PeerTube/server/middlewares/validators/videos.ts

400 lines
14 KiB
TypeScript
Raw Normal View History

2017-06-10 22:15:25 +02:00
import * as express from 'express'
2017-12-12 17:53:50 +01:00
import 'express-validator'
2018-07-19 16:17:54 +02:00
import { body, param, ValidationChain } from 'express-validator/check'
Users can change ownership of their video [#510] (#888) * [#510] Create a new route to get the list of user names To be able to transfer ownership to a user, we need to be able to select him from the list of users. Because the list could be too big, we add a autocomplete feature. This commit does the following: * Add a API endpoint to get a list of user names by searching its name * [#510] The user can choose the next owner of the video To be able to transfer ownership to a user, we need the owner to be able to select the user. The server can autocomplete the name of the user to give the ownership. We add a dialog for the user to actually select it. This commit does the following: * Create a modal for the owner to select the next one * Opens this modal with a button into the menu *more* * Make the dependency injection * [#510] When the user choose the next owner, create a request in database For the change of ownership to happen, we need to store the temporary requests. When the user make the request, save it to database. This commit does the following: * Create the model to persist change ownership requests * Add an API to manage ownership operations * Add a route to persist an ownership request * [#510] A user can fetch its ownership requests sent to him To be able to accept or refuse a change of ownership, the user must be able to fetch them. This commit does the following: * Add an API to list ownership for a user * Add the query to database model * [#510] A user can validate an ownership requests sent to him - server The user can accept or refuse any ownership request that was sent to him. This commit focus only on the server part. This commit does the following: * Add an API for the user to accept or refuse a video ownership * Add validators to ensure security access * Add a query to load a specific video change ownership request * [#510] A user can validate an ownership requests sent to him - web The user can accept or refuse any ownership request that was sent to him. This commit focus only on the web part. This commit does the following: * Add a page to list user ownership changes * Add actions to accept or refuse them * When accepting, show a modal requiring the channel to send the video * Correct lint - to squash * [#510] PR reviews - to squash This commit does the following: * Search parameter for user autocompletion is required from middleware directly * [#510] PR reviews - to squash with creation in database commit This commit does the following: * Add the status attribute in model * Set this attribute on instance creation * Use AccountModel method `loadLocalByName` * [#510] PR reviews - to squash with fetch ownership This commit does the following: * Add the scope `FULL` for database queries with includes * Add classic pagination middlewares * [#510] PR reviews - to squash with ownership validation - server This commit does the following: * Add a middleware to validate whether a user can validate an ownership * Change the ownership status instead of deleting the row * [#510] PR reviews - to squash with ownership validation - client This commit does the following: * Correct indentation of html files with two-spaces indentation * Use event emitter instead of function for accept event * Update the sort of ownership change table for a decreasing order by creation date * Add the status in ownership change table * Use classic method syntax * code style - to squash * Add new user right - to squash * Move the change to my-account instead of video-watch - to squash As requested in pull-request, move the action to change ownership into my videos page. The rest of the logic was not really changed. This commit does the following: - Move the modal into my video page - Create the generic component `button` to keep some styles and logic * [#510] Add tests for the new feature To avoid regression, we add tests for all api of ownership change. This commit does the following: - Create an end-to-end test for ownership change - Divide it to one test per