrors(req, res)) return
|
2019-02-11 02:30:29 -06:00
|
|
|
|
2018-01-30 06:27:07 -06:00
|
|
|
const exists = await checkUserEmailExist(req.body.email, res, false)
|
|
|
|
if (!exists) {
|
|
|
|
logger.debug('User with email %s does not exist (asking reset password).', req.body.email)
|
|
|
|
// Do not leak our emails
|
2020-12-07 07:32:36 -06:00
|
|
|
return res.status(HttpStatusCode.NO_CONTENT_204).end()
|
2018-01-30 06:27:07 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
return next()
|
|
|
|
}
|
|
|
|
]
|
|
|
|
|
|
|
|
const usersResetPasswordValidator = [
|
|
|
|
param('id').isInt().not().isEmpty().withMessage('Should have a valid id'),
|
|
|
|
body('verificationString').not().isEmpty().withMessage('Should have a valid verification string'),
|
|
|
|
body('password').custom(isUserPasswordValid).withMessage('Should have a valid password'),
|
|
|
|
|
|
|
|
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
|
|
|
|
logger.debug('Checking usersResetPassword parameters', { parameters: req.params })
|
|
|
|
|
|
|
|
if (areValidationErrors(req, res)) return
|
|
|
|
if (!await checkUserIdExist(req.params.id, res)) return
|
|
|
|
|
2019-03-19 04:35:15 -05:00
|
|
|
const user = res.locals.user
|
2018-01-30 06:27:07 -06:00
|
|
|
const redisVerificationString = await Redis.Instance.getResetPasswordLink(user.id)
|
|
|
|
|
|
|
|
if (redisVerificationString !== req.body.verificationString) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({
|
|
|
|
status: HttpStatusCode.FORBIDDEN_403,
|
|
|
|
message: 'Invalid verification string.'
|
|
|
|
})
|
2018-01-30 06:27:07 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
return next()
|
|
|
|
}
|
|
|
|
]
|
|
|
|
|
2018-08-31 02:18:19 -05:00
|
|
|
const usersAskSendVerifyEmailValidator = [
|
|
|
|
body('email').isEmail().not().isEmpty().withMessage('Should have a valid email'),
|
|
|
|
|
|
|
|
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
|
|
|
|
logger.debug('Checking askUsersSendVerifyEmail parameters', { parameters: req.body })
|
|
|
|
|
|
|
|
if (areValidationErrors(req, res)) return
|
|
|
|
const exists = await checkUserEmailExist(req.body.email, res, false)
|
|
|
|
if (!exists) {
|
|
|
|
logger.debug('User with email %s does not exist (asking verify email).', req.body.email)
|
|
|
|
// Do not leak our emails
|
2020-12-07 07:32:36 -06:00
|
|
|
return res.status(HttpStatusCode.NO_CONTENT_204).end()
|
2018-08-31 02:18:19 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
return next()
|
|
|
|
}
|
|
|
|
]
|
|
|
|
|
|
|
|
const usersVerifyEmailValidator = [
|
2019-06-11 04:54:33 -05:00
|
|
|
param('id')
|
|
|
|
.isInt().not().isEmpty().withMessage('Should have a valid id'),
|
|
|
|
|
|
|
|
body('verificationString')
|
|
|
|
.not().isEmpty().withMessage('Should have a valid verification string'),
|
|
|
|
body('isPendingEmail')
|
|
|
|
.optional()
|
2019-07-25 10:28:45 -05:00
|
|
|
.customSanitizer(toBooleanOrNull),
|
2018-08-31 02:18:19 -05:00
|
|
|
|
|
|
|
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
|
|
|
|
logger.debug('Checking usersVerifyEmail parameters', { parameters: req.params })
|
|
|
|
|
|
|
|
if (areValidationErrors(req, res)) return
|
|
|
|
if (!await checkUserIdExist(req.params.id, res)) return
|
|
|
|
|
2019-03-19 04:35:15 -05:00
|
|
|
const user = res.locals.user
|
2018-08-31 02:18:19 -05:00
|
|
|
const redisVerificationString = await Redis.Instance.getVerifyEmailLink(user.id)
|
|
|
|
|
|
|
|
if (redisVerificationString !== req.body.verificationString) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({
|
|
|
|
status: HttpStatusCode.FORBIDDEN_403,
|
|
|
|
message: 'Invalid verification string.'
|
|
|
|
})
|
2018-08-31 02:18:19 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
return next()
|
|
|
|
}
|
|
|
|
]
|
|
|
|
|
Users can change ownership of their video [#510] (#888)
* [#510] Create a new route to get the list of user names
To be able to transfer ownership to a user,
we need to be able to select him from the list of users.
Because the list could be too big, we add a autocomplete feature.
