Team routes (#92)

* Team routes template

* More work on teams

* Updating routes WIP

* Edit routes

* Fixes

* Run prepare, prevent non-members from seeing perms

* More fixes

* Finish team routes

* More fixes

* Unpushed changes

* Some more fixes and error handling

* Fix sqlx prepare, formatting

Co-authored-by: Aeledfyr <aeledfyr@gmail.com>

src/routes/mod.rs

@@ -49,12 +49,20 @@ pub fn users_config(cfg: &mut web::ServiceConfig) {
         web::scope("user")
             .service(users::user_get)
             .service(users::mods_list)
-            .service(users::user_delete),
+            .service(users::user_delete)
+            .service(users::teams),
     );
 }
 
 pub fn teams_config(cfg: &mut web::ServiceConfig) {
-    cfg.service(web::scope("team").service(teams::team_members_get));
+    cfg.service(
+        web::scope("team")
+            .service(teams::team_members_get)
+            .service(teams::edit_team_member)
+            .service(teams::add_team_member)
+            .service(teams::join_team)
+            .service(teams::remove_team_member),
+    );
 }
 
 #[derive(thiserror::Error, Debug)]
@@ -63,8 +71,12 @@ pub enum ApiError {
     DatabaseError(#[from] crate::database::models::DatabaseError),
     #[error("Deserialization error: {0}")]
     JsonError(#[from] serde_json::Error),
-    #[error("Authentication Error")]
-    AuthenticationError,
+    #[error("Authentication Error: {0}")]
+    AuthenticationError(#[from] crate::auth::AuthenticationError),
+    #[error("Authentication Error: {0}")]
+    CustomAuthenticationError(String),
+    #[error("Invalid Input: {0}")]
+    InvalidInputError(String),
     #[error("Search Error: {0}")]
     SearchError(#[from] meilisearch_sdk::errors::Error),
 }
@@ -73,9 +85,11 @@ impl actix_web::ResponseError for ApiError {
     fn status_code(&self) -> actix_web::http::StatusCode {
         match self {
             ApiError::DatabaseError(..) => actix_web::http::StatusCode::INTERNAL_SERVER_ERROR,
-            ApiError::AuthenticationError => actix_web::http::StatusCode::UNAUTHORIZED,
+            ApiError::AuthenticationError(..) => actix_web::http::StatusCode::UNAUTHORIZED,
+            ApiError::CustomAuthenticationError(..) => actix_web::http::StatusCode::UNAUTHORIZED,
             ApiError::JsonError(..) => actix_web::http::StatusCode::BAD_REQUEST,
             ApiError::SearchError(..) => actix_web::http::StatusCode::INTERNAL_SERVER_ERROR,
+            ApiError::InvalidInputError(..) => actix_web::http::StatusCode::BAD_REQUEST,
         }
     }
 
@@ -84,9 +98,11 @@ impl actix_web::ResponseError for ApiError {
             crate::models::error::ApiError {
                 error: match self {
                     ApiError::DatabaseError(..) => "database_error",
-                    ApiError::AuthenticationError => "unauthorized",
+                    ApiError::AuthenticationError(..) => "unauthorized",
+                    ApiError::CustomAuthenticationError(..) => "unauthorized",
                     ApiError::JsonError(..) => "json_error",
                     ApiError::SearchError(..) => "search_error",
+                    ApiError::InvalidInputError(..) => "invalid_input",
                 },
                 description: &self.to_string(),
             },

src/routes/mod_creation.rs

@@ -437,6 +437,8 @@ async fn mod_create_inner(
                 user_id: current_user.id.into(),
                 name: current_user.username.clone(),
                 role: crate::models::teams::OWNER_ROLE.to_owned(),
+                permissions: crate::models::teams::Permissions::ALL,
+                accepted: true,
             }],
         };
 

