misty.cafe/mistykey
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

pass access token through API to enforce rank

Browse source
This commit is contained in:
Hazelnoot 2025-06-21 12:40:37 -04:00
parent fae87e03c0
commit 186c615e3f
166 changed files with 473 additions and 380 deletions
Download patch file Download diff file Expand all files Collapse all files

4
packages/backend/src/server/api/endpoints/notes/delete.ts
View file

@ -59,13 +59,13 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
private roleService: RoleService,
private noteDeleteService: NoteDeleteService,
) {
super(meta, paramDef, async (ps, me) => {
super(meta, paramDef, async (ps, me, token) => {
const note = await this.getterService.getNote(ps.noteId).catch(err => {
if (err.id === '9725d0ce-ba28-4dde-95a7-2cbb2c15de24') throw new ApiError(meta.errors.noSuchNote);
throw err;
});
if (!await this.roleService.isModerator(me) && (note.userId !== me.id)) {
if (!await this.roleService.isModerator(me, token) && (note.userId !== me.id)) {
throw new ApiError(meta.errors.accessDenied);
}