request * [#510] Do not send twice the same request to avoid spam We can send several time the same request to change ownership. However, it will spam the user. To avoid this, we do not save a request already existing in database. This commit does the following: - Check whether the request exist in database - Add tests to verify this new condition * [#510] Change icons Change icons so they remains logic with the rest of the application. This commit does the following: - Add svg for missing icons - Add icons in `my-button` component - Use these new icons * [#510] Add control about the user quota The user should be able to accept a new video only if his quota allows it. This commit does the following: - Update the middleware to control the quota - Add tests verifying the control * Correct merge - Use new modal system - Move button to new directory `buttons` * PR reviews - to squash
2018-09-04 08:57:13 +02:00
import { UserRight, VideoChangeOwnershipStatus, VideoPrivacy } from '../../../shared'
2017-09-15 12:17:08 +02:00
import {
isBooleanValid,
isDateValid,
isIdOrUUIDValid,
isIdValid,
isUUIDValid,
toIntOrNull,
toValueOrNull
} from '../../helpers/custom-validators/misc'
import {
2018-07-12 19:02:00 +02:00
checkUserCanManageVideo,
isScheduleVideoUpdatePrivacyValid,
isVideoCategoryValid,
2018-05-11 15:10:13 +02:00
isVideoChannelOfAccountExist,
isVideoDescriptionValid,
isVideoExist,
isVideoFile,
isVideoImage,
isVideoLanguageValid,
isVideoLicenceValid,
isVideoNameValid,
isVideoPrivacyValid,
isVideoRatingTypeValid,
isVideoSupportValid,
2018-09-19 11:16:23 +02:00
isVideoTagsValid
2017-11-23 17:53:38 +01:00
} from '../../helpers/custom-validators/videos'
2017-12-28 11:16:08 +01:00
import { getDurationFromVideoFile } from '../../helpers/ffmpeg-utils'
import { logger } from '../../helpers/logger'
2017-12-05 17:46:33 +01:00
import { CONSTRAINTS_FIELDS } from '../../initializers'
2017-12-12 17:53:50 +01:00
import { VideoShareModel } from '../../models/video/video-share'
import { authenticate } from '../oauth'
2017-11-27 17:30:46 +01:00
import { areValidationErrors } from './utils'
2018-08-14 15:28:30 +02:00
import { cleanUpReqFiles } from '../../helpers/express-utils'
2018-08-14 09:08:47 +02:00
import { VideoModel } from '../../models/video/video'
import { UserModel } from '../../models/account/user'
Users can change ownership of their video [#510] (#888) * [#510] Create a new route to get the list of user names To be able to transfer ownership to a user, we need to be able to select him from the list of users. Because the list could be too big, we add a autocomplete feature. This commit does the following: * Add a API endpoint to get a list of user names by searching its name * [#510] The user can choose the next owner of the video To be able to transfer ownership to a user, we need the owner to be able to select the user. The server can autocomplete the name of the user to give the ownership. We add a dialog for the user to actually select it. This commit does the following: * Create a modal for the owner to select the next one * Opens this modal with a button into the menu *more* * Make the dependency injection * [#510] When the user choose the next owner, create a request in database For the change of ownership to happen, we need to store the temporary requests. When the user make the request, save it to database. This commit does the following: * Create the model to persist change ownership requests * Add an API to manage ownership operations * Add a route to persist an ownership request * [#510] A user can fetch its ownership requests sent to him To be able to accept or refuse a change of ownership, the user must be able to fetch them. This commit does the following: * Add an API to list ownership for a user * Add the query to database model * [#510] A user can validate an ownership requests sent to him - server The user can accept or refuse any ownership request that was sent to him. This commit focus only on the server part. This commit does the following: * Add an API for the user to accept or refuse a video ownership * Add validators to ensure security access * Add a query to load a specific video change ownership request * [#510] A user can validate an ownership requests sent to him - web The user can accept or refuse any ownership request that was sent to