src/routes/mods.rs

@@ -1,8 +1,10 @@
 use super::ApiError;
-use crate::auth::check_is_moderator_from_headers;
+use crate::auth::get_user_from_headers;
 use crate::database;
 use crate::models;
 use crate::models::mods::SearchRequest;
+use crate::models::teams::Permissions;
+use crate::models::users::Role;
 use crate::search::{search_for_mod, SearchConfig, SearchError};
 use actix_web::{delete, get, web, HttpRequest, HttpResponse};
 use serde::{Deserialize, Serialize};
@@ -92,17 +94,30 @@ pub async fn mod_delete(
     pool: web::Data<PgPool>,
     config: web::Data<SearchConfig>,
 ) -> Result<HttpResponse, ApiError> {
-    check_is_moderator_from_headers(
-        req.headers(),
-        &mut *pool
-            .acquire()
-            .await
-            .map_err(|e| ApiError::DatabaseError(e.into()))?,
-    )
-    .await
-    .map_err(|_| ApiError::AuthenticationError)?;
-
+    let user = get_user_from_headers(req.headers(), &**pool).await?;
     let id = info.into_inner().0;
+
+    if user.role != Role::Moderator || user.role != Role::Admin {
+        let mod_item = database::models::Mod::get(id.into(), &**pool)
+            .await
+            .map_err(|e| ApiError::DatabaseError(e.into()))?
+            .ok_or_else(|| ApiError::InvalidInputError("Invalid Mod ID specified!".to_string()))?;
+        let team_member = database::models::TeamMember::get_from_user_id(
+            mod_item.team_id,
+            user.id.into(),
+            &**pool,
+        )
+        .await
+        .map_err(ApiError::DatabaseError)?
+        .ok_or_else(|| ApiError::InvalidInputError("Invalid Mod ID specified!".to_string()))?;
+
+        if !team_member.permissions.contains(Permissions::DELETE_MOD) {
+            return Err(ApiError::CustomAuthenticationError(
+                "You don't have permission to delete this mod".to_string(),
+            ));
+        }
+    }
+
     let result = database::models::Mod::remove_full(id.into(), &**pool)
         .await
         .map_err(|e| ApiError::DatabaseError(e.into()))?;

src/routes/tags.rs

@@ -41,8 +41,7 @@ pub async fn category_create(
             .await
             .map_err(|e| ApiError::DatabaseError(e.into()))?,
     )
-    .await
-    .map_err(|_| ApiError::AuthenticationError)?;
+    .await?;
 
     let name = category.into_inner().0;
 
@@ -64,8 +63,7 @@ pub async fn category_delete(
             .await
             .map_err(|e| ApiError::DatabaseError(e.into()))?,
     )
-    .await
-    .map_err(|_| ApiError::AuthenticationError)?;
+    .await?;
 
     let name = category.into_inner().0;
     let mut transaction = pool.begin().await.map_err(models::DatabaseError::from)?;
@@ -103,8 +101,7 @@ pub async fn loader_create(
             .await
             .map_err(|e| ApiError::DatabaseError(e.into()))?,
     )
-    .await
-    .map_err(|_| ApiError::AuthenticationError)?;
+    .await?;
 
     let name = loader.into_inner().0;
 
@@ -126,8 +123,7 @@ pub async fn loader_delete(
             .await
             .map_err(|e| ApiError::DatabaseError(e.into()))?,
     )
-    .await
-    .map_err(|_| ApiError::AuthenticationError)?;
+    .await?;
 
     let name = loader.into_inner().0;
     let mut transaction = pool.begin().await.map_err(models::DatabaseError::from)?;
@@ -187,8 +183,7 @@ pub async fn game_version_create(
             .await
             .map_err(|e| ApiError::DatabaseError(e.into()))?,
     )
-    .await
-    .map_err(|_| ApiError::AuthenticationError)?;
+    .await?;
 
     let name = game_version.into_inner().0;
 
@@ -221,8 +216,7 @@ pub async fn game_version_delete(
             .await
             .map_err(|e| ApiError::DatabaseError(e.into()))?,
     )
-    .await
-    .map_err(|_| ApiError::AuthenticationError)?;
+    .await?;
 
     let name = game_version.into_inner().0;
     let mut transaction = pool.begin().await.map_err(models::DatabaseError::from)?;

src/routes/teams.rs

@@ -1,25 +1,363 @@
+use crate::auth::get_user_from_headers;
 use crate::database::models::TeamMember;
-use crate::models::teams::TeamId;
+use crate::models::teams::{Permissions, TeamId};
+use crate::models::users::UserId;
 use crate::routes::ApiError;
-use actix_web::{get, web, HttpResponse};
+use actix_web::{delete, get, patch, post, web, HttpRequest, HttpResponse};
+use serde::{Deserialize, Serialize};
 use sqlx::PgPool;
 
