From b7b70346b4a3aa1f8a3842e28e25b78766773a32 Mon Sep 17 00:00:00 2001
From: Paul Makles <me@insrt.uk>
Date: Sat, 18 Mar 2023 22:32:15 +0000
Subject: [PATCH] fix: add additional checks to group members

---
 Cargo.lock                                           |  6 +++---
 crates/bonfire/Cargo.toml                            |  2 +-
 crates/delta/Cargo.toml                              |  2 +-
 crates/delta/src/routes/channels/group_add_member.rs | 10 +++++++++-
 crates/quark/Cargo.toml                              |  2 +-
 5 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 7d1c376e..ae1e92d6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2792,7 +2792,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-bonfire"
-version = "0.5.16"
+version = "0.5.17"
 dependencies = [
  "async-std",
  "async-tungstenite",
@@ -2808,7 +2808,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-delta"
-version = "0.5.16"
+version = "0.5.17"
 dependencies = [
  "async-channel",
  "async-std",
@@ -2847,7 +2847,7 @@ dependencies = [
 
 [[package]]
 name = "revolt-quark"
-version = "0.5.16"
+version = "0.5.17"
 dependencies = [
  "async-lock",
  "async-recursion",
diff --git a/crates/bonfire/Cargo.toml b/crates/bonfire/Cargo.toml
index 6857f19b..9aaf7c72 100644
--- a/crates/bonfire/Cargo.toml
+++ b/crates/bonfire/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "revolt-bonfire"
-version = "0.5.16"
+version = "0.5.17"
 license = "AGPL-3.0-or-later"
 edition = "2021"
 
diff --git a/crates/delta/Cargo.toml b/crates/delta/Cargo.toml
index 7a4ba256..c488923d 100644
--- a/crates/delta/Cargo.toml
+++ b/crates/delta/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "revolt-delta"
-version = "0.5.16"
+version = "0.5.17"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <paulmakles@gmail.com>"]
 edition = "2018"
diff --git a/crates/delta/src/routes/channels/group_add_member.rs b/crates/delta/src/routes/channels/group_add_member.rs
index a7f8096d..b1dc9c03 100644
--- a/crates/delta/src/routes/channels/group_add_member.rs
+++ b/crates/delta/src/routes/channels/group_add_member.rs
@@ -1,5 +1,6 @@
 use revolt_quark::{
-    models::{Channel, User},
+    get_relationship,
+    models::{user::RelationshipStatus, Channel, User},
     perms, Db, EmptyResponse, Error, Permission, Ref, Result,
 };
 
@@ -22,6 +23,13 @@ pub async fn req(db: &Db, user: User, target: Ref, member: Ref) -> Result<EmptyR
     match &channel {
         Channel::Group { .. } => {
             let member = member.as_user(db).await?;
+            if !matches!(
+                get_relationship(&user, &member.id),
+                RelationshipStatus::Friend
+            ) {
+                return Err(Error::NotFriends);
+            }
+
             channel
                 .add_user_to_group(db, &member.id, &user.id)
                 .await
diff --git a/crates/quark/Cargo.toml b/crates/quark/Cargo.toml
index 9b882359..916d9b33 100644
--- a/crates/quark/Cargo.toml
+++ b/crates/quark/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "revolt-quark"
-version = "0.5.16"
+version = "0.5.17"
 license = "AGPL-3.0-or-later"
 edition = "2021"