him. This commit focus only on the web part. This commit does the following: * Add a page to list user ownership changes * Add actions to accept or refuse them * When accepting, show a modal requiring the channel to send the video * Correct lint - to squash * [#510] PR reviews - to squash This commit does the following: * Search parameter for user autocompletion is required from middleware directly * [#510] PR reviews - to squash with creation in database commit This commit does the following: * Add the status attribute in model * Set this attribute on instance creation * Use AccountModel method `loadLocalByName` * [#510] PR reviews - to squash with fetch ownership This commit does the following: * Add the scope `FULL` for database queries with includes * Add classic pagination middlewares * [#510] PR reviews - to squash with ownership validation - server This commit does the following: * Add a middleware to validate whether a user can validate an ownership * Change the ownership status instead of deleting the row * [#510] PR reviews - to squash with ownership validation - client This commit does the following: * Correct indentation of html files with two-spaces indentation * Use event emitter instead of function for accept event * Update the sort of ownership change table for a decreasing order by creation date * Add the status in ownership change table * Use classic method syntax * code style - to squash * Add new user right - to squash * Move the change to my-account instead of video-watch - to squash As requested in pull-request, move the action to change ownership into my videos page. The rest of the logic was not really changed. This commit does the following: - Move the modal into my video page - Create the generic component `button` to keep some styles and logic * [#510] Add tests for the new feature To avoid regression, we add tests for all api of ownership change. This commit does the following: - Create an end-to-end test for ownership change - Divide it to one test per request * [#510] Do not send twice the same request to avoid spam We can send several time the same request to change ownership. However, it will spam the user. To avoid this, we do not save a request already existing in database. This commit does the following: - Check whether the request exist in database - Add tests to verify this new condition * [#510] Change icons Change icons so they remains logic with the rest of the application. This commit does the following: - Add svg for missing icons - Add icons in `my-button` component - Use these new icons * [#510] Add control about the user quota The user should be able to accept a new video only if his quota allows it. This commit does the following: - Update the middleware to control the quota - Add tests verifying the control * Correct merge - Use new modal system - Move button to new directory `buttons` * PR reviews - to squash
2018-09-04 08:57:13 +02:00
import { checkUserCanTerminateOwnershipChange, doesChangeVideoOwnershipExist } from '../../helpers/custom-validators/video-ownership'
import { VideoChangeOwnershipAccept } from '../../../shared/models/videos/video-change-ownership-accept.model'
import { VideoChangeOwnershipModel } from '../../models/video/video-change-ownership'
import { AccountModel } from '../../models/account/account'
2018-09-19 11:16:23 +02:00
import { VideoFetchType } from '../../helpers/video'
2015-11-07 14:16:26 +01:00
2018-07-16 14:58:22 +02:00
const videosAddValidator = getCommonVideoAttributes().concat([
2018-06-22 15:42:55 +02:00
body('videofile')
.custom((value, { req }) => isVideoFile(req.files)).withMessage(
2018-07-12 19:02:00 +02:00
'This file is not supported or too large. Please, make sure it is of the following type: '
2018-06-22 15:42:55 +02:00
+ CONSTRAINTS_FIELDS.VIDEOS.EXTNAME.join(', ')
),
2017-09-15 12:17:08 +02:00
body('name').custom(isVideoNameValid).withMessage('Should have a valid name'),
2018-05-11 15:10:13 +02:00
body('channelId')
.toInt()
.custom(isIdValid).withMessage('Should have correct video channel id'),
2017-09-15 12:17:08 +02:00
2017-11-27 17:30:46 +01:00
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
2017-09-15 12:17:08 +02:00
logger.debug('Checking videosAdd parameters', { parameters: req.body, files: req.files })
2018-07-31 15:09:34 +02:00
