From e1169c5335148d69fefd9914f5416cd8638b9dfa Mon Sep 17 00:00:00 2001
From: Paul Makles <paulmakles@gmail.com>
Date: Sun, 24 Apr 2022 13:59:07 +0100
Subject: [PATCH] fix: ensure bot invite route runs correct group member checks

---
 Cargo.lock                                 |  2 +-
 Cargo.toml                                 |  2 +-
 src/routes/bots/invite.rs                  | 18 ++++++------------
 src/routes/channels/channel_delete.rs      |  2 +-
 src/routes/channels/group_remove_member.rs |  2 +-
 5 files changed, 10 insertions(+), 16 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e8c3abcb..88ed6956 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3098,7 +3098,7 @@ dependencies = [
 [[package]]
 name = "revolt-quark"
 version = "0.1.0"
-source = "git+https://github.com/revoltchat/quark?rev=1eb92e3b5893075de1c11332bab76bffd88d4fa8#1eb92e3b5893075de1c11332bab76bffd88d4fa8"
+source = "git+https://github.com/revoltchat/quark?rev=2e914015d56dcedead3a7e9ed2b9ff0696a5135e#2e914015d56dcedead3a7e9ed2b9ff0696a5135e"
 dependencies = [
  "async-recursion",
  "async-std",
diff --git a/Cargo.toml b/Cargo.toml
index f991cfaa..fdaab99a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -69,5 +69,5 @@ schemars = "0.8.8"
 rocket_okapi = { git = "https://github.com/insertish/okapi", rev = "dcf0df115596ee07a587a7a543cddf3d7944645b", features = [ "swagger" ] }
 
 # quark
-revolt-quark = { git = "https://github.com/revoltchat/quark", rev = "1eb92e3b5893075de1c11332bab76bffd88d4fa8" }
+revolt-quark = { git = "https://github.com/revoltchat/quark", rev = "2e914015d56dcedead3a7e9ed2b9ff0696a5135e" }
 # revolt-quark = { path = "../quark" }
diff --git a/src/routes/bots/invite.rs b/src/routes/bots/invite.rs
index d18c7305..8cd61051 100644
--- a/src/routes/bots/invite.rs
+++ b/src/routes/bots/invite.rs
@@ -1,7 +1,4 @@
-use revolt_quark::{
-    models::{Channel, User},
-    perms, Db, EmptyResponse, Error, Permission, Ref, Result,
-};
+use revolt_quark::{models::User, perms, Db, EmptyResponse, Error, Permission, Ref, Result};
 
 use rocket::serde::json::Json;
 use serde::Deserialize;
@@ -58,20 +55,17 @@ pub async fn invite_bot(
                 .map(|_| EmptyResponse)
         }
         InviteBotDestination::Group { group } => {
-            let channel = db.fetch_channel(&group).await?;
+            let mut channel = db.fetch_channel(&group).await?;
 
             perms(&user)
                 .channel(&channel)
                 .throw_permission_and_view_channel(db, Permission::InviteOthers)
                 .await?;
 
-            if let Channel::Group { id, .. } = channel {
-                db.add_user_to_group(&id, &bot.id)
-                    .await
-                    .map(|_| EmptyResponse)
-            } else {
-                Err(Error::InvalidOperation)
-            }
+            channel
+                .add_user_to_group(db, &bot.id, &user.id)
+                .await
+                .map(|_| EmptyResponse)
         }
     }
 }
diff --git a/src/routes/channels/channel_delete.rs b/src/routes/channels/channel_delete.rs
index 1777c119..a31eeb0c 100644
--- a/src/routes/channels/channel_delete.rs
+++ b/src/routes/channels/channel_delete.rs
@@ -27,7 +27,7 @@ pub async fn req(db: &Db, user: User, target: Ref) -> Result<EmptyResponse> {
             .await
             .map(|_| EmptyResponse),
         Channel::Group { .. } => channel
-            .remove_user_from_group(db, &user.id)
+            .remove_user_from_group(db, &user.id, None)
             .await
             .map(|_| EmptyResponse),
         Channel::TextChannel { .. } | Channel::VoiceChannel { .. } => {
diff --git a/src/routes/channels/group_remove_member.rs b/src/routes/channels/group_remove_member.rs
index 2abbed80..c3a67b14 100644
--- a/src/routes/channels/group_remove_member.rs
+++ b/src/routes/channels/group_remove_member.rs
@@ -29,7 +29,7 @@ pub async fn req(db: &Db, user: User, target: Ref, member: Ref) -> Result<EmptyR
             }
 
             channel
-                .remove_user_from_group(db, &member.id)
+                .remove_user_from_group(db, &member.id, Some(&user.id))
                 .await
                 .map(|_| EmptyResponse)
         }