chore: loosen username restrictions

fixes #153

Cargo.lock

@@ -2999,7 +2999,7 @@ dependencies = [
 [[package]]
 name = "revolt-quark"
 version = "0.1.0"
-source = "git+https://github.com/revoltchat/quark?rev=68403fb55912de9ad98257741b8c93ce165b7abf#68403fb55912de9ad98257741b8c93ce165b7abf"
+source = "git+https://github.com/revoltchat/quark?rev=45706b93d4da11cf3e0f3ca41514c73945bb348d#45706b93d4da11cf3e0f3ca41514c73945bb348d"
 dependencies = [
  "async-recursion",
  "async-std",

Cargo.toml

@@ -64,5 +64,5 @@ schemars = "0.8.8"
 rocket_okapi = { git = "https://github.com/insertish/okapi", rev = "dcf0df115596ee07a587a7a543cddf3d7944645b", features = [ "swagger" ] }
 
 # quark
-revolt-quark = { git = "https://github.com/revoltchat/quark", rev = "68403fb55912de9ad98257741b8c93ce165b7abf" }
+revolt-quark = { git = "https://github.com/revoltchat/quark", rev = "45706b93d4da11cf3e0f3ca41514c73945bb348d" }
 # revolt-quark = { path = "../quark" }

set_version.sh

@@ -1,3 +1,3 @@
 #!/bin/bash
-export version=0.5.3
+export version=0.5.3-1
 echo "pub const VERSION: &str = \"${version}\";" > src/version.rs

src/routes/bots/create.rs

@@ -45,7 +45,7 @@ pub async fn create_bot(db: &Db, user: User, info: Json<DataCreateBot>) -> Resul
     let id = Ulid::new().to_string();
     let bot_user = User {
         id: id.clone(),
-        username: info.name,
+        username: info.name.trim().to_string(),
         bot: Some(BotInformation {
             owner: user.id.clone(),
         }),

src/routes/channels/channel_ack.rs

@@ -1,4 +1,4 @@
-use revolt_quark::{models::User, perms, Db, EmptyResponse, Permission, Ref, Result};
+use revolt_quark::{models::User, perms, Db, EmptyResponse, Error, Permission, Ref, Result};
 
 /// # Acknowledge Message
 ///
@@ -6,6 +6,10 @@ use revolt_quark::{models::User, perms, Db, EmptyResponse, Permission, Ref, Resu
 #[openapi(tag = "Messaging")]
 #[put("/<target>/ack/<message>")]
 pub async fn req(db: &Db, user: User, target: Ref, message: Ref) -> Result<EmptyResponse> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let channel = target.as_channel(db).await?;
     perms(&user)
         .channel(&channel)

src/routes/channels/group_add_member.rs

@@ -9,6 +9,10 @@ use revolt_quark::{
 #[openapi(tag = "Groups")]
 #[put("/<target>/recipients/<member>")]
 pub async fn req(db: &Db, user: User, target: Ref, member: Ref) -> Result<EmptyResponse> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let mut channel = target.as_channel(db).await?;
     perms(&user)
         .channel(&channel)

src/routes/channels/group_create.rs

@@ -37,6 +37,10 @@ pub struct DataCreateGroup {
 #[openapi(tag = "Groups")]
 #[post("/create", data = "<info>")]
 pub async fn req(db: &Db, user: User, info: Json<DataCreateGroup>) -> Result<Json<Channel>> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let info = info.into_inner();
     info.validate()
         .map_err(|error| Error::FailedValidation { error })?;

src/routes/channels/group_remove_member.rs

@@ -9,6 +9,10 @@ use revolt_quark::{
 #[openapi(tag = "Groups")]
 #[delete("/<target>/recipients/<member>")]
 pub async fn req(db: &Db, user: User, target: Ref, member: Ref) -> Result<EmptyResponse> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let channel = target.as_channel(db).await?;
 
     match &channel {

src/routes/channels/invite_create.rs

@@ -1,6 +1,6 @@
 use revolt_quark::{
     models::{Invite, User},
-    perms, Db, Permission, Ref, Result,
+    perms, Db, Error, Permission, Ref, Result,
 };
 
 use rocket::serde::json::Json;
@@ -13,6 +13,10 @@ use rocket::serde::json::Json;
 #[openapi(tag = "Channel Invites")]
 #[post("/<target>/invites")]
 pub async fn req(db: &Db, user: User, target: Ref) -> Result<Json<Invite>> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let channel = target.as_channel(db).await?;
     perms(&user)
         .channel(&channel)

