} from '../../../helpers/custom-validators/videos'
import { getDurationFromVideoFile } from '../../../helpers/ffmpeg-utils'
import { logger } from '../../../helpers/logger'
-import { CONSTRAINTS_FIELDS } from '../../../initializers'
-import { authenticate } from '../../oauth'
+import { CONFIG, CONSTRAINTS_FIELDS } from '../../../initializers'
+import { authenticatePromiseIfNeeded } from '../../oauth'
import { areValidationErrors } from '../utils'
import { cleanUpReqFiles } from '../../../helpers/express-utils'
import { VideoModel } from '../../../models/video/video'
import { AccountModel } from '../../../models/account/account'
import { VideoFetchType } from '../../../helpers/video'
import { isNSFWQueryValid, isNumberArray, isStringArray } from '../../../helpers/custom-validators/search'
+import { getServerActor } from '../../../helpers/utils'
const videosAddValidator = getCommonVideoAttributes().concat([
body('videofile')
}
])
+async function checkVideoFollowConstraints (req: express.Request, res: express.Response, next: express.NextFunction) {
+ const video: VideoModel = res.locals.video
+
+ // Anybody can watch local videos
+ if (video.isOwned() === true) return next()
+
+ // Logged user
+ if (res.locals.oauth) {
+ // Users can search or watch remote videos
+ if (CONFIG.SEARCH.REMOTE_URI.USERS === true) return next()
+ }
+
+ // Anybody can search or watch remote videos
+ if (CONFIG.SEARCH.REMOTE_URI.ANONYMOUS === true) return next()
+
+ // Check our instance follows an actor that shared this video
+ const serverActor = await getServerActor()
+ if (await VideoModel.checkVideoHasInstanceFollow(video.id, serverActor.id) === true) return next()
+
+ return res.status(403)
+ .json({
+ error: 'Cannot get this video regarding follow constraints.'
+ })
+}
+
const videosCustomGetValidator = (fetchType: VideoFetchType) => {
return [
param('id').custom(isIdOrUUIDValid).not().isEmpty().withMessage('Should have a valid id'),
// Video private or blacklisted
if (video.privacy === VideoPrivacy.PRIVATE || video.VideoBlacklist) {
- return authenticate(req, res, () => {
- const user: UserModel = res.locals.oauth.token.User
+ await authenticatePromiseIfNeeded(req, res)
+
+ const user: UserModel = res.locals.oauth ? res.locals.oauth.token.User : null
- // Only the owner or a user that have blacklist rights can see the video
- if (video.VideoChannel.Account.userId !== user.id && !user.hasRight(UserRight.MANAGE_VIDEO_BLACKLIST)) {
- return res.status(403)
- .json({ error: 'Cannot get this private or blacklisted video.' })
- }
+ // Only the owner or a user that have blacklist rights can see the video
+ if (
+ !user ||
+ (video.VideoChannel.Account.userId !== user.id && !user.hasRight(UserRight.MANAGE_VIDEO_BLACKLIST))
+ ) {
+ return res.status(403)
+ .json({ error: 'Cannot get this private or blacklisted video.' })
+ }
- return next()
- })
+ return next()
}
// Video is public, anyone can access it
videosAddValidator,
videosUpdateValidator,
videosGetValidator,
+ checkVideoFollowConstraints,
videosCustomGetValidator,
videosRemoveValidator,
--- /dev/null
+/* tslint:disable:no-unused-expression */
+
+import * as chai from 'chai'
+import 'mocha'
+import { doubleFollow, getAccountVideos, getVideo, getVideoChannelVideos, getVideoWithToken } from '../../utils'
+import { flushAndRunMultipleServers, killallServers, ServerInfo, setAccessTokensToServers, uploadVideo } from '../../utils/index'
+import { unfollow } from '../../utils/server/follows'
+import { userLogin } from '../../utils/users/login'
+import { createUser } from '../../utils/users/users'
+
+const expect = chai.expect
+
+describe('Test follow constraints', function () {
+ let servers: ServerInfo[] = []
+ let video1UUID: string
+ let video2UUID: string
+ let userAccessToken: string
+
+ before(async function () {
+ this.timeout(30000)
+
+ servers = await flushAndRunMultipleServers(2)
+
+ // Get the access tokens
+ await setAccessTokensToServers(servers)
+
+ {
+ const res = await uploadVideo(servers[ 0 ].url, servers[ 0 ].accessToken, { name: 'video server 1' })
+ video1UUID = res.body.video.uuid
+ }
+ {
+ const res = await uploadVideo(servers[ 1 ].url, servers[ 1 ].accessToken, { name: 'video server 2' })
+ video2UUID = res.body.video.uuid
+ }
+
+ const user = {
+ username: 'user1',
+ password: 'super_password'
+ }
+ await createUser(servers[0].url, servers[0].accessToken, user.username, user.password)
+ userAccessToken = await userLogin(servers[0], user)
+
+ await doubleFollow(servers[0], servers[1])
+ })
+
+ describe('With a followed instance', function () {
+
+ describe('With an unlogged user', function () {
+
+ it('Should get the local video', async function () {
+ await getVideo(servers[0].url, video1UUID, 200)
+ })
+
+ it('Should get the remote video', async function () {
+ await getVideo(servers[0].url, video2UUID, 200)
+ })
+
+ it('Should list local account videos', async function () {
+ const res = await getAccountVideos(servers[0].url, undefined, 'root@localhost:9001', 0, 5)
+
+ expect(res.body.total).to.equal(1)
+ expect(res.body.data).to.have.lengthOf(1)
