gru/rustpad
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new functions and fixes

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-08-06 09:08:02 +02:00
parent 1e80fb2bcb
commit 7989a873e7
11 changed files with 191 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/api/mod.rs
+79 -15
View File
@@ -136,6 +136,25 @@ fn workspace_creator_is_requester(headers: &HeaderMap, workspace: &db::Workspace
guest_owner_is_requester(headers, workspace.created_by_guest_id.as_deref())
}
async fn requester_owns_note(
state: &SharedState,
headers: &HeaderMap,
workspace: &db::Workspace,
note: &db::Note,
) -> Result<bool, ApiError> {
let workspace_account_owner = crate::auth::is_resource_owner(
state,
"workspace",
&workspace.slug,
user_session_token(headers),
)
.await
.unwrap_or(false);
Ok(workspace_account_owner
|| workspace_creator_is_requester(headers, workspace)
|| note_creator_is_requester(state, headers, note).await?)
}
async fn can_set_workspace_password(
state: &SharedState,
headers: &HeaderMap,
@@ -399,6 +418,7 @@ pub struct NoteListItem {
updated_at: String,
url: String,
protected: bool,
can_delete: bool,
created_by: Option<String>,
participant_count: i64,
file_count: i64,
@@ -421,6 +441,7 @@ pub struct NoteInfo {
private: bool,
created_at: String,
updated_at: String,
can_delete: bool,
can_delete_files: bool,
can_upload_files: bool,
upload_max_size_bytes: Option<usize>,
@@ -741,6 +762,32 @@ pub async fn open_workspace(
&headers,
)
.await?;
let mut access_level = effective_header_access_level(
&state,
&headers,
"workspace",
&workspace.slug,
workspace.is_private,
workspace.password_hash.is_some(),
)
.await?;
if db::verify_workspace_password(&workspace, payload.password.as_deref()) {
access_level = AccessLevel::Write;
}
let workspace_account_owner = crate::auth::is_resource_owner(
&state,
"workspace",
&workspace.slug,
bearer_token(&headers),
)
.await
.unwrap_or(false);
let workspace_owner =
workspace_account_owner || workspace_creator_is_requester(&headers, &workspace);
let requester_user = session_user(&state, &headers).await?;
let requester_nickname = requester_user.as_ref().map(|user| user.nickname.as_str());
let requester_guest = requester_guest_id(&headers);
let stats = db::list_note_stats(&state.db, workspace.id)
.await?
.into_iter()
@@ -763,6 +810,19 @@ pub async fn open_workspace(
})
.map(|note| {
let stats = stats.get(&note.id);
let note_owner = if let Some(owner_guest_id) = note.created_by_guest_id.as_deref() {
requester_guest.is_some_and(|requester| requester == owner_guest_id)
} else {
note.created_by
.as_deref()
.zip(requester_nickname)
.is_some_and(|(owner, requester)| owner == requester)
};
let can_delete = can_delete_workspace_note(
access_level,
note.protected,
workspace_owner || note_owner,
);
NoteListItem {
url: format!("/w/{}/n/{}", workspace.slug, note.slug),
slug: note.slug,
@@ -770,6 +830,7 @@ pub async fn open_workspace(
created_at: db::normalize_timestamp(&note.created_at),
updated_at: db::normalize_timestamp(&note.updated_at),
protected: note.protected,
can_delete,
created_by: note.created_by,
participant_count: stats.map_or(0, |value| value.participant_count),
file_count: stats.map_or(0, |value| value.file_count),
@@ -788,18 +849,6 @@ pub async fn open_workspace(
let start = (page - 1) * per_page;
let notes = notes.into_iter().skip(start).take(per_page).collect();
let mut access_level = effective_header_access_level(
&state,
&headers,
"workspace",
&workspace.slug,
workspace.is_private,
workspace.password_hash.is_some(),
)
.await?;
if db::verify_workspace_password(&workspace, payload.password.as_deref()) {
access_level = AccessLevel::Write;
}
let can_set_password = can_set_workspace_password(&state, &headers, &workspace).await;
Ok(Json(WorkspaceOpenResponse {
workspace: workspace_info_from(&workspace, access_level, can_set_password),
@@ -911,6 +960,7 @@ pub async fn create_note(
created_at: db::normalize_timestamp(&note.created_at),
updated_at: db::normalize_timestamp(&note.updated_at),
protected: note.protected,
can_delete: true,
created_by: note.created_by,
participant_count: 0,
file_count: 0,
@@ -1050,9 +1100,14 @@ pub async fn note_info(
let note_owner = note_creator_is_requester(&state, &headers, &note).await?;
let password_write_access =
has_password_write_access(&state, &headers, "workspace", &workspace_slug).await?;
let can_manage_authorship =
can_manage_resource_settings(workspace_owner, note_owner, password_write_access);
let can_delete_files = can_manage_authorship;
let requester_is_owner = workspace_owner || workspace_guest_owner || note_owner;
let can_manage_authorship = can_manage_resource_settings(
workspace_owner || workspace_guest_owner,
note_owner,
password_write_access,
);
let can_delete_files =
can_delete_workspace_note(access_level, note.protected, requester_is_owner);
let upload_max_size_bytes =
resource_upload_limit(&state, &headers, "workspace", &workspace_slug).await?;
let can_upload_files = upload_max_size_bytes.is_some();
@@ -1080,6 +1135,7 @@ pub async fn note_info(
private: workspace.is_private != 0,
created_at: db::normalize_timestamp(&note.created_at),
updated_at: db::normalize_timestamp(&note.updated_at),
can_delete: can_delete_files,
can_delete_files,
can_upload_files,
upload_max_size_bytes,
@@ -1404,6 +1460,14 @@ async fn effective_header_access_level(
Ok(level)
}
fn can_delete_workspace_note(
level: AccessLevel,
note_protected: bool,
requester_is_owner: bool,
) -> bool {
level >= AccessLevel::Write && (!note_protected || requester_is_owner)
}
fn require_write(level: AccessLevel) -> Result<(), ApiError> {
if level >= AccessLevel::Write {
Ok(())