HMC/handmade-revolt-backend
6
0
Fork 0
forked from jmug/stoatchat
Code Pull Requests Actions Packages Releases 2 Activity

feat: allow editing owned bots using user edit route

Browse Source
This commit is contained in:
Paul Makles
2023-05-31 17:10:57 +01:00
parent bca17b11a7
commit 4abd4070f7
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
crates/delta/src/routes/users/edit_user.rs
View File

@@ -66,14 +66,20 @@ pub async fn req(
// If we want to edit a different user than self, ensure we have
// permissions and subsequently replace the user in question
if target.id != "@me" {
if !user.privileged {
if target.id != "@me" && target.id != user.id {
let target_user = target.as_user(db).await?;
let is_bot_owner = target_user
.bot
.map(|bot| bot.owner == user.id)
.unwrap_or_default();
if !is_bot_owner && !user.privileged {
return Err(Error::NotPrivileged);
}
}
user = target.as_user(db).await?;
// Otherwise, filter out invalid edit fields
} else if data.badges.is_some() || data.flags.is_some() {
if !user.privileged && (data.badges.is_some() || data.flags.is_some()) {
return Err(Error::NotPrivileged);
}