if (areValidationErrors(req, res)) return cleanUpReqFiles(req)
if (areErrorsInScheduleUpdate(req, res)) return cleanUpReqFiles(req)
2017-11-27 17:30:46 +01:00
const videoFile: Express.Multer.File = req.files['videofile'][0]
const user = res.locals.oauth.token.User
2017-09-15 12:17:08 +02:00
2018-07-31 15:09:34 +02:00
if (!await isVideoChannelOfAccountExist(req.body.channelId, user, res)) return cleanUpReqFiles(req)
2017-11-27 17:30:46 +01:00
const isAble = await user.isAbleToUploadVideo(videoFile)
if (isAble === false) {
res.status(403)
.json({ error: 'The user video quota is exceeded with this video.' })
.end()
2018-07-31 15:09:34 +02:00
return cleanUpReqFiles(req)
2017-11-27 17:30:46 +01:00
}
let duration: number
try {
duration = await getDurationFromVideoFile(videoFile.path)
} catch (err) {
2018-03-26 15:54:13 +02:00
logger.error('Invalid input file in videosAddValidator.', { err })
2017-11-27 17:30:46 +01:00
res.status(400)
.json({ error: 'Invalid input file.' })
.end()
2018-07-31 15:09:34 +02:00
return cleanUpReqFiles(req)
2017-11-27 17:30:46 +01:00
}
videoFile['duration'] = duration
return next()
2017-09-15 12:17:08 +02:00
}
2018-07-16 14:58:22 +02:00
])
2017-09-15 12:17:08 +02:00
2018-07-16 14:58:22 +02:00
const videosUpdateValidator = getCommonVideoAttributes().concat([
2017-10-24 19:41:09 +02:00
param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
body('name')
.optional()
.custom(isVideoNameValid).withMessage('Should have a valid name'),
2018-05-11 15:10:13 +02:00
body('channelId')
.optional()
.toInt()
.custom(isIdValid).withMessage('Should have correct video channel id'),
2017-09-15 12:17:08 +02:00
2017-11-27 17:30:46 +01:00
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
2017-09-15 12:17:08 +02:00
logger.debug('Checking videosUpdate parameters', { parameters: req.body })
2018-07-31 15:09:34 +02:00
if (areValidationErrors(req, res)) return cleanUpReqFiles(req)
if (areErrorsInScheduleUpdate(req, res)) return cleanUpReqFiles(req)
if (!await isVideoExist(req.params.id, res)) return cleanUpReqFiles(req)
2017-11-27 17:30:46 +01:00
const video = res.locals.video
// Check if the user who did the request is able to update the video
2018-05-11 15:10:13 +02:00
const user = res.locals.oauth.token.User
2018-07-31 15:09:34 +02:00
if (!checkUserCanManageVideo(user, res.locals.video, UserRight.UPDATE_ANY_VIDEO, res)) return cleanUpReqFiles(req)
2017-11-27 17:30:46 +01:00
if (video.privacy !== VideoPrivacy.PRIVATE && req.body.privacy === VideoPrivacy.PRIVATE) {
2018-07-31 15:09:34 +02:00
cleanUpReqFiles(req)
2017-11-27 17:30:46 +01:00
return res.status(409)
.json({ error: 'Cannot set "private" a video that was not private.' })
2017-11-27 17:30:46 +01:00
.end()
}
2018-07-31 15:09:34 +02:00
if (req.body.channelId && !await isVideoChannelOfAccountExist(req.body.channelId, user, res)) return cleanUpReqFiles(req)
2018-05-11 15:10:13 +02:00
2017-11-27 17:30:46 +01:00
return next()
2017-09-15 12:17:08 +02:00
}
2018-07-16 14:58:22 +02:00
])
2016-02-04 21:10:33 +01:00
const videosCustomGetValidator = (fetchType: VideoFetchType) => {
return [
param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
2016-12-29 19:07:05 +01:00
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
logger.debug('Checking videosGet parameters', { parameters: req.params })
if (areValidationErrors(req, res)) return
if (!await isVideoExist(req.params.id, res, fetchType)) return
2018-08-14 09:08:47 +02:00
const video: VideoModel = res.locals.video
2018-08-14 09:08:47 +02:00
// Video private or blacklisted
if (video.privacy === VideoPrivacy.PRIVATE || video.VideoBlacklist) {
return authenticate(req, res, () => {
const user: UserModel = res.locals.oauth.token.User
2018-08-14 09:08:47 +02:00
// Only the owner or a user that have blacklist rights can see the video
if (video.VideoChannel.Account.userId !== user.id && !user.hasRight(UserRight.MANAGE_VIDEO_BLACKLIST)) {
return res.status(403)
.json({ error: 'Cannot get this private or blacklisted video.' })
.end()
}
2018-08-14 09:08:47 +02:00
return next()
})
}
// Video is public, anyone can access it
if (video.privacy === VideoPrivacy.PUBLIC) return next()
// Video is unlisted, check we used the uuid to fetch it
if (video.privacy === VideoPrivacy.UNLISTED) {
if (isUUIDValid(req.params.id)) return next()
2018-01-31 14:40:42 +01:00
// Don't leak this unlisted video