This commit does the following:
* Add a API endpoint to get a list of user names by searching its name
* [#510] The user can choose the next owner of the video
To be able to transfer ownership to a user,
we need the owner to be able to select the user.
The server can autocomplete the name of the user to give the ownership.
We add a dialog for the user to actually select it.
This commit does the following:
* Create a modal for the owner to select the next one
* Opens this modal with a button into the menu *more*
* Make the dependency injection
* [#510] When the user choose the next owner, create a request in database
For the change of ownership to happen, we need to store the temporary requests.
When the user make the request, save it to database.
This commit does the following:
* Create the model to persist change ownership requests
* Add an API to manage ownership operations
* Add a route to persist an ownership request
* [#510] A user can fetch its ownership requests sent to him
To be able to accept or refuse a change of ownership,
the user must be able to fetch them.
This commit does the following:
* Add an API to list ownership for a user
* Add the query to database model
* [#510] A user can validate an ownership requests sent to him - server
The user can accept or refuse any ownership request that was sent to him.
This commit focus only on the server part.
This commit does the following:
* Add an API for the user to accept or refuse a video ownership
* Add validators to ensure security access
* Add a query to load a specific video change ownership request
* [#510] A user can validate an ownership requests sent to him - web
The user can accept or refuse any ownership request that was sent to him.
This commit focus only on the web part.
This commit does the following:
* Add a page to list user ownership changes
* Add actions to accept or refuse them
* When accepting, show a modal requiring the channel to send the video
* Correct lint - to squash
* [#510] PR reviews - to squash
This commit does the following:
* Search parameter for user autocompletion is required from middleware directly
* [#510] PR reviews - to squash with creation in database commit
This commit does the following:
* Add the status attribute in model
* Set this attribute on instance creation
* Use AccountModel method `loadLocalByName`
* [#510] PR reviews - to squash with fetch ownership
This commit does the following:
* Add the scope `FULL` for database queries with includes
* Add classic pagination middlewares
* [#510] PR reviews - to squash with ownership validation - server
This commit does the following:
* Add a middleware to validate whether a user can validate an ownership
* Change the ownership status instead of deleting the row
* [#510] PR reviews - to squash with ownership validation - client
This commit does the following:
* Correct indentation of html files with two-spaces indentation
* Use event emitter instead of function for accept event
* Update the sort of ownership change table for a decreasing order by creation date
* Add the status in ownership change table
* Use classic method syntax
* code style - to squash
* Add new user right - to squash
* Move the change to my-account instead of video-watch - to squash
As requested in pull-request, move the action to change ownership into my videos page.
The rest of the logic was not really changed.
This commit does the following:
- Move the modal into my video page
- Create the generic component `button` to keep some styles and logic
* [#510] Add tests for the new feature
To avoid regression, we add tests for all api of ownership change.
This commit does the following:
- Create an end-to-end test for ownership change
- Divide it to one test per request
* [#510] Do not send twice the same request to avoid spam
We can send several time the same request to change ownership.
However, it will spam the user.
To avoid this, we do not save a request already existing in database.
This commit does the following:
- Check whether the request exist in database
- Add tests to verify this new condition
* [#510] Change icons
Change icons so they remains logic with the rest of the application.
This commit does the following:
- Add svg for missing icons
- Add icons in `my-button` component
- Use these new icons
* [#510] Add control about the user quota
The user should be able to accept a new video only if his quota allows it.
This commit does the following:
- Update the middleware to control the quota
- Add tests verifying the control
* Correct merge
- Use new modal system
- Move button to new directory `buttons`
* PR reviews - to squash
2018-09-04 01:57:13 -05:00
|
|
|
const userAutocompleteValidator = [
|
|
|
|
param('search').isString().not().isEmpty().withMessage('Should have a search parameter')
|
|
|
|
]
|
|
|
|
|
2019-04-09 04:02:02 -05:00
|
|
|
const ensureAuthUserOwnsAccountValidator = [
|
2020-01-31 09:56:52 -06:00
|
|
|
(req: express.Request, res: express.Response, next: express.NextFunction) => {
|
2019-04-09 04:02:02 -05:00
|
|
|
const user = res.locals.oauth.token.User
|
|
|
|
|
|
|
|
if (res.locals.account.id !== user.Account.id) {
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({
|
|
|
|
status: HttpStatusCode.FORBIDDEN_403,
|
|
|
|
message: 'Only owner can access ratings list.'
