Moderation + Mod Editing (#101)

* Moderation + Mod Editing WIP

* Run prepare, fix perms

* Make it compile

* Finish moderation and edit routes

* More fixes

* Use better queries

* Final Fixes

src/routes/versions.rs

@@ -1,12 +1,13 @@
 use super::ApiError;
-use crate::auth::get_user_from_headers;
+use crate::auth::{check_is_moderator_from_headers, get_user_from_headers};
 use crate::database;
+use crate::file_hosting::FileHost;
 use crate::models;
 use crate::models::teams::Permissions;
-use crate::models::users::Role;
-use actix_web::{delete, get, web, HttpRequest, HttpResponse};
+use actix_web::{delete, get, patch, web, HttpRequest, HttpResponse};
 use serde::{Deserialize, Serialize};
 use sqlx::PgPool;
+use std::sync::Arc;
 
 // TODO: this needs filtering, and a better response type
 // Currently it only gives a list of ids, which have to be
@@ -52,6 +53,7 @@ pub struct VersionIds {
 
 #[get("versions")]
 pub async fn versions_get(
+    req: HttpRequest,
     web::Query(ids): web::Query<VersionIds>,
     pool: web::Data<PgPool>,
 ) -> Result<HttpResponse, ApiError> {
@@ -63,17 +65,48 @@ pub async fn versions_get(
         .await
         .map_err(|e| ApiError::DatabaseError(e.into()))?;
 
-    let versions: Vec<models::mods::Version> = versions_data
-        .into_iter()
-        .filter_map(|v| v)
-        .map(convert_version)
-        .collect();
+    let user_option = get_user_from_headers(req.headers(), &**pool).await.ok();
+
+    let mut versions = Vec::new();
+
+    for version_data in versions_data {
+        if let Some(version) = version_data {
+            let mut authorized = version.accepted;
+
+            if let Some(user) = &user_option {
+                if !authorized {
+                    if user.role.is_mod() {
+                        authorized = true;
+                    } else {
+                        let user_id: database::models::ids::UserId = user.id.into();
+
+                        let member_exists = sqlx::query!(
+                            "SELECT EXISTS(SELECT 1 FROM team_members tm INNER JOIN mods m ON m.team_id = tm.id AND m.id = $1 WHERE tm.user_id = $2)",
+                            version.mod_id as database::models::ModId,
+                            user_id as database::models::ids::UserId,
+                        )
+                            .fetch_one(&**pool)
+                            .await
+                            .map_err(|e| ApiError::DatabaseError(e.into()))?
+                            .exists;
+
+                        authorized = member_exists.unwrap_or(false);
+                    }
+                }
+            }
+
+            if authorized {
+                versions.push(convert_version(version));
+            }
+        }
+    }
 
     Ok(HttpResponse::Ok().json(versions))
 }
 
 #[get("{version_id}")]
 pub async fn version_get(
+    req: HttpRequest,
     info: web::Path<(models::ids::VersionId,)>,
     pool: web::Data<PgPool>,
 ) -> Result<HttpResponse, ApiError> {
@@ -81,8 +114,29 @@ pub async fn version_get(
     let version_data = database::models::Version::get_full(id.into(), &**pool)
         .await
         .map_err(|e| ApiError::DatabaseError(e.into()))?;
+    let user_option = get_user_from_headers(req.headers(), &**pool).await.ok();
 
