Prevent access to bot routes as bot.

Cargo.lock

@@ -2528,7 +2528,7 @@ dependencies = [
 [[package]]
 name = "rauth"
 version = "0.3.0"
-source = "git+https://gitlab.insrt.uk/insert/rauth?rev=19bef300ecc269c028e3d746f0a2f09842d3b37b#19bef300ecc269c028e3d746f0a2f09842d3b37b"
+source = "git+https://github.com/insertish/rauth?rev=19bef300ecc269c028e3d746f0a2f09842d3b37b#19bef300ecc269c028e3d746f0a2f09842d3b37b"
 dependencies = [
  "chrono",
  "handlebars",

Cargo.toml

@@ -48,7 +48,7 @@ async-std = { version = "1.8.0", features = ["tokio1", "tokio02", "attributes"]
 web-push = "0.7.2"
 many-to-many = "0.1.2"
 lettre = "0.10.0-alpha.4"
-rauth = { git = "https://gitlab.insrt.uk/insert/rauth", rev = "19bef300ecc269c028e3d746f0a2f09842d3b37b" }
+rauth = { git = "https://github.com/insertish/rauth", rev = "19bef300ecc269c028e3d746f0a2f09842d3b37b" }
 hive_pubsub = { git = "https://gitlab.insrt.uk/insert/hive", rev = "a89826df2b30166220e68a6ed01a58b751456604", features = ["mongo"] }
 
 # web

src/routes/bots/create.rs

@@ -24,6 +24,10 @@ pub struct Data {
 
 #[post("/create", data = "<info>")]
 pub async fn create_bot(user: User, info: Json<Data>) -> Result<Value> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot)
+    }
+    
     let info = info.into_inner();
     info.validate()
         .map_err(|error| Error::FailedValidation { error })?;

src/routes/bots/delete.rs

@@ -6,6 +6,10 @@ use mongodb::bson::doc;
 
 #[delete("/<target>")]
 pub async fn delete_bot(user: User, target: Ref) -> Result<EmptyResponse> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot)
+    }
+    
     let bot = target.fetch_bot().await?;
     if bot.owner != user.id {
         return Err(Error::MissingPermission);

src/routes/bots/edit.rs

@@ -26,6 +26,10 @@ pub struct Data {
 
 #[patch("/<target>", data = "<data>")]
 pub async fn edit_bot(user: User, target: Ref, data: Json<Data>) -> Result<EmptyResponse> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot)
+    }
+    
     let data = data.into_inner();
     data.validate()
         .map_err(|error| Error::FailedValidation { error })?;

src/routes/bots/fetch.rs

@@ -5,6 +5,10 @@ use serde_json::Value;
 
 #[get("/<target>")]
 pub async fn fetch_bot(user: User, target: Ref) -> Result<Value> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot)
+    }
+    
     let bot = target.fetch_bot().await?;
 
     if !bot.public {

src/routes/bots/fetch_owned.rs

@@ -7,6 +7,10 @@ use serde_json::Value;
 
 #[get("/@me")]
 pub async fn fetch_owned_bots(user: User) -> Result<Value> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot)
+    }
+    
     let bots = get_collection("bots")
         .find(
             doc! {

src/routes/bots/fetch_public.rs

@@ -5,6 +5,10 @@ use serde_json::Value;
 
 #[get("/<target>/invite")]
 pub async fn fetch_public_bot(user: User, target: Ref) -> Result<Value> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot)
+    }
+    
     let bot = target.fetch_bot().await?;
 
     if !bot.public {

src/routes/bots/invite.rs

@@ -23,6 +23,10 @@ pub enum Destination {
 
 #[post("/<target>/invite", data = "<dest>")]
 pub async fn invite_bot(user: User, target: Ref, dest: Json<Destination>) -> Result<EmptyResponse> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot)
+    }
+    
     let bot = target.fetch_bot().await?;
 
     if !bot.public {