Prevent access to bot routes as bot.

src/routes/bots/create.rs

@@ -24,6 +24,10 @@ pub struct Data {
 
 #[post("/create", data = "<info>")]
 pub async fn create_bot(user: User, info: Json<Data>) -> Result<Value> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot)
+    }
+    
     let info = info.into_inner();
     info.validate()
         .map_err(|error| Error::FailedValidation { error })?;

src/routes/bots/delete.rs

@@ -6,6 +6,10 @@ use mongodb::bson::doc;
 
 #[delete("/<target>")]
 pub async fn delete_bot(user: User, target: Ref) -> Result<EmptyResponse> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot)
+    }
+    
     let bot = target.fetch_bot().await?;
     if bot.owner != user.id {
         return Err(Error::MissingPermission);

src/routes/bots/edit.rs

@@ -26,6 +26,10 @@ pub struct Data {
 
 #[patch("/<target>", data = "<data>")]
 pub async fn edit_bot(user: User, target: Ref, data: Json<Data>) -> Result<EmptyResponse> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot)
+    }
+    
     let data = data.into_inner();
     data.validate()
         .map_err(|error| Error::FailedValidation { error })?;

src/routes/bots/fetch.rs

@@ -5,6 +5,10 @@ use serde_json::Value;
 
 #[get("/<target>")]
 pub async fn fetch_bot(user: User, target: Ref) -> Result<Value> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot)
+    }
+    
     let bot = target.fetch_bot().await?;
 
     if !bot.public {

src/routes/bots/fetch_owned.rs

@@ -7,6 +7,10 @@ use serde_json::Value;
 
 #[get("/@me")]
 pub async fn fetch_owned_bots(user: User) -> Result<Value> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot)
+    }
+    
     let bots = get_collection("bots")
         .find(
             doc! {

src/routes/bots/fetch_public.rs

@@ -5,6 +5,10 @@ use serde_json::Value;
 
 #[get("/<target>/invite")]
 pub async fn fetch_public_bot(user: User, target: Ref) -> Result<Value> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot)
+    }
+    
     let bot = target.fetch_bot().await?;
 
     if !bot.public {

src/routes/bots/invite.rs

@@ -23,6 +23,10 @@ pub enum Destination {
 
 #[post("/<target>/invite", data = "<dest>")]
 pub async fn invite_bot(user: User, target: Ref, dest: Json<Destination>) -> Result<EmptyResponse> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot)
+    }
+    
     let bot = target.fetch_bot().await?;
 
     if !bot.public {