 #[get("{id}/members")]
 pub async fn team_members_get(
+    req: HttpRequest,
     info: web::Path<(TeamId,)>,
     pool: web::Data<PgPool>,
 ) -> Result<HttpResponse, ApiError> {
     let id = info.into_inner().0;
     let members_data = TeamMember::get_from_team(id.into(), &**pool).await?;
 
+    let current_user = get_user_from_headers(req.headers(), &**pool).await.ok();
+
+    if let Some(user) = current_user {
+        let team_member = TeamMember::get_from_user_id(id.into(), user.id.into(), &**pool)
+            .await
+            .map_err(ApiError::DatabaseError)?;
+
+        if team_member.is_some() {
+            let team_members: Vec<crate::models::teams::TeamMember> = members_data
+                .into_iter()
+                .map(|data| crate::models::teams::TeamMember {
+                    user_id: data.user_id.into(),
+                    name: data.name,
+                    role: data.role,
+                    permissions: data.permissions,
+                })
+                .collect();
+
+            return Ok(HttpResponse::Ok().json(team_members));
+        }
+    }
+
     let team_members: Vec<crate::models::teams::TeamMember> = members_data
         .into_iter()
         .map(|data| crate::models::teams::TeamMember {
             user_id: data.user_id.into(),
             name: data.name,
             role: data.role,
+            permissions: Permissions::default(),
         })
         .collect();
 