return res.status(404).end()
}
2018-01-31 14:40:42 +01:00
}
]
}
const videosGetValidator = videosCustomGetValidator('all')
2015-11-07 14:16:26 +01:00
2017-09-15 12:17:08 +02:00
const videosRemoveValidator = [
2017-10-24 19:41:09 +02:00
param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
2015-11-07 14:16:26 +01:00
2017-11-27 17:30:46 +01:00
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
2017-09-15 12:17:08 +02:00
logger.debug('Checking videosRemove parameters', { parameters: req.params })
2015-11-07 14:16:26 +01:00
2017-11-27 17:30:46 +01:00
if (areValidationErrors(req, res)) return
if (!await isVideoExist(req.params.id, res)) return
// Check if the user who did the request is able to delete the video
if (!checkUserCanManageVideo(res.locals.oauth.token.User, res.locals.video, UserRight.REMOVE_ANY_VIDEO, res)) return
2017-11-27 17:30:46 +01:00
return next()
2017-09-15 12:17:08 +02:00
}
]
2015-11-07 14:16:26 +01:00
2017-09-15 12:17:08 +02:00
const videoRateValidator = [
2017-10-24 19:41:09 +02:00
param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
2017-09-15 12:17:08 +02:00
body('rating').custom(isVideoRatingTypeValid).withMessage('Should have a valid rate type'),
2017-03-08 21:35:43 +01:00
2017-11-27 17:30:46 +01:00
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
2017-09-15 12:17:08 +02:00
logger.debug('Checking videoRate parameters', { parameters: req.body })
2017-03-08 21:35:43 +01:00
2017-11-27 17:30:46 +01:00
if (areValidationErrors(req, res)) return
if (!await isVideoExist(req.params.id, res)) return
return next()
2017-09-15 12:17:08 +02:00
}
]
2017-03-08 21:35:43 +01:00
const videosShareValidator = [
param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
param('accountId').custom(isIdValid).not().isEmpty().withMessage('Should have a valid account id'),
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
logger.debug('Checking videoShare parameters', { parameters: req.params })
if (areValidationErrors(req, res)) return
2017-11-27 17:30:46 +01:00
if (!await isVideoExist(req.params.id, res)) return
2017-12-12 17:53:50 +01:00
const share = await VideoShareModel.load(req.params.accountId, res.locals.video.id, undefined)
if (!share) {
return res.status(404)
.end()
}
res.locals.videoShare = share
return next()
}
]
Users can change ownership of their video [#510] (#888) * [#510] Create a new route to get the list of user names To be able to transfer ownership to a user, we need to be able to select him from the list of users. Because the list could be too big, we add a autocomplete feature. This commit does the following: * Add a API endpoint to get a list of user names by searching its name * [#510] The user can choose the next owner of the video To be able to transfer ownership to a user, we need the owner to be able to select the user. The server can autocomplete the name of the user to give the ownership. We add a dialog for the user to actually select it. This commit does the following: * Create a modal for the owner to select the next one * Opens this modal with a button into the menu *more* * Make the dependency injection * [#510] When the user choose the next owner, create a request in database For the change of ownership to happen, we need to store the temporary requests. When the user make the request, save it to database. This commit does the following: * Create the model to persist change ownership requests * Add an API to manage ownership operations * Add a route to persist an ownership request * [#510] A user can fetch its ownership requests sent to him To be able to accept or refuse a change of ownership, the user must be able to fetch them. This commit does the following: * Add an API to list ownership for a user * Add the query to database model * [#510] A user can validate an ownership requests sent to him - server The user can accept or refuse any ownership request that was sent to him. This commit focus only on the server part. This commit does the following: * Add an API for the user to accept or refuse a video ownership * Add validators to ensure security access * Add a query to load a specific video change ownership request * [#510] A user can validate an ownership requests sent to him - web The user can accept or refuse any ownership request that was sent to him. This commit focus only on the web part. This commit