     if let Some(data) = version_data {
+        if let Some(user) = user_option {
+            if !data.accepted && !user.role.is_mod() {
+                let user_id: database::models::ids::UserId = user.id.into();
+
+                let member_exists = sqlx::query!(
+                     "SELECT EXISTS(SELECT 1 FROM team_members tm INNER JOIN mods m ON m.team_id = tm.id AND m.id = $1 WHERE tm.user_id = $2)",
+                     data.mod_id as database::models::ModId,
+                     user_id as database::models::ids::UserId,
+                )
+                    .fetch_one(&**pool)
+                    .await
+                    .map_err(|e| ApiError::DatabaseError(e.into()))?
+                    .exists;
+
+                if !member_exists.unwrap_or(false) {
+                    return Ok(HttpResponse::NotFound().body(""));
+                }
+            }
+        }
+
         Ok(HttpResponse::Ok().json(convert_version(data)))
     } else {
         Ok(HttpResponse::NotFound().body(""))
@@ -106,7 +160,7 @@ fn convert_version(data: database::models::version_item::QueryVersion) -> models
             "release" => VersionType::Release,
             "beta" => VersionType::Beta,
             "alpha" => VersionType::Alpha,
-            _ => VersionType::Alpha,
+            _ => VersionType::Release,
         },
 
         files: data
@@ -141,6 +195,228 @@ fn convert_version(data: database::models::version_item::QueryVersion) -> models
     }
 }
 
