feat: reintroduce permission checks for send

Cargo.lock

@@ -2837,7 +2837,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-bonfire"
-version = "0.5.21"
+version = "0.5.22"
 dependencies = [
  "async-std",
  "async-tungstenite",
@@ -2882,7 +2882,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-delta"
-version = "0.5.21"
+version = "0.5.22"
 dependencies = [
  "async-channel",
  "async-std",
@@ -2955,7 +2955,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-quark"
-version = "0.5.21"
+version = "0.5.22"
 dependencies = [
  "async-lock",
  "async-recursion",

crates/bonfire/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-bonfire"
-version = "0.5.21"
+version = "0.5.22"
 license = "AGPL-3.0-or-later"
 edition = "2021"
 

crates/delta/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-delta"
-version = "0.5.21"
+version = "0.5.22"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <paulmakles@gmail.com>"]
 edition = "2018"

crates/delta/src/routes/channels/message_edit.rs

@@ -44,8 +44,6 @@ pub async fn req(
         .throw_permission_and_view_channel(db, Permission::SendMessage)
         .await?;
 
-    Message::validate_sum(&edit.content, &edit.embeds)?;
-
     let mut message = msg.as_message(db).await?;
     if message.channel != channel.id() {
         return Err(Error::NotFound);
@@ -55,6 +53,12 @@ pub async fn req(
         return Err(Error::CannotEditMessage);
     }
 
+    if let Some(new_embeds) = &edit.embeds {
+        Message::validate_sum(&edit.content, new_embeds)?;
+    } else {
+        Message::validate_sum(&edit.content, &vec![])?;
+    }
+
     message.edited = Some(Timestamp::now_utc());
     let mut partial = PartialMessage {
         edited: message.edited,

crates/delta/src/routes/channels/message_send.rs

@@ -1,11 +1,9 @@
 use revolt_quark::{
-    models::{
+    models::{message::DataMessageSend, Message, User},
-        message::DataMessageSend,
-        Message, User,
-    },
     perms,
+    types::push::MessageAuthor,
     web::idempotency::IdempotencyKey,
-    Db, Error, Permission, Ref, Result, types::push::MessageAuthor,
+    Db, Error, Permission, Ref, Result,
 };
 
 use rocket::serde::json::Json;
@@ -35,7 +33,7 @@ pub async fn message_send(
         .throw_permission_and_view_channel(db, Permission::SendMessage)
         .await?;
 
-    // Verify permissions for masquerade.
+    // Verify permissions for masquerade
     if let Some(masq) = &data.masquerade {
         permissions
             .throw_permission(db, Permission::Masquerade)
@@ -48,8 +46,37 @@ pub async fn message_send(
         }
     }
 
+    // Check permissions for embeds
+    if !data.embeds.is_empty() {
+        permissions
+            .throw_permission(db, Permission::SendEmbeds)
+            .await?;
+    }
+
+    // Check permissions for files
+    if !data.attachments.is_empty() {
+        permissions
+            .throw_permission(db, Permission::UploadFiles)
+            .await?;
+    }
+
+    // Ensure interactions information is correct
+    if let Some(interactions) = &data.interactions {
+        interactions.validate(db, &mut permissions).await?;
+    }
+
     // Create the message
-    let message = channel.send_message(db, data, MessageAuthor::User(&user), idempotency).await?;
+    let message = channel
+        .send_message(
+            db,
+            data,
+            MessageAuthor::User(&user),
+            idempotency,
+            permissions
+                .has_permission(db, Permission::SendEmbeds)
+                .await?,
+        )
+        .await?;
 
     Ok(Json(message))
 }

crates/delta/src/routes/webhooks/webhook_execute.rs

@@ -33,6 +33,9 @@ pub async fn webhook_execute(
 
     webhook.assert_token(&token).map_err(Error::from_core)?;
 
+    // TODO: webhooks can currently always send masquerades, files, embeds, reactions (interactions)
+    // TODO: they can also mention anyone
+
     let channel = legacy_db.fetch_channel(&webhook.channel_id).await?;
     let message = channel
         .send_message(
@@ -40,6 +43,7 @@ pub async fn webhook_execute(
             data,
             MessageAuthor::Webhook(&webhook.into()),
             idempotency,
+            true,
         )
         .await?;
 

crates/quark/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-quark"
-version = "0.5.21"
+version = "0.5.22"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 

crates/quark/src/impl/generic/channels/channel.rs

@@ -409,6 +409,7 @@ impl Channel {
         data: DataMessageSend,
         author: MessageAuthor<'_>,
         mut idempotency: IdempotencyKey,
+        generate_embeds: bool,
     ) -> Result<Message> {
         Message::validate_sum(&data.content, &data.embeds)?;
 