does the following: * Add a page to list user ownership changes * Add actions to accept or refuse them * When accepting, show a modal requiring the channel to send the video * Correct lint - to squash * [#510] PR reviews - to squash This commit does the following: * Search parameter for user autocompletion is required from middleware directly * [#510] PR reviews - to squash with creation in database commit This commit does the following: * Add the status attribute in model * Set this attribute on instance creation * Use AccountModel method `loadLocalByName` * [#510] PR reviews - to squash with fetch ownership This commit does the following: * Add the scope `FULL` for database queries with includes * Add classic pagination middlewares * [#510] PR reviews - to squash with ownership validation - server This commit does the following: * Add a middleware to validate whether a user can validate an ownership * Change the ownership status instead of deleting the row * [#510] PR reviews - to squash with ownership validation - client This commit does the following: * Correct indentation of html files with two-spaces indentation * Use event emitter instead of function for accept event * Update the sort of ownership change table for a decreasing order by creation date * Add the status in ownership change table * Use classic method syntax * code style - to squash * Add new user right - to squash * Move the change to my-account instead of video-watch - to squash As requested in pull-request, move the action to change ownership into my videos page. The rest of the logic was not really changed. This commit does the following: - Move the modal into my video page - Create the generic component `button` to keep some styles and logic * [#510] Add tests for the new feature To avoid regression, we add tests for all api of ownership change. This commit does the following: - Create an end-to-end test for ownership change - Divide it to one test per request * [#510] Do not send twice the same request to avoid spam We can send several time the same request to change ownership. However, it will spam the user. To avoid this, we do not save a request already existing in database. This commit does the following: - Check whether the request exist in database - Add tests to verify this new condition * [#510] Change icons Change icons so they remains logic with the rest of the application. This commit does the following: - Add svg for missing icons - Add icons in `my-button` component - Use these new icons * [#510] Add control about the user quota The user should be able to accept a new video only if his quota allows it. This commit does the following: - Update the middleware to control the quota - Add tests verifying the control * Correct merge - Use new modal system - Move button to new directory `buttons` * PR reviews - to squash
2018-09-04 08:57:13 +02:00
const videosChangeOwnershipValidator = [
param('videoId').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
logger.debug('Checking changeOwnership parameters', { parameters: req.params })
if (areValidationErrors(req, res)) return
if (!await isVideoExist(req.params.videoId, res)) return
// Check if the user who did the request is able to change the ownership of the video
if (!checkUserCanManageVideo(res.locals.oauth.token.User, res.locals.video, UserRight.CHANGE_VIDEO_OWNERSHIP, res)) return
const nextOwner = await AccountModel.loadLocalByName(req.body.username)
if (!nextOwner) {
res.status(400)
.type('json')
.end()
return
}
res.locals.nextOwner = nextOwner
return next()
}
]
const videosTerminateChangeOwnershipValidator = [
param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
logger.debug('Checking changeOwnership parameters', { parameters: req.params })
if (areValidationErrors(req, res)) return
if (!await doesChangeVideoOwnershipExist(req.params.id, res)) return
// Check if the user who did the request is able to change the ownership of the video
if (!checkUserCanTerminateOwnershipChange(res.locals.oauth.token.User, res.locals.videoChangeOwnership, res)) return
return next()
},
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
const videoChangeOwnership = res.locals.videoChangeOwnership as VideoChangeOwnershipModel
if (videoChangeOwnership.status === VideoChangeOwnershipStatus.WAITING) {
return next()
} else {
res.status(403)
