From fcbaab7bcb99483222c485b8f019f310de2fe2b9 Mon Sep 17 00:00:00 2001
From: Paul Makles <paulmakles@gmail.com>
Date: Wed, 23 Feb 2022 15:59:21 +0000
Subject: [PATCH] feat(server/set_default): prevent users giving perm they
 don't have

---
 src/routes/servers/permissions_set_default.rs | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/src/routes/servers/permissions_set_default.rs b/src/routes/servers/permissions_set_default.rs
index ce09abaa..7f1ee736 100644
--- a/src/routes/servers/permissions_set_default.rs
+++ b/src/routes/servers/permissions_set_default.rs
@@ -3,7 +3,7 @@ use serde::{Deserialize, Serialize};
 
 use revolt_quark::{
     models::{server::PartialServer, Server, User},
-    perms, Db, Permission, Ref, Result,
+    perms, Db, Error, Permission, Ref, Result,
 };
 
 #[derive(Serialize, Deserialize)]
@@ -16,12 +16,18 @@ pub async fn req(db: &Db, user: User, target: Ref, data: Json<Data>) -> Result<J
     let data = data.into_inner();
 
     let mut server = target.as_server(db).await?;
-    perms(&user)
-        .server(&server)
+    let mut permissions = perms(&user).server(&server);
+
+    permissions
         .throw_permission(db, Permission::ManagePermissions)
         .await?;
 
-    // ! FIXME_PERMISSIONS
+    if !permissions
+        .has_permission_value(db, data.permissions)
+        .await?
+    {
+        return Err(Error::CannotGiveMissingPermissions);
+    }
 
     server
         .update(