HMC/handmade-revolt-backend
6
0
Fork 0
forked from jmug/stoatchat
Code Pull Requests Actions Packages Releases 2 Activity

feat(perms): consistently throw correct permissions

Browse Source
This commit is contained in:
Paul Makles
2022-02-22 21:41:12 +00:00
parent 7befd77c5b
commit 4c40c6c2cc
33 changed files with 134 additions and 264 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/routes/channels/channel_ack.rs
View File

@@ -1,16 +1,12 @@
use revolt_quark::{models::User, perms, Db, EmptyResponse, Error, Ref, Result};
use revolt_quark::{models::User, perms, Db, EmptyResponse, Permission, Ref, Result};
#[put("/<target>/ack/<message>")]
pub async fn req(db: &Db, user: User, target: Ref, message: Ref) -> Result<EmptyResponse> {
let channel = target.as_channel(db).await?;
if !perms(&user)
perms(&user)
.channel(&channel)
.calc(db)
.await
.can_view_channel()
{
return Err(Error::NotFound);
}
.throw_permission(db, Permission::ViewChannel)
.await?;
channel
.ack(db, &user.id, &message.id)

17
src/routes/channels/channel_delete.rs
View File

@@ -6,11 +6,8 @@ use revolt_quark::{
#[delete("/<target>")]
pub async fn req(db: &Db, user: User, target: Ref) -> Result<EmptyResponse> {
let channel = target.as_channel(db).await?;
let perm = perms(&user).channel(&channel).calc(db).await;
if !perm.can_view_channel() {
return Err(Error::NotFound);
}
let mut perms = perms(&user).channel(&channel);
perms.throw_permission(db, Permission::ViewChannel).await?;
match &channel {
Channel::SavedMessages { .. } => Err(Error::NoEffect),
@@ -30,11 +27,11 @@ pub async fn req(db: &Db, user: User, target: Ref) -> Result<EmptyResponse> {
.await
.map(|_| EmptyResponse),
Channel::TextChannel { .. } | Channel::VoiceChannel { .. } => {
if perm.can_manage_channel() {
channel.delete(db).await.map(|_| EmptyResponse)
} else {
Error::from_permission(Permission::ManageChannel)
}
perms
.throw_permission(db, Permission::ManageChannel)
.await?;
channel.delete(db).await.map(|_| EmptyResponse)
}
}
}

10
src/routes/channels/channel_edit.rs
View File

@@ -38,14 +38,10 @@ pub async fn req(
.map_err(|error| Error::FailedValidation { error })?;
let mut channel = target.as_channel(db).await?;
if !perms(&user)
perms(&user)
.channel(&channel)
.calc(db)
.await
.can_manage_channel()
{
return Error::from_permission(Permission::ManageChannel);
}
.throw_permission_and_view_channel(db, Permission::ManageChannel)
.await?;
if data.name.is_none()
&& data.description.is_none()

19
src/routes/channels/channel_fetch.rs
View File

@@ -1,22 +1,17 @@
use revolt_quark::{
models::{Channel, User},
perms, Database, Error, Permission, Ref, Result,
perms, Database, Permission, Ref, Result,
};
use rocket::{serde::json::Json, State};
#[get("/<target>")]
pub async fn req(db: &State<Database>, user: User, target: Ref) -> Result<Json<Channel>> {
let target = target.as_channel(db).await?;
let channel = target.as_channel(db).await?;
perms(&user)
.channel(&channel)
.throw_permission(db, Permission::ViewChannel)
.await?;
if perms(&user)
.channel(&target)
.calc(db)
.await
.can_view_channel()
{
Ok(Json(target))
} else {
Error::from_permission(Permission::ViewChannel)
}
Ok(Json(channel))
}