|
|
|
|
})
|
2019-04-09 04:02:02 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
return next()
|
|
|
|
}
|
|
|
|
]
|
|
|
|
|
2019-07-30 02:59:19 -05:00
|
|
|
const ensureCanManageUser = [
|
|
|
|
(req: express.Request, res: express.Response, next: express.NextFunction) => {
|
|
|
|
const authUser = res.locals.oauth.token.User
|
|
|
|
const onUser = res.locals.user
|
|
|
|
|
|
|
|
if (authUser.role === UserRole.ADMINISTRATOR) return next()
|
|
|
|
if (authUser.role === UserRole.MODERATOR && onUser.role === UserRole.USER) return next()
|
|
|
|
|
2021-05-31 18:36:53 -05:00
|
|
|
return res.fail({
|
|
|
|
status: HttpStatusCode.FORBIDDEN_403,
|
|
|
|
message: 'A moderator can only manager users.'
|
|
|
|
})
|
2019-07-30 02:59:19 -05:00
|
|
|
}
|
|
|
|
]
|
|
|
|
|
2016-08-04 15:32:36 -05:00
|
|
|
// ---------------------------------------------------------------------------
|
|
|
|
|
2017-05-15 15:22:03 -05:00
|
|
|
export {
|
2020-07-02 15:49:51 -05:00
|
|
|
usersListValidator,
|
2017-05-15 15:22:03 -05:00
|
|
|
usersAddValidator,
|
2018-08-08 03:55:27 -05:00
|
|
|
deleteMeValidator,
|
2017-09-06 09:35:40 -05:00
|
|
|
usersRegisterValidator,
|
2018-08-08 07:58:21 -05:00
|
|
|
usersBlockingValidator,
|
2017-05-15 15:22:03 -05:00
|
|
|
usersRemoveValidator,
|
|
|
|
usersUpdateValidator,
|
2017-09-05 14:29:39 -05:00
|
|
|
usersUpdateMeValidator,
|
2017-07-25 13:17:28 -05:00
|
|
|
usersVideoRatingValidator,
|
2017-09-05 14:29:39 -05:00
|
|
|
ensureUserRegistrationAllowed,
|
2018-05-22 12:43:13 -05:00
|
|
|
ensureUserRegistrationAllowedForIP,
|
2017-12-29 12:10:13 -06:00
|
|
|
usersGetValidator,
|
2018-01-30 06:27:07 -06:00
|
|
|
usersAskResetPasswordValidator,
|
2018-08-31 02:18:19 -05:00
|
|
|
usersResetPasswordValidator,
|
|
|
|
usersAskSendVerifyEmailValidator,
|
Users can change ownership of their video [#510] (#888)
* [#510] Create a new route to get the list of user names
To be able to transfer ownership to a user,
we need to be able to select him from the list of users.
Because the list could be too big, we add a autocomplete feature.
This commit does the following:
* Add a API endpoint to get a list of user names by searching its name
* [#510] The user can choose the next owner of the video
To be able to transfer ownership to a user,
we need the owner to be able to select the user.
The server can autocomplete the name of the user to give the ownership.
We add a dialog for the user to actually select it.
This commit does the following:
* Create a modal for the owner to select the next one
* Opens this modal with a button into the menu *more*
* Make the dependency injection
* [#510] When the user choose the next owner, create a request in database
For the change of ownership to happen, we need to store the temporary requests.
When the user make the request, save it to database.
This commit does the following:
* Create the model to persist change ownership requests
* Add an API to manage ownership operations
* Add a route to persist an ownership request
* [#510] A user can fetch its ownership requests sent to him
To be able to accept or refuse a change of ownership,
the user must be able to fetch them.
This commit does the following:
* Add an API to list ownership for a user
* Add the query to database model
* [#510] A user can validate an ownership requests sent to him - server
The user can accept or refuse any ownership request that was sent to him.
This commit focus only on the server part.
This commit does the following:
* Add an API for the user to accept or refuse a video ownership
* Add validators to ensure security access
* Add a query to load a specific video change ownership request
* [#510] A user can validate an ownership requests sent to him - web
The user can accept or refuse any ownership request that was sent to him.
This commit focus only on the web part.
This commit does the following:
* Add a page to list user ownership changes
* Add actions to accept or refuse them
* When accepting, show a modal requiring the channel to send the video
* Correct lint - to squash
* [#510] PR reviews - to squash
This commit does the following:
* Search parameter for user autocompletion is required from middleware directly
* [#510] PR reviews - to squash with creation in database commit
This commit does the following:
* Add the status attribute in model
* Set this attribute on instance creation
* Use AccountModel method `loadLocalByName`
* [#510] PR reviews - to squash with fetch ownership
This commit does the following:
* Add the scope `FULL` for database queries with includes
* Add classic pagination middlewares
* [#510] PR reviews - to squash with ownership validation - server
This commit does the following:
* Add a middleware to validate whether a user can validate an ownership
* Change the ownership status instead of deleting the row
* [#510] PR reviews - to squash with ownership validation - client
This commit does the following:
* Correct indentation of html files with two-spaces indentation
* Use event emitter instead of function for accept event
* Update the sort of ownership change table for a decreasing order by creation date
* Add the status in ownership change table
* Use classic method syntax
* code style - to squash
* Add new user right - to squash
* Move the change to my-account instead of video-watch - to squash
As requested in pull-request, move the action to change ownership into my videos page.