@@ -416,8 +417,8 @@ impl Channel {
 
         // Check the message is not empty
         if (data.content.as_ref().map_or(true, |v| v.is_empty()))
-            && (data.attachments.as_ref().map_or(true, |v| v.is_empty()))
+            && (data.attachments.is_empty())
-            && (data.embeds.as_ref().map_or(true, |v| v.is_empty()))
+            && (data.embeds.is_empty())
         {
             return Err(Error::EmptyMessage);
         }
@@ -496,11 +497,9 @@ impl Channel {
 
         // Process included embeds.
         let mut embeds = vec![];
-        if let Some(sendable_embeds) = data.embeds {
+        for sendable_embed in data.embeds {
-            for sendable_embed in sendable_embeds {
             embeds.push(sendable_embed.into_embed(db, message_id.clone()).await?)
         }
-        }
 
         if !embeds.is_empty() {
             message.embeds.replace(embeds);
@@ -508,25 +507,18 @@ impl Channel {
 
         // Add attachments to message.
         let mut attachments = vec![];
-        if let Some(ids) = &data.attachments {
+        if data.attachments.len() > *MAX_ATTACHMENT_COUNT {
-            if ids.len() > *MAX_ATTACHMENT_COUNT {
             return Err(Error::TooManyAttachments {
                 max: *MAX_ATTACHMENT_COUNT,
             });
         }
 
-            for attachment_id in ids {
+        for attachment_id in data.attachments {
             attachments.push(
-                    db.find_and_use_attachment(
+                db.find_and_use_attachment(&attachment_id, "attachments", "message", &message_id)
-                        attachment_id,
-                        "attachments",
-                        "message",
-                        &message_id,
-                    )
                     .await?,
             );
         }
-        }
 
         if !attachments.is_empty() {
             message.attachments.replace(attachments);
@@ -541,6 +533,7 @@ impl Channel {
         message.create(db, self, Some(author)).await?;
 
         // Queue up a task for processing embeds
+        if generate_embeds {
             if let Some(content) = &message.content {
                 process_embeds::queue(
                     self.id().to_string(),
@@ -549,6 +542,7 @@ impl Channel {
                 )
                 .await;
             }
+        }
 
         Ok(message)
     }

crates/quark/src/impl/generic/channels/message.rs

@@ -18,7 +18,7 @@ use crate::{
     tasks::ack::AckEvent,
     types::{
         january::{Embed, Text},
-        push::{PushNotification, MessageAuthor},
+        push::{MessageAuthor, PushNotification},
     },
     Database, Error, Permission, Result,
 };
@@ -170,22 +170,17 @@ impl Message {
     }
 
     /// Validate the sum of content of a message is under threshold
-    pub fn validate_sum(
+    pub fn validate_sum(content: &Option<String>, embeds: &Vec<SendableEmbed>) -> Result<()> {
-        content: &Option<String>,
-        embeds: &Option<Vec<SendableEmbed>>,
-    ) -> Result<()> {
         let mut running_total = 0;
         if let Some(content) = content {
             running_total += content.len();
         }
 
-        if let Some(embeds) = embeds {
         for embed in embeds {
             if let Some(desc) = &embed.description {
                 running_total += desc.len();
             }
         }
-        }
 
         if running_total <= 2000 {
             Ok(())

crates/quark/src/models/channels/message.rs

@@ -268,15 +268,16 @@ pub struct DataMessageSend {
     #[validate(length(min = 0, max = 2000))]
     pub content: Option<String>,
     /// Attachments to include in message
-    #[validate(length(min = 1, max = 128))]
+    #[serde(default)]
-    pub attachments: Option<Vec<String>>,
+    pub attachments: Vec<String>,
     /// Messages to reply to
     pub replies: Option<Vec<Reply>>,
     /// Embeds to include in message
     ///
     /// Text embed content contributes to the content length cap
+    #[serde(default)]
     #[validate(length(min = 1, max = 10))]
-    pub embeds: Option<Vec<SendableEmbed>>,
+    pub embeds: Vec<SendableEmbed>,
     /// Masquerade to apply to this message
     #[validate]
     pub masquerade: Option<Masquerade>,