src/routes/channels/members_fetch.rs

@@ -11,6 +11,10 @@ use rocket::serde::json::Json;
 #[openapi(tag = "Groups")]
 #[get("/<target>/members")]
 pub async fn req(db: &Db, user: User, target: Ref) -> Result<Json<Vec<User>>> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let channel = target.as_channel(db).await?;
     perms(&user)
         .channel(&channel)

src/routes/channels/message_bulk_delete.rs

@@ -0,0 +1,59 @@
+use chrono::Utc;
+use revolt_quark::{
+    models::{Message, User},
+    perms, Db, EmptyResponse, Error, Permission, Ref, Result,
+};
+use rocket::serde::json::Json;
+use serde::Deserialize;
+use validator::Validate;
+
+/// # Search Parameters
+#[derive(Validate, Deserialize, JsonSchema)]
+pub struct OptionsBulkDelete {
+    /// Message IDs
+    #[validate(length(min = 1, max = 100))]
+    ids: Vec<String>,
+}
+
+/// # Bulk Delete Messages
+///
+/// Delete multiple messages you've sent or one you have permission to delete.
+///
+/// This will always require `ManageMessages` permission regardless of whether you own the message or not.
+///
+/// Messages must have been sent within the past 1 week.
+#[openapi(tag = "Messaging")]
+#[delete("/<target>/messages/bulk", data = "<options>", rank = 1)]
+pub async fn req(
+    db: &Db,
+    user: User,
+    target: Ref,
+    options: Json<OptionsBulkDelete>,
+) -> Result<EmptyResponse> {
+    let options = options.into_inner();
+    options
+        .validate()
+        .map_err(|error| Error::FailedValidation { error })?;
+
+    for id in &options.ids {
+        if ulid::Ulid::from_string(id)
+            .map_err(|_| Error::InvalidOperation)?
+            .datetime()
+            .signed_duration_since(Utc::now())
+            .num_days()
+            .abs()
+            > 7
+        {
+            return Err(Error::InvalidOperation);
+        }
+    }
+
+    perms(&user)
+        .channel(&target.as_channel(db).await?)
+        .throw_permission(db, Permission::ManageMessages)
+        .await?;
+
+    Message::bulk_delete(db, &target.id, options.ids)
+        .await
+        .map(|_| EmptyResponse)
+}

src/routes/channels/message_delete.rs

@@ -4,7 +4,7 @@ use revolt_quark::{models::User, perms, Db, EmptyResponse, Error, Permission, Re
 ///
 /// Delete a message you've sent or one you have permission to delete.
 #[openapi(tag = "Messaging")]
-#[delete("/<target>/messages/<msg>")]
+#[delete("/<target>/messages/<msg>", rank = 2)]
 pub async fn req(db: &Db, user: User, target: Ref, msg: Ref) -> Result<EmptyResponse> {
     let message = msg.as_message(db).await?;
     if message.channel != target.id {

src/routes/channels/message_search.rs

@@ -11,7 +11,7 @@ use serde::{Deserialize, Serialize};
 use validator::Validate;
 
 /// # Search Parameters
-#[derive(Validate, Serialize, Deserialize, JsonSchema, FromForm)]
+#[derive(Validate, Serialize, Deserialize, JsonSchema)]
 pub struct OptionsMessageSearch {
     /// Full-text search query
     ///
@@ -48,6 +48,10 @@ pub async fn req(
     target: Ref,
     options: Json<OptionsMessageSearch>,
 ) -> Result<Json<BulkMessageResponse>> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let options = options.into_inner();
     options
         .validate()

src/routes/channels/message_send.rs

@@ -80,6 +80,7 @@ pub async fn message_send(
         id: message_id.clone(),
         channel: channel.id().to_string(),
         author: user.id.clone(),
+        masquerade: data.masquerade,
         ..Default::default()
     };
 
@@ -94,7 +95,7 @@ pub async fn message_send(
     }
 
     // 2. Verify permissions for masquerade.
-    if data.masquerade.is_some() {
+    if message.masquerade.is_some() {
         permissions
             .throw_permission(db, Permission::Masquerade)
             .await?;

src/routes/channels/mod.rs

@@ -10,6 +10,7 @@ mod group_create;
 mod group_remove_member;
 mod invite_create;
 mod members_fetch;
+mod message_bulk_delete;
 mod message_delete;
 mod message_edit;
 mod message_fetch;
@@ -35,6 +36,7 @@ pub fn routes() -> (Vec<Route>, OpenApi) {
         message_query_stale::req,
         message_fetch::req,
         message_edit::req,
+        message_bulk_delete::req,
         message_delete::req,
         group_create::req,
         group_add_member::req,

