pepepper/fluxer
1
0 Fork 0
mirror of https://github.com/fluxerapp/fluxer synced 2026-10-17 21:15:32 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): make an empty admin guild patch apply no change (#2538)

Browse Source
This commit is contained in:
Hampus authored and GitHub committed 2026-09-06 18:38:13 +02:00
1 parent 5ef402b8ee
commit 2f159852a7
5 files changed
+15 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

fluxer_api/src/api/admin/controllers/GuildAdminController.ts
+5 -2
View File
@@ -72,7 +72,10 @@ function selectGuildUpdateACLs(body: UpdateGuildRequest): Array<string> {
if (body.new_owner_id !== undefined) {
required.push(AdminACLs.GUILD_TRANSFER_OWNERSHIP);
}
return required.length > 0 ? required : [AdminACLs.WILDCARD];
if (required.length > 0) {
return required;
}
return Object.keys(body).length === 0 ? [] : [AdminACLs.WILDCARD];
}
function requireAllAdminACLs(granted: ReadonlySet<string>, required: ReadonlyArray<string>): void {
@@ -148,7 +151,7 @@ export function GuildAdminController(app: HonoApp) {
operationId: 'update_admin_guild',
summary: 'Update guild',
description:
'Partially updates a guild. The permissions required are selected by the fields present in the body and are evaluated with all-of semantics: name requires GUILD_UPDATE_NAME, vanity_url_code requires GUILD_UPDATE_VANITY, new_owner_id requires GUILD_TRANSFER_OWNERSHIP, add_features and remove_features require GUILD_UPDATE_FEATURES, and fields together with every other setting requires GUILD_UPDATE_SETTINGS. A body carrying no field requires the wildcard permission. Every applied change is logged to the audit log.',
'Partially updates a guild. The permissions required are selected by the fields present in the body and are evaluated with all-of semantics: name requires GUILD_UPDATE_NAME, vanity_url_code requires GUILD_UPDATE_VANITY, new_owner_id requires GUILD_TRANSFER_OWNERSHIP, add_features and remove_features require GUILD_UPDATE_FEATURES, and fields together with every other setting requires GUILD_UPDATE_SETTINGS. A body with no fields applies no change. Every applied change is logged to the audit log.',
responseSchema: GuildUpdateResponse,
statusCode: 200,
security: 'adminApiKey',
fluxer_api/src/api/admin/tests/AdminGuildRoutes.test.ts
+6 -4
View File
@@ -81,15 +81,17 @@ describe('Admin guild routes', () => {
.expect(HTTP_STATUS.FORBIDDEN, 'MISSING_ACL')
.execute();
});
test('PATCH /admin/guilds/{guild_id} rejects an empty patch without the wildcard ACL', async () => {
test('PATCH /admin/guilds/{guild_id} applies no change for an empty patch', async () => {
const admin = await createTestAccount(harness);
await setUserACLs(harness, admin, ['admin:authenticate', 'guild:update:name']);
const guild = await createGuild(harness, admin.token, `Empty Patch Guild ${Date.now()}`);
await createBuilder(harness, `${admin.token}`)
const name = `Empty Patch Guild ${Date.now()}`;
const guild = await createGuild(harness, admin.token, name);
const result = await createBuilder<AdminGuildUpdate>(harness, `${admin.token}`)
.patch(`/admin/guilds/${guild.id}`)
.body({})
.expect(HTTP_STATUS.FORBIDDEN, 'MISSING_ACL')
.expect(HTTP_STATUS.OK)
.execute();
expect(result.guild.name).toBe(name);
});
test('guild member add, ban and removal use the member and ban sub-resources', async () => {
const admin = await createTestAccount(harness);