pepepper/fluxer
1
0 Fork 0
mirror of https://github.com/fluxerapp/fluxer synced 2026-10-18 13:35:42 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): correct guild permission and mfa checks (#2499)

Browse Source
This commit is contained in:
Hampus authored and GitHub committed 2026-09-06 15:28:01 +02:00
1 parent f392636857
commit 908e1b8bd4
12 files changed
+303 -86
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

fluxer_api/src/api/guild/controllers/GuildDiscoveryController.ts
+8 -33
View File
@@ -3,7 +3,6 @@
import {Permissions} from '@fluxer/constants/src/ChannelConstants';
import {DiscoveryApplicationStatus, DiscoveryCategoryLabels} from '@fluxer/constants/src/DiscoveryConstants';
import {GuildFeatures, JoinSourceTypes} from '@fluxer/constants/src/GuildConstants';
import {MissingPermissionsError} from '@fluxer/errors/src/domains/core/MissingPermissionsError';
import {DiscoveryDisabledError} from '@fluxer/errors/src/domains/discovery/DiscoveryDisabledError';
import {DiscoveryNotDiscoverableError} from '@fluxer/errors/src/domains/discovery/DiscoveryNotDiscoverableError';
import {InvitesDisabledError} from '@fluxer/errors/src/domains/invite/InvitesDisabledError';
@@ -160,14 +159,8 @@ export function GuildDiscoveryController(app: HonoApp) {
const {guild_id} = ctx.req.valid('param');
const guildId = createGuildID(guild_id);
const data = ctx.req.valid('json');
const hasPermission = await ctx.get('gatewayService').checkPermission({
guildId,
userId: user.id,
permission: Permissions.MANAGE_GUILD,
});
if (!hasPermission) {
throw new MissingPermissionsError();
}
const {checkPermission} = await ctx.get('guildService').getGuildAuthenticated({userId: user.id, guildId});
await checkPermission(Permissions.MANAGE_GUILD);
const row = await ctx.get('discoveryService').apply({
guildId,
userId: user.id,
@@ -201,14 +194,8 @@ export function GuildDiscoveryController(app: HonoApp) {
const {guild_id} = ctx.req.valid('param');
const guildId = createGuildID(guild_id);
const data = ctx.req.valid('json');
const hasPermission = await ctx.get('gatewayService').checkPermission({
guildId,
userId: user.id,
permission: Permissions.MANAGE_GUILD,
});
if (!hasPermission) {
throw new MissingPermissionsError();
}
const {checkPermission} = await ctx.get('guildService').getGuildAuthenticated({userId: user.id, guildId});
await checkPermission(Permissions.MANAGE_GUILD);
const row = await ctx.get('discoveryService').editApplication({
guildId,
userId: user.id,
@@ -237,14 +224,8 @@ export function GuildDiscoveryController(app: HonoApp) {
const user = ctx.get('user');
const {guild_id} = ctx.req.valid('param');
const guildId = createGuildID(guild_id);
const hasPermission = await ctx.get('gatewayService').checkPermission({
guildId,
userId: user.id,
permission: Permissions.MANAGE_GUILD,
});
if (!hasPermission) {
throw new MissingPermissionsError();
}
const {checkPermission} = await ctx.get('guildService').getGuildAuthenticated({userId: user.id, guildId});
await checkPermission(Permissions.MANAGE_GUILD);
await ctx.get('discoveryService').withdraw({guildId, userId: user.id});
return ctx.body(null, 204);
},
@@ -267,14 +248,8 @@ export function GuildDiscoveryController(app: HonoApp) {
const user = ctx.get('user');
const {guild_id} = ctx.req.valid('param');
const guildId = createGuildID(guild_id);
const hasPermission = await ctx.get('gatewayService').checkPermission({
guildId,
userId: user.id,
permission: Permissions.MANAGE_GUILD,
});
if (!hasPermission) {
throw new MissingPermissionsError();
}
const {checkPermission} = await ctx.get('guildService').getGuildAuthenticated({userId: user.id, guildId});
await checkPermission(Permissions.MANAGE_GUILD);
const discoveryService = ctx.get('discoveryService');
const row = await discoveryService.getStatus(guildId);
const eligibility = await discoveryService.getEligibility(guildId);
fluxer_api/src/api/guild/controllers/GuildMemberSearchController.ts
+8 -1
View File
@@ -20,6 +20,7 @@ import {guildMembersNeedReindexing} from '../../search/GuildMemberIndexingUtils'
import type {HonoApp} from '../../types/HonoEnv';
import {Validator} from '../../Validator';
import {GuildRepository} from '../repositories/GuildRepository';
import {createGuildMfaEnforcer} from '../services/GuildMfaEnforcement';
const MEMBERS_PAGE_PERMISSIONS =
Permissions.MANAGE_GUILD |
@@ -81,11 +82,17 @@ export function GuildMemberSearchController(app: HonoApp) {
const guildId = createGuildID(ctx.req.valid('param').guild_id);
const guildIdString = guildId.toString();
const body = ctx.req.valid('json');
const {getMyPermissions} = await ctx.get('guildService').getGuildAuthenticated({userId, guildId});
const {getMyPermissions, guildData} = await ctx.get('guildService').getGuildAuthenticated({userId, guildId});
const permissions = await getMyPermissions();
if ((permissions & MEMBERS_PAGE_PERMISSIONS) === 0n) {
throw new MissingPermissionsError();
}
const enforceGuildMfa = await createGuildMfaEnforcer({
userRepository: ctx.get('userRepository'),
guildData,
userId,
});
enforceGuildMfa(permissions & MEMBERS_PAGE_PERMISSIONS);
const canViewInvites = (permissions & Permissions.MANAGE_GUILD) !== 0n;
const guild = await guildRepository.findUnique(guildId);
if (!guild) {