src/routes/servers/invites_fetch.rs

@@ -1,6 +1,6 @@
 use revolt_quark::{
     models::{Invite, User},
-    perms, Db, Permission, Ref, Result,
+    perms, Db, Error, Permission, Ref, Result,
 };
 
 use rocket::serde::json::Json;
@@ -11,6 +11,10 @@ use rocket::serde::json::Json;
 #[openapi(tag = "Server Members")]
 #[get("/<target>/invites")]
 pub async fn req(db: &Db, user: User, target: Ref) -> Result<Json<Vec<Invite>>> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let server = target.as_server(db).await?;
     perms(&user)
         .server(&server)

src/routes/servers/server_ack.rs

@@ -1,4 +1,4 @@
-use revolt_quark::{models::User, perms, Db, EmptyResponse, Ref, Result};
+use revolt_quark::{models::User, perms, Db, EmptyResponse, Error, Ref, Result};
 
 /// # Mark Server As Read
 ///
@@ -6,6 +6,10 @@ use revolt_quark::{models::User, perms, Db, EmptyResponse, Ref, Result};
 #[openapi(tag = "Server Information")]
 #[put("/<target>/ack")]
 pub async fn req(db: &Db, user: User, target: Ref) -> Result<EmptyResponse> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let server = target.as_server(db).await?;
     perms(&user).server(&server).calc(db).await?;
 

src/routes/users/add_friend.rs

@@ -1,5 +1,5 @@
 use revolt_quark::models::User;
-use revolt_quark::{Database, Result};
+use revolt_quark::{Database, Error, Result};
 
 use rocket::serde::json::Json;
 use rocket::State;
@@ -11,6 +11,11 @@ use rocket::State;
 #[put("/<username>/friend")]
 pub async fn req(db: &State<Database>, user: User, username: String) -> Result<Json<User>> {
     let mut target = db.fetch_user_by_username(&username).await?;
+
+    if user.bot.is_some() || target.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     user.add_friend(db, &mut target).await?;
     Ok(Json(target.with_auto_perspective(db, &user).await))
 }

src/routes/users/change_username.rs

@@ -28,6 +28,9 @@ pub async fn req(
     data: Json<DataChangeUsername>,
 ) -> Result<Json<User>> {
     let data = data.into_inner();
+    data.validate()
+        .map_err(|error| Error::FailedValidation { error })?;
+
     account
         .verify_password(&data.password)
         .map_err(|_| Error::InvalidCredentials)?;

src/routes/users/find_mutual.rs

@@ -24,6 +24,10 @@ pub async fn req(db: &State<Database>, user: User, target: Ref) -> Result<Json<M
         return Err(Error::InvalidOperation);
     }
 
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let target = target.as_user(db).await?;
 
     if perms(&user)

src/routes/users/remove_friend.rs

@@ -1,5 +1,5 @@
 use revolt_quark::models::User;
-use revolt_quark::{Database, Result};
+use revolt_quark::{Database, Error, Result};
 
 use rocket::serde::json::Json;
 use rocket::State;
@@ -11,6 +11,11 @@ use rocket::State;
 #[delete("/<target>/friend")]
 pub async fn req(db: &State<Database>, user: User, target: String) -> Result<Json<User>> {
     let mut target = db.fetch_user(&target).await?;
+
+    if user.bot.is_some() || target.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     user.remove_friend(db, &mut target).await?;
     Ok(Json(target.with_auto_perspective(db, &user).await))
 }

src/util/ratelimiter.rs

@@ -136,7 +136,7 @@ fn resolve_bucket_limit(bucket: &str) -> u8 {
         "messaging" => 10,
         "channels" => 15,
         "servers" => 5,
-        "auth" => 3,
+        "auth" => 15,
         "auth_delete" => 255,
         "swagger" => 100,
         _ => 20,

src/util/regex.rs

@@ -1,4 +1,4 @@
 use once_cell::sync::Lazy;
 use regex::Regex;
 
-pub static RE_USERNAME: Lazy<Regex> = Lazy::new(|| Regex::new(r"^[a-zA-Z0-9_.]+$").unwrap());
+pub static RE_USERNAME: Lazy<Regex> = Lazy::new(|| Regex::new(r"^[^\u200B]+$").unwrap());

src/version.rs

@@ -1 +1 @@
-pub const VERSION: &str = "0.5.3";
+pub const VERSION: &str = "0.5.3-1";