init

src/routes/server/handlers.rs

@@ -5,6 +5,7 @@ use crate::domain::dto::server::{
 };
 use crate::http::context::{CurrentUser, Superuser};
 use crate::http::error::HTTPError;
+use crate::permissions::ServerPermission;
 use crate::routes::server::mapper;
 use axum::{
     Json,
@@ -13,6 +14,27 @@ use axum::{
 };
 use uuid::Uuid;
 
+async fn require_server_permission(
+    state: &AppState,
+    user: &CurrentUser,
+    server_id: Uuid,
+    permission: ServerPermission,
+) -> Result<(), HTTPError> {
+    if user.is_superuser {
+        return Ok(());
+    }
+
+    let granted = state
+        .repositories
+        .server
+        .get_user_permission(server_id, user.id)
+        .await?
+        .map(|value| ServerPermission::from_bits_truncate(value.permissions as u64))
+        .unwrap_or_default();
+
+    if granted.contains(permission) { Ok(()) } else { Err(HTTPError::Forbidden) }
+}
+
 /// Liste tous les serveurs
 #[utoipa::path(
     get,
@@ -112,7 +134,7 @@ pub async fn create(
     )
 )]
 pub async fn update(
-    _admin: Superuser,
+    user: CurrentUser,
     State(state): State<AppState>,
     Path(id): Path<Uuid>,
     Json(payload): Json<UpdateServerRequest>,
@@ -125,6 +147,8 @@ pub async fn update(
         .await?
         .ok_or(HTTPError::NotFound)?;
 
+    require_server_permission(&state, &user, id, ServerPermission::MANAGE_SERVER).await?;
+
     let server = state
         .services
         .server
@@ -311,10 +335,12 @@ pub async fn get_role_permission(
     tag = "Server Permissions"
 )]
 pub async fn set_role_permission(
+    user: CurrentUser,
     State(state): State<AppState>,
     Path((server_id, role_id)): Path<(Uuid, Uuid)>,
     Json(payload): Json<SetServerPermissionRequest>,
 ) -> Result<Json<ServerRolePermissionResponse>, HTTPError> {
+    require_server_permission(&state, &user, server_id, ServerPermission::MANAGE_ROLES).await?;
     state
         .repositories
         .server
@@ -347,9 +373,11 @@ pub async fn set_role_permission(
     tag = "Server Permissions"
 )]
 pub async fn remove_role_permission(
+    user: CurrentUser,
     State(state): State<AppState>,
     Path((server_id, role_id)): Path<(Uuid, Uuid)>,
 ) -> Result<StatusCode, HTTPError> {
+    require_server_permission(&state, &user, server_id, ServerPermission::MANAGE_ROLES).await?;
     if state
         .repositories
         .server