+ })
+
+ it('Should list remote account videos', async function () {
+ const res = await getAccountVideos(servers[0].url, undefined, 'root@localhost:9002', 0, 5)
+
+ expect(res.body.total).to.equal(1)
+ expect(res.body.data).to.have.lengthOf(1)
+ })
+
+ it('Should list local channel videos', async function () {
+ const res = await getVideoChannelVideos(servers[0].url, undefined, 'root_channel@localhost:9001', 0, 5)
+
+ expect(res.body.total).to.equal(1)
+ expect(res.body.data).to.have.lengthOf(1)
+ })
+
+ it('Should list remote channel videos', async function () {
+ const res = await getVideoChannelVideos(servers[0].url, undefined, 'root_channel@localhost:9002', 0, 5)
+
+ expect(res.body.total).to.equal(1)
+ expect(res.body.data).to.have.lengthOf(1)
+ })
+ })
+
+ describe('With a logged user', function () {
+ it('Should get the local video', async function () {
+ await getVideoWithToken(servers[0].url, userAccessToken, video1UUID, 200)
+ })
+
+ it('Should get the remote video', async function () {
+ await getVideoWithToken(servers[0].url, userAccessToken, video2UUID, 200)
+ })
+
+ it('Should list local account videos', async function () {
+ const res = await getAccountVideos(servers[0].url, userAccessToken, 'root@localhost:9001', 0, 5)
+
+ expect(res.body.total).to.equal(1)
+ expect(res.body.data).to.have.lengthOf(1)
+ })
+
+ it('Should list remote account videos', async function () {
+ const res = await getAccountVideos(servers[0].url, userAccessToken, 'root@localhost:9002', 0, 5)
+
+ expect(res.body.total).to.equal(1)
+ expect(res.body.data).to.have.lengthOf(1)
+ })
+
+ it('Should list local channel videos', async function () {
+ const res = await getVideoChannelVideos(servers[0].url, userAccessToken, 'root_channel@localhost:9001', 0, 5)
+
+ expect(res.body.total).to.equal(1)
+ expect(res.body.data).to.have.lengthOf(1)
+ })
+
+ it('Should list remote channel videos', async function () {
+ const res = await getVideoChannelVideos(servers[0].url, userAccessToken, 'root_channel@localhost:9002', 0, 5)
+
+ expect(res.body.total).to.equal(1)
+ expect(res.body.data).to.have.lengthOf(1)
+ })
+ })
+ })
+
+ describe('With a non followed instance', function () {
+
+ before(async function () {
+ this.timeout(30000)
+
+ await unfollow(servers[0].url, servers[0].accessToken, servers[1])
+ })
+
+ describe('With an unlogged user', function () {
+
+ it('Should get the local video', async function () {
+ await getVideo(servers[0].url, video1UUID, 200)
+ })
+
+ it('Should not get the remote video', async function () {
+ await getVideo(servers[0].url, video2UUID, 403)
+ })
+
+ it('Should list local account videos', async function () {
+ const res = await getAccountVideos(servers[0].url, undefined, 'root@localhost:9001', 0, 5)
+
+ expect(res.body.total).to.equal(1)
+ expect(res.body.data).to.have.lengthOf(1)
+ })
+
+ it('Should not list remote account videos', async function () {
+ const res = await getAccountVideos(servers[0].url, undefined, 'root@localhost:9002', 0, 5)
+
+ expect(res.body.total).to.equal(0)
+ expect(res.body.data).to.have.lengthOf(0)
+ })
+
+ it('Should list local channel videos', async function () {
+ const res = await getVideoChannelVideos(servers[0].url, undefined, 'root_channel@localhost:9001', 0, 5)
+
+ expect(res.body.total).to.equal(1)
+ expect(res.body.data).to.have.lengthOf(1)
+ })
+
+ it('Should not list remote channel videos', async function () {
+ const res = await getVideoChannelVideos(servers[0].url, undefined, 'root_channel@localhost:9002', 0, 5)
+
+ expect(res.body.total).to.equal(0)
+ expect(res.body.data).to.have.lengthOf(0)
+ })
+ })
+
+ describe('With a logged user', function () {
+ it('Should get the local video', async function () {
+ await getVideoWithToken(servers[0].url, userAccessToken, video1UUID, 200)
+ })
+
+ it('Should get the remote video', async function () {
+ await getVideoWithToken(servers[0].url, userAccessToken, video2UUID, 200)
+ })
+
+ it('Should list local account videos', async function () {
+ const res = await getAccountVideos(servers[0].url, userAccessToken, 'root@localhost:9001', 0, 5)
+
+ expect(res.body.total).to.equal(1)
+ expect(res.body.data).to.have.lengthOf(1)
+ })
+
+ it('Should list remote account videos', async function () {
+ const res = await getAccountVideos(servers[0].url, userAccessToken, 'root@localhost:9002', 0, 5)
+
+ expect(res.body.total).to.equal(1)
+ expect(res.body.data).to.have.lengthOf(1)
+ })
+
+ it('Should list local channel videos', async function () {
+ const res = await getVideoChannelVideos(servers[0].url, userAccessToken, 'root_channel@localhost:9001', 0, 5)
+
+ expect(res.body.total).to.equal(1)
+ expect(res.body.data).to.have.lengthOf(1)
+ })
+
+ it('Should list remote channel videos', async function () {
+ const res = await getVideoChannelVideos(servers[0].url, userAccessToken, 'root_channel@localhost:9002', 0, 5)
+
+ expect(res.body.total).to.equal(1)
+ expect(res.body.data).to.have.lengthOf(1)
+ })
+ })
+ })
+
+ after(async function () {
+ killallServers(servers)
+ })
+})
projects / oweals / peertube.git / commitdiff