init

src/routes/channel/handlers.rs

@@ -6,6 +6,7 @@ use crate::domain::dto::channel::{
 };
 use crate::http::context::{CurrentUser, Superuser};
 use crate::http::error::HTTPError;
+use crate::models::{channel, channel_user};
 use crate::routes::channel::mapper;
 use axum::{
     Json,
@@ -13,6 +14,15 @@ use axum::{
     http::StatusCode,
 };
 use uuid::Uuid;
+use sea_orm::{ColumnTrait, EntityTrait, QueryFilter};
+
+async fn require_channel_member(state: &AppState, channel_id: Uuid, user_id: Uuid) -> Result<(), HTTPError> {
+    let channel = state.repositories.channel.get_by_id(channel_id).await?.ok_or(HTTPError::NotFound)?;
+    if channel.channel_type == channel::ChannelType::DM
+        && channel_user::Entity::find().filter(channel_user::Column::ChannelId.eq(channel_id)).filter(channel_user::Column::UserId.eq(user_id)).one(&state.db).await?.is_none()
+    { return Err(HTTPError::Forbidden); }
+    Ok(())
+}
 
 /// Liste tous les channels
 #[utoipa::path(
@@ -54,12 +64,7 @@ pub async fn get_read_state(
     State(state): State<AppState>,
     Path(channel_id): Path<Uuid>,
 ) -> Result<Json<ReadStateResponse>, HTTPError> {
-    state
-        .repositories
-        .channel
-        .get_by_id(channel_id)
-        .await?
-        .ok_or(HTTPError::NotFound)?;
+    require_channel_member(&state, channel_id, user.id).await?;
     let read_state = state
         .repositories
         .read_state
@@ -99,12 +104,7 @@ pub async fn set_read_state(
     Path(channel_id): Path<Uuid>,
     Json(payload): Json<SetReadStateRequest>,
 ) -> Result<Json<ReadStateResponse>, HTTPError> {
-    state
-        .repositories
-        .channel
-        .get_by_id(channel_id)
-        .await?
-        .ok_or(HTTPError::NotFound)?;
+    require_channel_member(&state, channel_id, user.id).await?;
 
     if let Some(message_id) = payload.last_read_message_id {
         let message = state