Scoped PATs (#651)

* Scoped PATs

* fix threads issues

* fix migration

src/routes/v2/project_creation.rs

@@ -4,13 +4,14 @@ use crate::database::models;
 use crate::database::models::thread_item::ThreadBuilder;
 use crate::file_hosting::{FileHost, FileHostingError};
 use crate::models::error::ApiError;
+use crate::models::pats::Scopes;
 use crate::models::projects::{
     DonationLink, License, MonetizationStatus, ProjectId, ProjectStatus, SideType, VersionId,
     VersionStatus,
 };
 use crate::models::threads::ThreadType;
 use crate::models::users::UserId;
-use crate::queue::session::SessionQueue;
+use crate::queue::session::AuthQueue;
 use crate::search::indexing::IndexingError;
 use crate::util::routes::read_from_field;
 use crate::util::validate::validation_errors_to_string;
@@ -273,7 +274,7 @@ pub async fn project_create(
     client: Data<PgPool>,
     redis: Data<deadpool_redis::Pool>,
     file_host: Data<Arc<dyn FileHost + Send + Sync>>,
-    session_queue: Data<SessionQueue>,
+    session_queue: Data<AuthQueue>,
 ) -> Result<HttpResponse, CreateError> {
     let mut transaction = client.begin().await?;
     let mut uploaded_files = Vec::new();
@@ -343,13 +344,21 @@ async fn project_create_inner(
     uploaded_files: &mut Vec<UploadedFile>,
     pool: &PgPool,
     redis: &deadpool_redis::Pool,
-    session_queue: &SessionQueue,
+    session_queue: &AuthQueue,
 ) -> Result<HttpResponse, CreateError> {
     // The base URL for files uploaded to backblaze
     let cdn_url = dotenvy::var("CDN_URL")?;
 
     // The currently logged in user
-    let current_user = get_user_from_headers(&req, pool, redis, session_queue).await?;
+    let current_user = get_user_from_headers(
+        &req,
+        pool,
+        redis,
+        session_queue,
+        Some(&[Scopes::PROJECT_CREATE]),
+    )
+    .await?
+    .1;
 
     let project_id: ProjectId = models::generate_project_id(transaction).await?.into();
 
@@ -726,14 +735,7 @@ async fn project_create_inner(
             }
         }
 
-        let thread_id = ThreadBuilder {
-            type_: ThreadType::Project,
-            members: vec![],
-        }
-        .insert(&mut *transaction)
-        .await?;
-
-        let project_builder = models::project_item::ProjectBuilder {
+        let project_builder_actual = models::project_item::ProjectBuilder {
             project_id: project_id.into(),
             project_type_id,
             team_id,
@@ -769,12 +771,23 @@ async fn project_create_inner(
                 })
                 .collect(),
             color: icon_data.and_then(|x| x.1),
-            thread_id,
             monetization_status: MonetizationStatus::Monetized,
         };
+        let project_builder = project_builder_actual.clone();
 
         let now = Utc::now();
 
+        let id = project_builder_actual.insert(&mut *transaction).await?;
+
+        let thread_id = ThreadBuilder {
+            type_: ThreadType::Project,
+            members: vec![],
+            project_id: Some(id),
+            report_id: None,
+        }
+            .insert(&mut *transaction)
+            .await?;
+
         let response = crate::models::projects::Project {
             id: project_id,
             slug: project_builder.slug.clone(),
@@ -817,12 +830,10 @@ async fn project_create_inner(
             donation_urls: project_create_data.donation_urls.clone(),
             gallery: gallery_urls,
             color: project_builder.color,
-            thread_id: Some(project_builder.thread_id.into()),
-            monetization_status: project_builder.monetization_status,
+            thread_id: thread_id.into(),
+            monetization_status: MonetizationStatus::Monetized,
         };
 
-        let _project_id = project_builder.insert(&mut *transaction).await?;
-
         if status == ProjectStatus::Processing {
             if let Ok(webhook_url) = dotenvy::var("MODERATION_DISCORD_WEBHOOK") {
                 crate::util::webhook::send_discord_webhook(response.id, pool, webhook_url, None)