     Ok(HttpResponse::Ok().json(team_members))
 }
+
+#[post("{id}/join")]
+pub async fn join_team(
+    req: HttpRequest,
+    info: web::Path<(TeamId,)>,
+    pool: web::Data<PgPool>,
+) -> Result<HttpResponse, ApiError> {
+    let team_id = info.into_inner().0.into();
+    let current_user = get_user_from_headers(req.headers(), &**pool).await?;
+
+    let member =
+        TeamMember::get_from_user_id_pending(team_id, current_user.id.into(), &**pool).await?;
+
+    if let Some(member) = member {
+        if member.accepted {
+            return Err(ApiError::InvalidInputError(
+                "You are already a member of this team".to_string(),
+            ));
+        }
+        let mut transaction = pool
+            .begin()
+            .await
+            .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+        // Edit Team Member to set Accepted to True
+        TeamMember::edit_team_member(
+            team_id,
+            current_user.id.into(),
+            None,
+            None,
+            Some(true),
+            None,
+            &mut transaction,
+        )
+        .await?;
+
+        transaction
+            .commit()
+            .await
+            .map_err(|e| ApiError::DatabaseError(e.into()))?;
+    } else {
+        return Err(ApiError::InvalidInputError(
+            "There is no pending request from this team".to_string(),
+        ));
+    }
+
+    Ok(HttpResponse::Ok().body(""))
+}
+
+fn default_role() -> String {
+    "Member".to_string()
+}
+
+#[derive(Serialize, Deserialize, Clone)]
+pub struct NewTeamMember {
+    pub user_id: UserId,
+    #[serde(default = "default_role")]
+    pub role: String,
+    #[serde(default = "Permissions::default")]
+    pub permissions: Permissions,
+}
+
+#[post("{id}/members")]
+pub async fn add_team_member(
+    req: HttpRequest,
+    info: web::Path<(TeamId,)>,
+    pool: web::Data<PgPool>,
+    new_member: web::Json<NewTeamMember>,
+) -> Result<HttpResponse, ApiError> {
+    let team_id = info.into_inner().0.into();
+
+    let mut transaction = pool
+        .begin()
+        .await
+        .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+    let current_user = get_user_from_headers(req.headers(), &**pool).await?;
+    let team_member =
+        TeamMember::get_from_user_id(team_id, current_user.id.into(), &**pool).await?;
+
+    let member = match team_member {
+        Some(m) => m,
+        None => {
+            return Err(ApiError::CustomAuthenticationError(
+                "You don't have permission to invite users to this team".to_string(),
+            ))
+        }
+    };
+
+    if !member.permissions.contains(Permissions::MANAGE_INVITES) {
+        return Err(ApiError::CustomAuthenticationError(
+            "You don't have permission to invite users to this team".to_string(),
+        ));
+    }
+    if !member.permissions.contains(new_member.permissions) {
+        return Err(ApiError::InvalidInputError(
+            "The new member has permissions that you don't have".to_string(),
+        ));
+    }
+
+    if new_member.role == crate::models::teams::OWNER_ROLE {
+        return Err(ApiError::InvalidInputError(
+            "The `Owner` role is restricted to one person".to_string(),
+        ));
+    }
+    let request = crate::database::models::team_item::TeamMember::get_from_user_id_pending(
+        team_id,
+        member.user_id,
+        &**pool,
+    )
+    .await?;
+
+    if let Some(req) = request {
+        if req.accepted {
+            return Err(ApiError::InvalidInputError(
+                "The user is already a member of that team".to_string(),
+            ));
+        } else {
+            return Err(ApiError::InvalidInputError(
+                "There is already a pending member request for this user".to_string(),
+            ));
+        }
+    }
+
+    let new_user = crate::database::models::User::get(member.user_id, &**pool)
+        .await
+        .map_err(|e| ApiError::DatabaseError(e.into()))?
+        .ok_or_else(|| ApiError::InvalidInputError("An invalid User ID specified".to_string()))?;
+
+    let new_id = crate::database::models::ids::generate_team_member_id(&mut transaction).await?;
+    TeamMember {
+        id: new_id,
+        team_id,
+        user_id: new_member.user_id.into(),
+        name: new_user.username,
+        role: new_member.role.clone(),
+        permissions: new_member.permissions,
+        accepted: false,
+    }
+    .insert(&mut transaction)
+    .await
+    .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+    transaction
+        .commit()
+        .await
+        .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+    Ok(HttpResponse::Ok().body(""))
+}
+
+#[derive(Serialize, Deserialize, Clone)]
+pub struct EditTeamMember {
+    pub permissions: Option<Permissions>,
+    pub role: Option<String>,
+    pub name: Option<String>,
+}
+
+#[patch("{id}/members/{user_id}")]
+pub async fn edit_team_member(
+    req: HttpRequest,
+    info: web::Path<(TeamId, UserId)>,
+    pool: web::Data<PgPool>,