10
src/routes/channels/group_add_member.rs
View File

@@ -6,14 +6,10 @@ use revolt_quark::{
#[put("/<target>/recipients/<member>")]
pub async fn req(db: &Db, user: User, target: Ref, member: Ref) -> Result<EmptyResponse> {
let channel = target.as_channel(db).await?;
if !perms(&user)
perms(&user)
.channel(&channel)
.calc(db)
.await
.can_invite_others()
{
return Error::from_permission(Permission::InviteOthers);
}
.throw_permission_and_view_channel(db, Permission::InviteOthers)
.await?;
match &channel {
Channel::Group { .. } => {

13
src/routes/channels/invite_create.rs
View File

@@ -1,6 +1,6 @@
use revolt_quark::{
models::{Invite, User},
perms, Db, Error, Permission, Ref, Result,
perms, Db, Permission, Ref, Result,
};
use rocket::serde::json::Json;
@@ -8,15 +8,10 @@ use rocket::serde::json::Json;
#[post("/<target>/invites")]
pub async fn req(db: &Db, user: User, target: Ref) -> Result<Json<Invite>> {
let channel = target.as_channel(db).await?;
if !perms(&user)
perms(&user)
.channel(&channel)
.calc(db)
.await
.can_invite_others()
{
return Error::from_permission(Permission::InviteOthers);
}
.throw_permission_and_view_channel(db, Permission::InviteOthers)
.await?;
Invite::create(db, &user, &channel).await.map(Json)
}

12
src/routes/channels/members_fetch.rs
View File

@@ -1,6 +1,6 @@
use revolt_quark::{
models::{Channel, User},
perms, Db, Error, Ref, Result,
perms, Db, Error, Permission, Ref, Result,
};
use rocket::serde::json::Json;
@@ -8,14 +8,10 @@ use rocket::serde::json::Json;
#[get("/<target>/members")]
pub async fn req(db: &Db, user: User, target: Ref) -> Result<Json<Vec<User>>> {
let channel = target.as_channel(db).await?;
if !perms(&user)
perms(&user)
.channel(&channel)
.calc(db)
.await
.can_view_channel()
{
return Err(Error::NotFound);
}
.throw_permission(db, Permission::ViewChannel)
.await?;
if let Channel::Group { recipients, .. } = channel {
Ok(Json(

5
src/routes/channels/message_delete.rs
View File

@@ -11,9 +11,8 @@ pub async fn req(db: &Db, user: User, target: Ref, msg: Ref) -> Result<EmptyResp
|| !{
perms(&user)
.channel(&target.as_channel(db).await?)
.calc(db)
.await
.can_manage_messages()
.has_permission(db, Permission::ManageMessages)
.await?
}
{
return Error::from_permission(Permission::ManageMessages);

12
src/routes/channels/message_fetch.rs
View File

@@ -1,6 +1,6 @@
use revolt_quark::{
models::{Message, User},
perms, Db, Error, Ref, Result,
perms, Db, Error, Permission, Ref, Result,
};
use rocket::serde::json::Json;
@@ -8,14 +8,10 @@ use rocket::serde::json::Json;
#[get("/<target>/messages/<msg>")]
pub async fn req(db: &Db, user: User, target: Ref, msg: Ref) -> Result<Json<Message>> {
let channel = target.as_channel(db).await?;
if !perms(&user)
perms(&user)
.channel(&channel)
.calc(db)
.await
.can_view_channel()
{
return Err(Error::NotFound);
}
.throw_permission(db, Permission::ViewChannel)
.await?;
let message = msg.as_message(db).await?;
if message.channel != channel.as_id() {

12
src/routes/channels/message_query.rs
View File

@@ -3,7 +3,7 @@ use revolt_quark::{
message::{BulkMessageResponse, MessageSort},
User,
},
perms, Db, Error, Ref, Result,
perms, Db, Error, Permission, Ref, Result,
};
use rocket::serde::json::Json;
use serde::{Deserialize, Serialize};
@@ -42,14 +42,10 @@ pub async fn req(
}
let channel = target.as_channel(db).await?;
if !perms(&user)
perms(&user)
.channel(&channel)
.calc(db)
.await
.can_view_channel()
{
return Err(Error::NotFound);
}
.throw_permission_and_view_channel(db, Permission::ReadMessageHistory)
.await?;
let Options {
limit,

