From add3f40b2308ef2858b5a4bc47d31dec90995abb Mon Sep 17 00:00:00 2001
From: Paul Makles <me@insrt.uk>
Date: Mon, 10 Feb 2025 18:54:15 +0000
Subject: [PATCH] fix: don't allow users to time themselves out closes #376

---
 crates/core/result/src/lib.rs                  |  1 +
 crates/delta/src/routes/servers/member_edit.rs | 12 ++++++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/crates/core/result/src/lib.rs b/crates/core/result/src/lib.rs
index f3de55cd..4d5e1c65 100644
--- a/crates/core/result/src/lib.rs
+++ b/crates/core/result/src/lib.rs
@@ -116,6 +116,7 @@ pub enum ErrorType {
         max: usize,
     },
     AlreadyInServer,
+    CannotTimeoutYourself,
 
     // ? Bot related errors
     ReachedMaximumBots,
diff --git a/crates/delta/src/routes/servers/member_edit.rs b/crates/delta/src/routes/servers/member_edit.rs
index b10a9a3e..005e65c7 100644
--- a/crates/delta/src/routes/servers/member_edit.rs
+++ b/crates/delta/src/routes/servers/member_edit.rs
@@ -15,12 +15,12 @@ use validator::Validate;
 ///
 /// Edit a member by their id.
 #[openapi(tag = "Server Members")]
-#[patch("/<server>/members/<target>", data = "<data>")]
+#[patch("/<server>/members/<member>", data = "<data>")]
 pub async fn edit(
     db: &State<Database>,
     user: User,
     server: Reference,
-    target: Reference,
+    member: Reference,
     data: Json<v0::DataMemberEdit>,
 ) -> Result<Json<v0::Member>> {
     let data = data.into_inner();
@@ -30,9 +30,9 @@ pub async fn edit(
         })
     })?;
 
-    // Fetch server and target member
+    // Fetch server and member
     let mut server = server.as_server(db).await?;
-    let mut member = target.as_member(db, &server.id).await?;
+    let mut member = member.as_member(db, &server.id).await?;
 
     // Fetch our currrent permissions
     let mut query = DatabasePermissionQuery::new(db, &user).server(&server);
@@ -84,6 +84,10 @@ pub async fn edit(
             .map(|x| x.contains(&v0::FieldsMember::Timeout))
             .unwrap_or_default()
     {
+        if data.timeout.is_some() && member.id.user == user.id {
+            return Err(create_error!(CannotTimeoutYourself));
+        }
+
         permissions.throw_if_lacking_channel_permission(ChannelPermission::TimeoutMembers)?;
     }