fix: add additional checks to group members

Cargo.lock

@@ -2792,7 +2792,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-bonfire"
-version = "0.5.16"
+version = "0.5.17"
 dependencies = [
  "async-std",
  "async-tungstenite",
@@ -2808,7 +2808,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-delta"
-version = "0.5.16"
+version = "0.5.17"
 dependencies = [
  "async-channel",
  "async-std",
@@ -2847,7 +2847,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-quark"
-version = "0.5.16"
+version = "0.5.17"
 dependencies = [
  "async-lock",
  "async-recursion",

crates/bonfire/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-bonfire"
-version = "0.5.16"
+version = "0.5.17"
 license = "AGPL-3.0-or-later"
 edition = "2021"
 

crates/delta/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-delta"
-version = "0.5.16"
+version = "0.5.17"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <paulmakles@gmail.com>"]
 edition = "2018"

crates/delta/src/routes/channels/group_add_member.rs

@@ -1,5 +1,6 @@
 use revolt_quark::{
-    models::{Channel, User},
+    get_relationship,
+    models::{user::RelationshipStatus, Channel, User},
     perms, Db, EmptyResponse, Error, Permission, Ref, Result,
 };
 
@@ -22,6 +23,13 @@ pub async fn req(db: &Db, user: User, target: Ref, member: Ref) -> Result<EmptyR
     match &channel {
         Channel::Group { .. } => {
             let member = member.as_user(db).await?;
+            if !matches!(
+                get_relationship(&user, &member.id),
+                RelationshipStatus::Friend
+            ) {
+                return Err(Error::NotFriends);
+            }
+
             channel
                 .add_user_to_group(db, &member.id, &user.id)
                 .await

crates/quark/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-quark"
-version = "0.5.16"
+version = "0.5.17"
 license = "AGPL-3.0-or-later"
 edition = "2021"