.json({ error: 'Ownership already accepted or refused' })
.end()
return
}
}
]
const videosAcceptChangeOwnershipValidator = [
async (req: express.Request, res: express.Response, next: express.NextFunction) => {
const body = req.body as VideoChangeOwnershipAccept
if (!await isVideoChannelOfAccountExist(body.channelId, res.locals.oauth.token.User, res)) return
const user = res.locals.oauth.token.User
const videoChangeOwnership = res.locals.videoChangeOwnership as VideoChangeOwnershipModel
const isAble = await user.isAbleToUploadVideo(videoChangeOwnership.Video.getOriginalFile())
if (isAble === false) {
res.status(403)
.json({ error: 'The user video quota is exceeded with this video.' })
.end()
return
}
return next()
}
]
2018-07-16 14:58:22 +02:00
function getCommonVideoAttributes () {
return [
body('thumbnailfile')
.custom((value, { req }) => isVideoImage(req.files, 'thumbnailfile')).withMessage(
'This thumbnail file is not supported or too large. Please, make sure it is of the following type: '
+ CONSTRAINTS_FIELDS.VIDEOS.IMAGE.EXTNAME.join(', ')
),
body('previewfile')
.custom((value, { req }) => isVideoImage(req.files, 'previewfile')).withMessage(
'This preview file is not supported or too large. Please, make sure it is of the following type: '
+ CONSTRAINTS_FIELDS.VIDEOS.IMAGE.EXTNAME.join(', ')
),
body('category')
.optional()
.customSanitizer(toIntOrNull)
.custom(isVideoCategoryValid).withMessage('Should have a valid category'),
body('licence')
.optional()
.customSanitizer(toIntOrNull)
.custom(isVideoLicenceValid).withMessage('Should have a valid licence'),
body('language')
.optional()
.customSanitizer(toValueOrNull)
.custom(isVideoLanguageValid).withMessage('Should have a valid language'),
body('nsfw')
.optional()
.toBoolean()
.custom(isBooleanValid).withMessage('Should have a valid NSFW attribute'),
body('waitTranscoding')
.optional()
.toBoolean()
.custom(isBooleanValid).withMessage('Should have a valid wait transcoding attribute'),
body('privacy')
.optional()
.toInt()
.custom(isVideoPrivacyValid).withMessage('Should have correct video privacy'),
body('description')
.optional()
.customSanitizer(toValueOrNull)
.custom(isVideoDescriptionValid).withMessage('Should have a valid description'),
body('support')
.optional()
.customSanitizer(toValueOrNull)
.custom(isVideoSupportValid).withMessage('Should have a valid support text'),
body('tags')
.optional()
.customSanitizer(toValueOrNull)
.custom(isVideoTagsValid).withMessage('Should have correct tags'),
body('commentsEnabled')
.optional()
.toBoolean()
.custom(isBooleanValid).withMessage('Should have comments enabled boolean'),
body('scheduleUpdate')
.optional()
.customSanitizer(toValueOrNull),
body('scheduleUpdate.updateAt')
.optional()
.custom(isDateValid).withMessage('Should have a valid schedule update date'),
body('scheduleUpdate.privacy')
.optional()
.toInt()
.custom(isScheduleVideoUpdatePrivacyValid).withMessage('Should have correct schedule update privacy')
] as (ValidationChain | express.Handler)[]
}
// ---------------------------------------------------------------------------
export {
videosAddValidator,
videosUpdateValidator,
videosGetValidator,
videosCustomGetValidator,
videosRemoveValidator,
videosShareValidator,
videoRateValidator,
Users can change ownership of their video [#510] (#888) * [#510] Create a new route to get the list of user names To be able to transfer ownership to a user, we need to be able to select him from the list of users. Because the list could be too big, we add a autocomplete feature. This commit does the following: * Add a API endpoint to get a list of user names by searching its name * [#510] The user can choose the next owner of the video To be able to transfer ownership to a user, we need the owner to be able to select the user. The server can autocomplete the name of the user to give the ownership. We add a dialog for the user to actually select it. This commit does the following: * Create a modal for the owner to select the next one * Opens this modal with a button into the menu *more* * Make the dependency injection * [#510] When the user choose the next owner, create a request in database For the change of ownership to happen, we need to store the temporary requests. When the user make the request, save it to database. This commit does the following: * Create the