+#[derive(Serialize, Deserialize)]
+pub struct EditVersion {
+    pub name: Option<String>,
+    pub changelog: Option<String>,
+    pub version_type: Option<models::mods::VersionType>,
+    pub dependencies: Option<Vec<models::ids::VersionId>>,
+    pub game_versions: Option<Vec<models::mods::GameVersion>>,
+    pub loaders: Option<Vec<models::mods::ModLoader>>,
+    pub accepted: Option<bool>,
+}
+
+#[patch("{id}")]
+pub async fn version_edit(
+    req: HttpRequest,
+    info: web::Path<(models::ids::VersionId,)>,
+    pool: web::Data<PgPool>,
+    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    new_version: web::Json<EditVersion>,
+) -> Result<HttpResponse, ApiError> {
+    let user = get_user_from_headers(req.headers(), &**pool).await?;
+
+    let version_id = info.into_inner().0;
+    let id = version_id.into();
+
+    let result = database::models::Version::get_full(id, &**pool)
+        .await
+        .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+    if let Some(version_item) = result {
+        let mod_item = database::models::Mod::get(version_item.mod_id, &**pool)
+            .await
+            .map_err(|e| ApiError::DatabaseError(e.into()))?
+            .ok_or_else(|| {
+                ApiError::InvalidInputError(
+                    "Attempted to edit version not attached to mod. How did this happen?"
+                        .to_string(),
+                )
+            })?;
+
+        let team_member = database::models::TeamMember::get_from_user_id(
+            mod_item.team_id,
+            user.id.into(),
+            &**pool,
+        )
+        .await?;
+        let permissions;
+
+        if let Some(member) = team_member {
+            permissions = Some(member.permissions)
+        } else if user.role.is_mod() {
+            permissions = Some(Permissions::ALL)
+        } else {
+            permissions = None
+        }
+
+        if let Some(perms) = permissions {
+            if !perms.contains(Permissions::UPLOAD_VERSION) {
+                return Err(ApiError::CustomAuthenticationError(
+                    "You do not have the permissions to edit this version!".to_string(),
+                ));
+            }
+
+            let mut transaction = pool
+                .begin()
+                .await
+                .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+            if let Some(accepted) = &new_version.accepted {
+                if !user.role.is_mod() {
+                    return Err(ApiError::CustomAuthenticationError(
+                        "You do not have the permissions to edit the approval of this version!"
+                            .to_string(),
+                    ));
+                }
+
+                sqlx::query!(
+                    "
+                    UPDATE versions
+                    SET accepted = $1
+                    WHERE (id = $2)
+                    ",
+                    accepted,
+                    id as database::models::ids::VersionId,
+                )
+                .execute(&mut *transaction)
+                .await
+                .map_err(|e| ApiError::DatabaseError(e.into()))?;
+            }
+
+            if let Some(name) = &new_version.name {
+                sqlx::query!(
+                    "
+                    UPDATE versions
+                    SET name = $1
+                    WHERE (id = $2)
+                    ",
+                    name,
+                    id as database::models::ids::VersionId,
+                )
+                .execute(&mut *transaction)
+                .await
+                .map_err(|e| ApiError::DatabaseError(e.into()))?;
+            }
+
+            if let Some(version_type) = &new_version.version_type {
+                let channel = database::models::ids::ChannelId::get_id(
+                    version_type.as_str(),
+                    &mut *transaction,
+                )
+                .await?
+                .ok_or_else(|| {
+                    ApiError::InvalidInputError(
+                        "No database entry for version type provided.".to_string(),
+                    )
+                })?;
+
+                sqlx::query!(
+                    "
+                    UPDATE versions
+                    SET release_channel = $1
+                    WHERE (id = $2)
+                    ",
+                    channel as database::models::ids::ChannelId,
+                    id as database::models::ids::VersionId,
+                )
+                .execute(&mut *transaction)
+                .await
+                .map_err(|e| ApiError::DatabaseError(e.into()))?;
+            }
+
+            if let Some(dependencies) = &new_version.dependencies {
+                sqlx::query!(
+                    "
+                    DELETE FROM dependencies WHERE dependent_id = $1
+                    ",
+                    id as database::models::ids::VersionId,
+                )
+                .execute(&mut *transaction)
+                .await
+                .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+                for dependency in dependencies {
+                    let dependency_id: database::models::ids::VersionId = dependency.clone().into();
+
+                    sqlx::query!(
+                        "
+                        INSERT INTO dependencies (dependent_id, dependency_id)
+                        VALUES ($1, $2)
+                        ",
+                        id as database::models::ids::VersionId,
+                        dependency_id as database::models::ids::VersionId,
+                    )
+                    .execute(&mut *transaction)
+                    .await
+                    .map_err(|e| ApiError::DatabaseError(e.into()))?;
+                }
+            }
+
+            if let Some(loaders) = &new_version.loaders {
+                sqlx::query!(
+                    "
+                    DELETE FROM loaders_versions WHERE version_id = $1
+                    ",
+                    id as database::models::ids::VersionId,
+                )
+                .execute(&mut *transaction)
+                .await
+                .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+                for loader in loaders {
+                    let loader_id =
+                        database::models::categories::Loader::get_id(&loader.0, &mut *transaction)
+                            .await?
+                            .ok_or_else(|| {
+                                ApiError::InvalidInputError(
+                                    "No database entry for loader provided.".to_string(),
+                                )
+                            })?;
+
+                    sqlx::query!(
+                        "
+                        INSERT INTO loaders_versions (loader_id, version_id)
+                        VALUES ($1, $2)
+                        ",
+                        loader_id as database::models::ids::LoaderId,
+                        id as database::models::ids::VersionId,
+                    )
+                    .execute(&mut *transaction)
+                    .await
+                    .map_err(|e| ApiError::DatabaseError(e.into()))?;
+                }
+            }
+
+            if let Some(body) = &new_version.changelog {
+                let mod_id: models::mods::ModId = version_item.mod_id.into();
+                let body_path = format!(
+                    "data/{}/versions/{}/changelog.md",
+                    mod_id, version_item.version_number
+                );
+
+                file_host.delete_file_version("", &*body_path).await?;
+
+                file_host
+                    .upload_file("text/plain", &body_path, body.clone().into_bytes())
+                    .await?;
+            }
+
+            transaction
+                .commit()
+                .await
+                .map_err(|e| ApiError::DatabaseError(e.into()))?;
+            Ok(HttpResponse::Ok().body(""))
+        } else {
+            Err(ApiError::CustomAuthenticationError(
+                "You do not have permission to edit this version!".to_string(),
+            ))
+        }
+    } else {
+        Ok(HttpResponse::NotFound().body(""))
+    }
+}
+
 #[delete("{version_id}")]
 pub async fn version_delete(
     req: HttpRequest,
@@ -150,7 +426,7 @@ pub async fn version_delete(
     let user = get_user_from_headers(req.headers(), &**pool).await?;
     let id = info.into_inner().0;
 