The rest of the logic was not really changed.
This commit does the following:
- Move the modal into my video page
- Create the generic component `button` to keep some styles and logic
* [#510] Add tests for the new feature
To avoid regression, we add tests for all api of ownership change.
This commit does the following:
- Create an end-to-end test for ownership change
- Divide it to one test per request
* [#510] Do not send twice the same request to avoid spam
We can send several time the same request to change ownership.
However, it will spam the user.
To avoid this, we do not save a request already existing in database.
This commit does the following:
- Check whether the request exist in database
- Add tests to verify this new condition
* [#510] Change icons
Change icons so they remains logic with the rest of the application.
This commit does the following:
- Add svg for missing icons
- Add icons in `my-button` component
- Use these new icons
* [#510] Add control about the user quota
The user should be able to accept a new video only if his quota allows it.
This commit does the following:
- Update the middleware to control the quota
- Add tests verifying the control
* Correct merge
- Use new modal system
- Move button to new directory `buttons`
* PR reviews - to squash
2018-09-04 01:57:13 -05:00
|
|
|
usersVerifyEmailValidator,
|
2019-04-09 04:02:02 -05:00
|
|
|
userAutocompleteValidator,
|
2019-07-30 02:59:19 -05:00
|
|
|
ensureAuthUserOwnsAccountValidator,
|
|
|
|
ensureCanManageUser
|
2017-09-05 14:29:39 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
// ---------------------------------------------------------------------------
|
|
|
|
|
2020-03-27 09:19:03 -05:00
|
|
|
function checkUserIdExist (idArg: number | string, res: express.Response, withStats = false) {
|
2019-10-21 07:50:55 -05:00
|
|
|
const id = parseInt(idArg + '', 10)
|
2020-09-25 09:19:35 -05:00
|
|
|
return checkUserExist(() => UserModel.loadByIdWithChannels(id, withStats), res)
|
2018-01-30 06:27:07 -06:00
|
|
|
}
|
2017-11-27 10:30:46 -06:00
|
|
|
|
2018-01-30 06:27:07 -06:00
|
|
|
function checkUserEmailExist (email: string, res: express.Response, abortResponse = true) {
|
|
|
|
return checkUserExist(() => UserModel.loadByEmail(email), res, abortResponse)
|
2017-05-15 15:22:03 -05:00
|
|
|
}
|
2017-09-06 09:35:40 -05:00
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
async function checkUserNameOrEmailDoesNotAlreadyExist (username: string, email: string, res: express.Response) {
|
2017-12-12 10:53:50 -06:00
|
|
|
const user = await UserModel.loadByUsernameOrEmail(username, email)
|
2017-11-27 10:30:46 -06:00
|
|
|
|
|
|
|
if (user) {
|
2021-05-31 18:36:53 -05:00
|
|
|
res.fail({
|
|
|
|
status: HttpStatusCode.CONFLICT_409,
|
|
|
|
message: 'User with this username or email already exists.'
|
|
|
|
})
|
2017-11-27 10:30:46 -06:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2018-06-21 04:54:22 -05:00
|
|
|
const actor = await ActorModel.loadLocalByName(username)
|
|
|
|
if (actor) {
|
2021-05-31 18:36:53 -05:00
|
|
|
res.fail({
|
|
|
|
status: HttpStatusCode.CONFLICT_409,
|
|
|
|
message: 'Another actor (account/channel) with this name on this instance already exists or has already existed.'
|
|
|
|
})
|
2018-06-21 04:54:22 -05:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2017-11-27 10:30:46 -06:00
|
|
|
return true
|
2017-09-06 09:35:40 -05:00
|
|
|
}
|
2018-01-30 06:27:07 -06:00
|
|
|
|
2020-12-08 07:30:29 -06:00
|
|
|
async function checkUserExist (finder: () => Promise<MUserDefault>, res: express.Response, abortResponse = true) {
|
2018-01-30 06:27:07 -06:00
|
|
|
const user = await finder()
|
|
|
|
|
|
|
|
if (!user) {
|
|
|
|
if (abortResponse === true) {
|
2021-05-31 18:36:53 -05:00
|
|
|
res.fail({
|
|
|
|
status: HttpStatusCode.NOT_FOUND_404,
|
|
|
|
message: 'User not found'
|
|
|
|
})
|
2018-01-30 06:27:07 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
res.locals.user = user
|
|
|
|
return true
|
|
|
|
}
|