model to persist change ownership requests * Add an API to manage ownership operations * Add a route to persist an ownership request * [#510] A user can fetch its ownership requests sent to him To be able to accept or refuse a change of ownership, the user must be able to fetch them. This commit does the following: * Add an API to list ownership for a user * Add the query to database model * [#510] A user can validate an ownership requests sent to him - server The user can accept or refuse any ownership request that was sent to him. This commit focus only on the server part. This commit does the following: * Add an API for the user to accept or refuse a video ownership * Add validators to ensure security access * Add a query to load a specific video change ownership request * [#510] A user can validate an ownership requests sent to him - web The user can accept or refuse any ownership request that was sent to him. This commit focus only on the web part. This commit does the following: * Add a page to list user ownership changes * Add actions to accept or refuse them * When accepting, show a modal requiring the channel to send the video * Correct lint - to squash * [#510] PR reviews - to squash This commit does the following: * Search parameter for user autocompletion is required from middleware directly * [#510] PR reviews - to squash with creation in database commit This commit does the following: * Add the status attribute in model * Set this attribute on instance creation * Use AccountModel method `loadLocalByName` * [#510] PR reviews - to squash with fetch ownership This commit does the following: * Add the scope `FULL` for database queries with includes * Add classic pagination middlewares * [#510] PR reviews - to squash with ownership validation - server This commit does the following: * Add a middleware to validate whether a user can validate an ownership * Change the ownership status instead of deleting the row * [#510] PR reviews - to squash with ownership validation - client This commit does the following: * Correct indentation of html files with two-spaces indentation * Use event emitter instead of function for accept event * Update the sort of ownership change table for a decreasing order by creation date * Add the status in ownership change table * Use classic method syntax * code style - to squash * Add new user right - to squash * Move the change to my-account instead of video-watch - to squash As requested in pull-request, move the action to change ownership into my videos page. The rest of the logic was not really changed. This commit does the following: - Move the modal into my video page - Create the generic component `button` to keep some styles and logic * [#510] Add tests for the new feature To avoid regression, we add tests for all api of ownership change. This commit does the following: - Create an end-to-end test for ownership change - Divide it to one test per request * [#510] Do not send twice the same request to avoid spam We can send several time the same request to change ownership. However, it will spam the user. To avoid this, we do not save a request already existing in database. This commit does the following: - Check whether the request exist in database - Add tests to verify this new condition * [#510] Change icons Change icons so they remains logic with the rest of the application. This commit does the following: - Add svg for missing icons - Add icons in `my-button` component - Use these new icons * [#510] Add control about the user quota The user should be able to accept a new video only if his quota allows it. This commit does the following: - Update the middleware to control the quota - Add tests verifying the control * Correct merge - Use new modal system - Move button to new directory `buttons` * PR reviews - to squash
2018-09-04 08:57:13 +02:00
videosChangeOwnershipValidator,
videosTerminateChangeOwnershipValidator,
videosAcceptChangeOwnershipValidator,
getCommonVideoAttributes
}
// ---------------------------------------------------------------------------
function areErrorsInScheduleUpdate (req: express.Request, res: express.Response) {
if (req.body.scheduleUpdate) {
if (!req.body.scheduleUpdate.updateAt) {
res.status(400)
.json({ error: 'Schedule update at is mandatory.' })
.end()
return true
}
}
return false
}