diff --git a/json-api/src/channels.rs b/json-api/src/channels.rs index 5ab96e6..564d165 100644 --- a/json-api/src/channels.rs +++ b/json-api/src/channels.rs @@ -84,26 +84,51 @@ pub async fn create_channel(pool: &Pool, response: &mut Response, params: } } -pub async fn delete_channel(pool: &Pool, response: &mut Response, params: Value) { - // make sure we have the right parameters provided - if let Some(name) = params.get("channel_id") { - if let Some(id) = name.as_u64() { - // TODO: something more intelligent with the logging im ngl - match Channel::delete(pool, id).await { - db::Response::Success => {}, - db::Response::Other(data) => { - eprintln!("\t{}", data); - *response.status_mut() = StatusCode::INTERNAL_SERVER_ERROR; - } - _ => { - eprintln!("\tBro like restart the server"); - *response.status_mut() = StatusCode::INTERNAL_SERVER_ERROR; - } +pub async fn delete_channel(pool: &Pool, response: &mut Response, params: HashMap<&str, &str>) { + /* + * Deletes a channel from the database, only after making sure the user has + * the required permissions to do so + * @channel_id : u64 - required + */ + use crate::perms; + use db::member::Member; + use db::Response::*; + + let uid = crate::http::extract_uid(¶ms); + let permissions = match Member::get(pool, uid).await { + Row(user) => user.permissions, + _ => 0 + }; + + // make sure unpriveleged users don't delete channels somehow + if perms::has_perm(permissions, perms::DELETE_CHANNEL) == false{ + *response.status_mut() = StatusCode::BAD_REQUEST; + return; + } + + // Collect the channel_id param before we attempt deletion + let channel_id = if let Some(chan) = params.get("channel_id") { + let c = chan; + match c.to_string().parse::() { + Ok(val) => Some(val), + _ => None + } + } else { + None + }; + + if let Some(id) = channel_id { + match Channel::delete(pool, id).await { + Success => {/* nothing to do on sucess */}, + Other(data) => { + eprintln!("\t{}", data); + *response.status_mut() = StatusCode::INTERNAL_SERVER_ERROR; } - } - else { - *response.status_mut() = StatusCode::BAD_REQUEST; - } + _ => { // ngmi + eprintln!("\tBro like restart the server this branch should never execute"); + *response.status_mut() = StatusCode::INTERNAL_SERVER_ERROR; + } + } } else { *response.status_mut() = StatusCode::BAD_REQUEST;