12
src/routes/channels/message_search.rs
View File

@@ -3,7 +3,7 @@ use revolt_quark::{
message::{BulkMessageResponse, MessageSort},
User,
},
perms, Db, Error, Ref, Result,
perms, Db, Error, Permission, Ref, Result,
};
use rocket::serde::json::Json;
@@ -39,14 +39,10 @@ pub async fn req(
.map_err(|error| Error::FailedValidation { error })?;
let channel = target.as_channel(db).await?;
if !perms(&user)
perms(&user)
.channel(&channel)
.calc(db)
.await
.can_view_channel()
{
return Err(Error::NotFound);
}
.throw_permission_and_view_channel(db, Permission::ReadMessageHistory)
.await?;
let Options {
query,

25
src/routes/channels/message_send.rs
View File

@@ -51,11 +51,10 @@ pub async fn message_send(
idempotency.consume_nonce(data.nonce).await?;
let channel = target.as_channel(db).await?;
let permissions = perms(&user).channel(&channel).calc(db).await;
if !permissions.can_send_message() {
return Error::from_permission(Permission::SendMessage);
}
let mut permissions = perms(&user).channel(&channel);
permissions
.throw_permission_and_view_channel(db, Permission::SendMessage)
.await?;
if data.content.is_empty()
&& (data.attachments.is_none() || data.attachments.as_ref().unwrap().is_empty())
@@ -66,8 +65,8 @@ pub async fn message_send(
let message_id = Ulid::new().to_string();
let mut message = Message {
id: message_id.clone(),
channel: channel.as_id(),
author: user.id,
channel: channel.id().to_string(),
author: user.id.clone(),
..Default::default()
};
@@ -80,8 +79,10 @@ pub async fn message_send(
}
// 2. Verify permissions for masquerade.
if data.masquerade.is_some() && !permissions.can_masquerade() {
return Error::from_permission(Permission::Masquerade);
if data.masquerade.is_some() {
permissions
.throw_permission(db, Permission::Masquerade)
.await?;
}
// 3. Verify replies are valid.
@@ -117,8 +118,10 @@ pub async fn message_send(
// 4. Add attachments to message.
let mut attachments = vec![];
if let Some(ids) = &data.attachments {
if !ids.is_empty() && !permissions.can_upload_files() {
return Error::from_permission(Permission::UploadFiles);
if !ids.is_empty() {
permissions
.throw_permission(db, Permission::UploadFiles)
.await?;
}
// ! FIXME: move this to app config

12
src/routes/channels/permissions_set.rs
View File

@@ -3,7 +3,7 @@ use serde::{Deserialize, Serialize};
use revolt_quark::{
models::{Channel, User},
perms, Db, Error, Permission, Ref, Result,
perms, Db, Permission, Ref, Result,
};
#[derive(Serialize, Deserialize)]
@@ -20,14 +20,10 @@ pub async fn req(
data: Json<Data>,
) -> Result<Json<Channel>> {
let mut channel = target.as_channel(db).await?;
if !perms(&user)
perms(&user)
.channel(&channel)
.calc(db)
.await
.can_manage_permissions()
{
return Error::from_permission(Permission::ManageChannel);
}
.throw_permission_and_view_channel(db, Permission::ManagePermissions)
.await?;
// ! FIXME_PERMISSIONS

10
src/routes/channels/permissions_set_default.rs
View File

@@ -14,14 +14,10 @@ pub struct Data {
#[put("/<target>/permissions/default", data = "<data>", rank = 1)]
pub async fn req(db: &Db, user: User, target: Ref, data: Json<Data>) -> Result<Json<Channel>> {
let mut channel = target.as_channel(db).await?;
if !perms(&user)
perms(&user)
.channel(&channel)
.calc(db)
.await
.can_manage_permissions()
{
return Error::from_permission(Permission::ManagePermissions);
}
.throw_permission_and_view_channel(db, Permission::ManagePermissions)
.await?;
match &channel {
Channel::Group { .. } => {