NoLog.cz/gancio-upstream
6
0
Fork 0
mirror of https://framagit.org/les/gancio.git synced 2025-01-31 16:42:22 +01:00
Code Issues Projects Releases Packages Wiki Activity

improve is_editor backend handling

Browse source
This commit is contained in:
lesion 2024-02-09 22:14:52 +01:00
parent 17bf8ea376
commit 464f230749
No known key found for this signature in database
GPG key ID: 352918250B012177
4 changed files with 20 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
server/api/auth.js
View file

@ -19,6 +19,14 @@ const Auth = {
}
},
isAdminOrEditor (req, res, next) {
if (req.user && req.user.is_active && (req.user.is_admin || req.user.is_editor)) {
next()
} else {
res.sendStatus(403)
}
},
// TODO
hasPerm (scope) {
return (req, res, next) => {

1
server/api/controller/oauth.js
View file

@ -28,6 +28,7 @@ passport.deserializeUser(async (id, done) => {
email: user.email,
role: user.role,
is_admin: user.role === 'admin',
is_editor: user.role === 'editor',
is_active: user.is_active,
}
done(null, userInfo)

8
server/api/index.js
View file

@ -51,7 +51,7 @@ module.exports = () => {
} else {
const { isAuth, isAdmin } = require('./auth')
const { isAuth, isAdmin, isAdminOrEditor } = require('./auth')
const upload = multer({ storage })
/**
@ -201,16 +201,16 @@ module.exports = () => {
// - FEDIVERSE INSTANCES, MODERATION, RESOURCES
api.get('/instances', isAdmin, instanceController.getAll)
api.get('/instances', isAdminOrEditor, instanceController.getAll)
api.get('/instances/trusted', instanceController.getTrusted)
api.get('/instances/:instance_domain', isAdmin, instanceController.get)
api.get('/instances/:instance_domain', isAdminOrEditor, instanceController.get)
api.post('/instances/toggle_block', isAdmin, instanceController.toggleBlock)
api.post('/instances/toggle_user_block', isAdmin, apUserController.toggleBlock)
api.post('/instances/add_trust', isAdmin, instanceController.addTrust)
api.delete('/instances/trust', isAdmin, instanceController.removeTrust)
api.put('/resources/:resource_id', isAdmin, resourceController.hide)
api.delete('/resources/:resource_id', isAdmin, resourceController.remove)
api.get('/resources', isAdmin, resourceController.getAll)
api.get('/resources', isAdminOrEditor, resourceController.getAll)
// - ADMIN ANNOUNCEMENTS
api.get('/announcements', isAdmin, announceController.getAll)

8
server/api/models/user.js
View file

@ -30,6 +30,12 @@ module.exports = (sequelize, DataTypes) => {
return this.role === 'admin'
}
},
is_editor: {
type: DataTypes.VIRTUAL,
get () {
return this.role === 'editor'
}
},
is_active: DataTypes.BOOLEAN
}, {
scopes: {
@ -37,7 +43,7 @@ module.exports = (sequelize, DataTypes) => {
attributes: { exclude: ['password', 'recover_code'] }
},
withRecover: {
attributes: { exclude: ['password'] }
attributes: { exclude: ['password', 'insert_at', 'created_at'] }
}
}
})