-    if user.role != Role::Moderator || user.role != Role::Admin {
+    if user.role.is_mod() {
         let version = database::models::Version::get(id.into(), &**pool)
             .await
             .map_err(|e| ApiError::DatabaseError(e.into()))?
@@ -192,3 +468,139 @@ pub async fn version_delete(
         Ok(HttpResponse::NotFound().body(""))
     }
 }
+
+#[derive(Deserialize)]
+pub struct Algorithm {
+    #[serde(default = "default_algorithm")]
+    algorithm: String,
+}
+
+fn default_algorithm() -> String {
+    "sha1".into()
+}
+
+// under /api/v1/version_file/{hash}
+#[get("{version_id}")]
+pub async fn get_version_from_hash(
+    info: web::Path<(String,)>,
+    pool: web::Data<PgPool>,
+    algorithm: web::Query<Algorithm>,
+) -> Result<HttpResponse, ApiError> {
+    let hash = info.into_inner().0;
+
+    let result = sqlx::query!(
+        "
+        SELECT version_id FROM files
+        INNER JOIN hashes ON hash = $1 AND algorithm = $2
+        ",
+        hash.as_bytes(),
+        algorithm.algorithm
+    )
+    .fetch_optional(&**pool)
+    .await
+    .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+    if let Some(id) = result {
+        let version_data = database::models::Version::get_full(
+            database::models::VersionId(id.version_id),
+            &**pool,
+        )
+        .await
+        .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+        if let Some(data) = version_data {
+            Ok(HttpResponse::Ok().json(convert_version(data)))
+        } else {
+            Ok(HttpResponse::NotFound().body(""))
+        }
+    } else {
+        Ok(HttpResponse::NotFound().body(""))
+    }
+}
+
+// under /api/v1/version_file/{hash}
+#[delete("{version_id}")]
+pub async fn delete_file(
+    req: HttpRequest,
+    info: web::Path<(String,)>,
+    pool: web::Data<PgPool>,
+    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    algorithm: web::Query<Algorithm>,
+) -> Result<HttpResponse, ApiError> {
+    check_is_moderator_from_headers(req.headers(), &**pool).await?;
+
+    let hash = info.into_inner().0;
+
+    let result = sqlx::query!(
+        "
+        SELECT version_id, filename FROM files
+        INNER JOIN hashes ON hash = $1 AND algorithm = $2
+        ",
+        hash.as_bytes(),
+        algorithm.algorithm
+    )
+    .fetch_optional(&**pool)
+    .await
+    .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+    if let Some(row) = result {
+        let version_data = database::models::Version::get_full(
+            database::models::VersionId(row.version_id),
+            &**pool,
+        )
+        .await
+        .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+        if let Some(data) = version_data {
+            let mut transaction = pool
+                .begin()
+                .await
+                .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+            sqlx::query!(
+                "
+                DELETE FROM hashes
+                WHERE hash = $1 AND algorithm = $2
+                ",
+                hash.as_bytes(),
+                algorithm.algorithm
+            )
+            .execute(&mut *transaction)
+            .await
+            .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+            sqlx::query!(
+                "
+                DELETE FROM files
+                WHERE files.version_id = $1
+                ",
+                data.id as database::models::ids::VersionId,
+            )
+            .execute(&mut *transaction)
+            .await
+            .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+            let mod_id: models::mods::ModId = data.mod_id.into();
+            file_host
+                .delete_file_version(
+                    "",
+                    &format!(
+                        "data/{}/versions/{}/{}",
+                        mod_id, data.version_number, row.filename
+                    ),
+                )
+                .await?;
+
+            transaction
+                .commit()
+                .await
+                .map_err(|e| ApiError::DatabaseError(e.into()))?;
+
+            Ok(HttpResponse::Ok().body(""))
+        } else {
+            Ok(HttpResponse::NotFound().body(""))
+        }
+    } else {
+        Ok(HttpResponse::NotFound().body(""))
+    }
+}