+    edit_member: web::Json<EditTeamMember>,
+) -> Result<HttpResponse, ApiError> {
+    let ids = info.into_inner();
+    let id = ids.0.into();
+    let user_id = ids.1.into();
+
+    let current_user = get_user_from_headers(req.headers(), &**pool).await?;
+    let team_member = TeamMember::get_from_user_id(id, current_user.id.into(), &**pool).await?;
+
+    let mut transaction = pool
+        .begin()
+        .await
+        .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+    let member = match team_member {
+        Some(m) => m,
+        None => {
+            return Err(ApiError::CustomAuthenticationError(
+                "You don't have permission to edit members of this team".to_string(),
+            ))
+        }
+    };
+
+    // If the only thing being modified is the name, a user can
+    // modify their own member without extra permissions.
+    if user_id == current_user.id.into()
+        && edit_member.permissions.is_none()
+        && edit_member.role.is_none()
+    {
+        TeamMember::edit_team_member(
+            id,
+            user_id,
+            None,
+            None,
+            None,
+            edit_member.name.clone(),
+            &mut transaction,
+        )
+        .await?;
+
+        transaction
+            .commit()
+            .await
+            .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+        return Ok(HttpResponse::Ok().body(""));
+    }
+
+    if !member.permissions.contains(Permissions::EDIT_MEMBER) {
+        return Err(ApiError::CustomAuthenticationError(
+            "You don't have permission to edit members of this team".to_string(),
+        ));
+    }
+
+    if let Some(new_permissions) = edit_member.permissions {
+        if !member.permissions.contains(new_permissions) {
+            return Err(ApiError::InvalidInputError(
+                "The new permissions have permissions that you don't have".to_string(),
+            ));
+        }
+    }
+
+    if edit_member.role.as_deref() == Some(crate::models::teams::OWNER_ROLE) {
+        return Err(ApiError::InvalidInputError(
+            "The `Owner` role is restricted to one person".to_string(),
+        ));
+    }
+
+    TeamMember::edit_team_member(
+        id,
+        user_id,
+        edit_member.permissions,
+        edit_member.role.clone(),
+        None,
+        edit_member.name.clone(),
+        &mut transaction,
+    )
+    .await?;
+
+    transaction
+        .commit()
+        .await
+        .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+    Ok(HttpResponse::Ok().body(""))
+}
+
+#[delete("{id}/members/{user_id}")]
+pub async fn remove_team_member(
+    req: HttpRequest,
+    info: web::Path<(TeamId, UserId)>,
+    pool: web::Data<PgPool>,
+) -> Result<HttpResponse, ApiError> {
+    let ids = info.into_inner();
+    let id = ids.0.into();
+    let user_id = ids.1.into();
+
+    let current_user = get_user_from_headers(req.headers(), &**pool).await?;
+    let team_member = TeamMember::get_from_user_id(id, current_user.id.into(), &**pool).await?;
+
+    let member = match team_member {
+        Some(m) => m,
+        None => {
+            return Err(ApiError::CustomAuthenticationError(
+                "You don't have permission to remove members from this team".to_string(),
+            ))
+        }
+    };
+
+    let delete_member = TeamMember::get_from_user_id(id, user_id, &**pool).await?;
+
+    if let Some(delete_member) = delete_member {
+        if delete_member.role == crate::models::teams::OWNER_ROLE {
+            // The owner cannot be removed from a team
+            return Err(ApiError::CustomAuthenticationError(
+                "The owner can't be removed from a team".to_string(),
+            ));
+        }
+
+        if delete_member.accepted {
+            // Members other than the owner can either leave the team, or be
+            // removed by a member with the REMOVE_MEMBER permission.
+            if delete_member.user_id == member.user_id
+                || member.permissions.contains(Permissions::REMOVE_MEMBER)
+            {
+                TeamMember::delete(id, user_id, &**pool).await?;
+            } else {
+                return Err(ApiError::CustomAuthenticationError(
+                    "You do not have permission to remove a member from this team".to_string(),
+                ));
+            }
+        } else if delete_member.user_id == member.user_id
+            || member.permissions.contains(Permissions::MANAGE_INVITES)
+        {
+            // This is a pending invite rather than a member, so the
+            // user being invited or team members with the MANAGE_INVITES
+            // permission can remove it.
+            TeamMember::delete(id, user_id, &**pool).await?;
+        } else {
+            return Err(ApiError::CustomAuthenticationError(
+                "You do not have permission to cancel a team invite".to_string(),
+            ));
+        }
+        Ok(HttpResponse::Ok().body(""))
+    } else {
+        Ok(HttpResponse::NotFound().body(""))
+    }
+}

