From c2b82cdeb7a4dff70d6ae6d82e15a1eb7167fe22 Mon Sep 17 00:00:00 2001
From: juancarmore <juancar_more2@hotmail.com>
Date: Fri, 14 Mar 2025 01:39:20 +0100
Subject: [PATCH] backend: Refactor recording middleware to include permission
 checks and update route handlers

---
 .../src/middlewares/recording.middleware.ts   | 54 +++++++++++--------
 backend/src/routes/recording.routes.ts        | 13 +++--
 2 files changed, 40 insertions(+), 27 deletions(-)

diff --git a/backend/src/middlewares/recording.middleware.ts b/backend/src/middlewares/recording.middleware.ts
index b720845..d3c3e3b 100644
--- a/backend/src/middlewares/recording.middleware.ts
+++ b/backend/src/middlewares/recording.middleware.ts
@@ -1,35 +1,43 @@
 import { container } from '../config/dependency-injector.config.js';
 import { Request, Response, NextFunction } from 'express';
-import { GlobalPreferencesService } from '../services/preferences/index.js';
-import { RoomPreferences } from '@typings-ce';
+import { OpenViduMeetPermissions, OpenViduMeetRoom } from '@typings-ce';
 import { LoggerService } from '../services/logger.service.js';
+import { RoomService } from '../services/room.service.js';
 
-export const withRecordingEnabled = async (req: Request, res: Response, next: NextFunction) => {
+export const withRecordingEnabledAndCorrectPermissions = async (req: Request, res: Response, next: NextFunction) => {
 	const logger = container.get(LoggerService);
 
 	try {
+		// TODO: Think how to get the roomName from the request
+		const roomName = req.body.roomName;
+		const payload = req.body.payload;
+		const roomService = container.get(RoomService);
+		const room: OpenViduMeetRoom = await roomService.getOpenViduRoom(roomName);
+		console.log('room', room);
+
+		if (!room.preferences) {
+			logger.error('No room preferences found checking recording preferences. Refusing access');
+			return res.status(403).json({ message: 'Recording is disabled in this room' });
+		}
+
+		const { recordingPreferences } = room.preferences;
+		const { enabled: recordingEnabled } = recordingPreferences;
+
+		if (!recordingEnabled) {
+			return res.status(403).json({ message: 'Recording is disabled in this room' });
+		}
+
+		const sameRoom = payload.video.room === roomName;
+		const permissions = payload.metadata?.permissions as OpenViduMeetPermissions;
+		const canRecord = permissions?.canRecord === true;
+
+		if (!sameRoom || !canRecord) {
+			return res.status(403).json({ message: 'Insufficient permissions to record in this room' });
+		}
+
 		return next();
-
-		// TODO: Think how get the roomName from the request
-
-		// const roomName = req.body.roomName;
-		// const preferenceService = container.get(GlobalPreferencesService);
-		// const preferences: RoomPreferences | null = await preferenceService.getOpenViduRoomPreferences(roomName);
-
-		// if (preferences) {
-		// 	const { recordingPreferences } = preferences;
-
-		// 	if (!recordingPreferences.enabled) {
-		// 		return res.status(403).json({ message: 'Recording is disabled in this room.' });
-		// 	}
-
-		// 	return next();
-		// }
-
-		// logger.error('No room preferences found checking recording preferences. Refusing access.');
-		// return res.status(403).json({ message: 'Recording is disabled in this room.' });
 	} catch (error) {
 		logger.error('Error checking recording preferences:' + error);
-		return res.status(403).json({ message: 'Recording is disabled in this room.' });
+		return res.status(403).json({ message: 'Recording is disabled in this room' });
 	}
 };
diff --git a/backend/src/routes/recording.routes.ts b/backend/src/routes/recording.routes.ts
index 48bf2bb..11d7d8c 100644
--- a/backend/src/routes/recording.routes.ts
+++ b/backend/src/routes/recording.routes.ts
@@ -1,8 +1,8 @@
 import { Router } from 'express';
 import bodyParser from 'body-parser';
 import * as recordingCtrl from '../controllers/recording.controller.js';
-import { withUserBasicAuth } from '../middlewares/auth.middleware.js';
-import { withRecordingEnabled } from '../middlewares/recording.middleware.js';
+import { withParticipantValidToken, withUserBasicAuth } from '../middlewares/auth.middleware.js';
+import { withRecordingEnabledAndCorrectPermissions } from '../middlewares/recording.middleware.js';
 
 export const recordingRouter = Router();
 
@@ -10,8 +10,13 @@ recordingRouter.use(bodyParser.urlencoded({ extended: true }));
 recordingRouter.use(bodyParser.json());
 
 // Recording Routes
-recordingRouter.post('/', withUserBasicAuth, /*withRecordingEnabled,*/ recordingCtrl.startRecording);
-recordingRouter.put('/:recordingId', withUserBasicAuth,/* withRecordingEnabled,*/ recordingCtrl.stopRecording);
+recordingRouter.post(
+	'/',
+	withParticipantValidToken,
+	withRecordingEnabledAndCorrectPermissions,
+	recordingCtrl.startRecording
+);
+recordingRouter.put('/:recordingId', withUserBasicAuth, /* withRecordingEnabled,*/ recordingCtrl.stopRecording);
 recordingRouter.get('/:recordingId/stream', /*withRecordingEnabled,*/ recordingCtrl.streamRecording);
 recordingRouter.delete(
 	'/:recordingId',