SadlyNotSappho
/
login-template
Template
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

update POST /upload error messages, fix a few other things

This commit is contained in:
SadlyNotSappho 2024-03-19 13:46:43 -07:00
parent ab7b102045
commit 2cd4cf784e
2 changed files with 48 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

90
src/main.rs
View File

@ -227,7 +227,10 @@ async fn api_perms(
), ),
None => status::Custom(Status::NotFound, Json(Err("User doesn't exist"))), None => status::Custom(Status::NotFound, Json(Err("User doesn't exist"))),
}, },
false => status::Custom(Status::Unauthorized, Json(Err("You don't have the permission to do this"))), false => status::Custom(
Status::Unauthorized,
Json(Err("You don't have the permission to do this")),
),
}, },
None => status::Custom(Status::Unauthorized, Json(Err("Invalid token"))), None => status::Custom(Status::Unauthorized, Json(Err("Invalid token"))),
}, },
@ -248,59 +251,58 @@ async fn toggleperms(
mut db: Connection<Db>, mut db: Connection<Db>,
info: Json<TogglePerms>, info: Json<TogglePerms>,
cookies: &CookieJar<'_>, cookies: &CookieJar<'_>,
) -> String { ) -> status::Custom<String> {
match cookies.get_private("token") { match cookies.get_private("token") {
Some(t) => { Some(t) => match User::get_by_token(&mut db, t).await {
match User::get_by_token(&mut db, t).await { Some(user) => match user.admin {
Some(user) => { true => match User::get_by_username(&mut db, &info.username).await {
match user.admin { Some(toggled_user) => {
true => { match toggled_user.username == user.username && info.perm == "admin" {
match User::get_by_username(&mut db, &info.username).await { true => status::Custom(
Some(toggled_user) => { Status::Forbidden,
if toggled_user.username == user.username "You can't change your own admin status".to_string(),
&& info.perm == "admin".to_string() ),
{ false => {
"You can't change your own admin status".to_string() let admin_username = std::env::var("ADMIN_USERNAME")
} else { .expect("set ADMIN_USERNAME env var");
let admin_username = std::env::var("ADMIN_USERNAME") match toggled_user.username == admin_username {
.expect("set ADMIN_USERNAME env var"); true => status::Custom(
if toggled_user.username == admin_username { Status::Forbidden,
"You can't change the system admin's perms.".to_string() "You can't change the system admin's perms.".to_string(),
} else { ),
if info.perm == "admin" false => {
&& user.username != admin_username match info.perm == "admin"
{ && user.username != admin_username
{
true => status::Custom(
Status::Forbidden,
"You can't change other people's admin status." "You can't change other people's admin status."
.to_string() .to_string(),
} else { ),
// how deep is this shit false => {
// i counted. 12. match toggled_user.set_role(&mut db,&info.perm,&info.value).await {
// NOW we can actually do the thing :D Ok(_) => status::Custom(Status::Ok, "Done".to_string()),
let res = match toggled_user Err(why) => status::Custom(Status::InternalServerError, format!(
.set_role(&mut db, &info.perm, &info.value)
.await
{
Ok(_) => "Done".to_string(),
Err(why) => format!(
"Couldn't update the user's role: {why}" "Couldn't update the user's role: {why}"
), )),
}; }
res
} }
} }
} }
} }
None => "The user you're trying to toggle perms for doesn't exist."
.to_string(),
} }
} }
false => "You aren't an admin.".to_string(),
} }
} None => status::Custom(
None => "Invalid user".to_string(), Status::NotFound,
} "The user you're trying to toggle perms for doesn't exist.".to_string(),
} ),
None => "Not logged in".to_string(), },
false => status::Custom(Status::Unauthorized, "You aren't an admin.".to_string()),
},
None => status::Custom(Status::Unauthorized, "Invalid login token".to_string()),
},
None => status::Custom(Status::Unauthorized, "Not logged in".to_string()),
} }
} }

4
src/tables.rs
View File

@ -235,7 +235,7 @@ impl Image {
VALUES ($1, $2); VALUES ($1, $2);
"#, "#,
) )
.bind(&uuid) .bind(uuid)
.bind(user.username), .bind(user.username),
) )
.await .await
@ -263,7 +263,7 @@ impl Image {
} }
} }
pub async fn is_owned_by(db: &mut Connection<Db>, uuid: &String, username: &String) -> Result<bool, String> { pub async fn is_owned_by(db: &mut Connection<Db>, uuid: &String, username: &String) -> Result<bool, String> {
match Image::get_by_uuid(db, &uuid).await { match Image::get_by_uuid(db, uuid).await {
Ok(img) => { Ok(img) => {
Ok(&img.owner_name == username) Ok(&img.owner_name == username)
}, },