src/routes/users.rs

@@ -1,5 +1,6 @@
 use crate::auth::{check_is_moderator_from_headers, get_user_from_headers};
-use crate::database::models::User;
+use crate::database::models::{TeamMember, User};
+use crate::models::teams::Permissions;
 use crate::models::users::{Role, UserId};
 use crate::routes::ApiError;
 use actix_web::{delete, get, web, HttpRequest, HttpResponse};
@@ -19,8 +20,7 @@ pub async fn user_auth_get(
                 .await
                 .map_err(|e| ApiError::DatabaseError(e.into()))?,
         )
-        .await
-        .map_err(|_| ApiError::AuthenticationError)?,
+        .await?,
     ))
 }
 
@@ -121,6 +121,47 @@ pub async fn mods_list(
     }
 }
 
+#[get("teams")]
+pub async fn teams(
+    req: HttpRequest,
+    info: web::Path<(UserId,)>,
+    pool: web::Data<PgPool>,
+) -> Result<HttpResponse, ApiError> {
+    let id: crate::database::models::UserId = info.into_inner().0.into();
+
+    let current_user = get_user_from_headers(req.headers(), &**pool).await.ok();
+
+    let results;
+    let mut same_user = false;
+
+    if let Some(user) = current_user {
+        if user.id.0 == id.0 as u64 {
+            results = TeamMember::get_from_user_private(id, &**pool).await?;
+            same_user = true;
+        } else {
+            results = TeamMember::get_from_user_public(id, &**pool).await?;
+        }
+    } else {
+        results = TeamMember::get_from_user_public(id, &**pool).await?;
+    }
+
+    let team_members: Vec<crate::models::teams::TeamMember> = results
+        .into_iter()
+        .map(|data| crate::models::teams::TeamMember {
+            user_id: data.user_id.into(),
+            name: data.name,
+            role: data.role,
+            permissions: if same_user {
+                data.permissions
+            } else {
+                Permissions::default()
+            },
+        })
+        .collect();
+
+    Ok(HttpResponse::Ok().json(team_members))
+}
+
 // TODO: Make this actually do stuff
 #[delete("{id}")]
 pub async fn user_delete(
@@ -135,8 +176,7 @@ pub async fn user_delete(
             .await
             .map_err(|e| ApiError::DatabaseError(e.into()))?,
     )
-    .await
-    .map_err(|_| ApiError::AuthenticationError)?;
+    .await?;
 
     let _id = info.0;
     let result = Some(());

src/routes/versions.rs

@@ -1,7 +1,9 @@
 use super::ApiError;
-use crate::auth::check_is_moderator_from_headers;
+use crate::auth::get_user_from_headers;
 use crate::database;
 use crate::models;
+use crate::models::teams::Permissions;
+use crate::models::users::Role;
 use actix_web::{delete, get, web, HttpRequest, HttpResponse};
 use serde::{Deserialize, Serialize};
 use sqlx::PgPool;
@@ -142,21 +144,44 @@ fn convert_version(data: database::models::version_item::QueryVersion) -> models
 #[delete("{version_id}")]
 pub async fn version_delete(
     req: HttpRequest,
-    info: web::Path<(models::ids::ModId, models::ids::VersionId)>,
+    info: web::Path<(models::ids::VersionId,)>,
     pool: web::Data<PgPool>,
 ) -> Result<HttpResponse, ApiError> {
-    check_is_moderator_from_headers(
-        req.headers(),
-        &mut *pool
-            .acquire()
-            .await
-            .map_err(|e| ApiError::DatabaseError(e.into()))?,
-    )
-    .await
-    .map_err(|_| ApiError::AuthenticationError)?;
+    let user = get_user_from_headers(req.headers(), &**pool).await?;
+    let id = info.into_inner().0;
+
+    if user.role != Role::Moderator || user.role != Role::Admin {
+        let version = database::models::Version::get(id.into(), &**pool)
+            .await
+            .map_err(|e| ApiError::DatabaseError(e.into()))?
+            .ok_or_else(|| {
+                ApiError::InvalidInputError("Invalid Version ID specified!".to_string())
+            })?;
+        let mod_item = database::models::Mod::get(version.mod_id, &**pool)
+            .await
+            .map_err(|e| ApiError::DatabaseError(e.into()))?
+            .ok_or_else(|| {
+                ApiError::InvalidInputError("Invalid Version ID specified!".to_string())
+            })?;
+        let team_member = database::models::TeamMember::get_from_user_id(
+            mod_item.team_id,
+            user.id.into(),
+            &**pool,
+        )
+        .await
+        .map_err(ApiError::DatabaseError)?
+        .ok_or_else(|| ApiError::InvalidInputError("Invalid Version ID specified!".to_string()))?;
+
+        if !team_member
+            .permissions
+            .contains(Permissions::DELETE_VERSION)
+        {
+            return Err(ApiError::CustomAuthenticationError(
+                "You don't have permission to delete versions in this team".to_string(),
+            ));
+        }
+    }
 
-    // TODO: check if the mod exists and matches the version id
-    let id = info.1;
     let result = database::models::Version::remove_full(id.into(), &**pool)
         .await
         .map_err(|e| ApiError::DatabaseError(e.into()))?;