improvements

src/api/pads_public.rs

@@ -21,6 +21,8 @@ pub struct CreatePadRequest {
 #[derive(Debug, Deserialize)]
 pub struct SetPadPasswordRequest {
     password: String,
+    #[serde(default)]
+    client_id: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -135,7 +137,8 @@ pub async fn pad_info(
             .unwrap_or(false);
     let guest_owner = pad_creator_is_requester(&headers, &pad);
     let password_write_access = has_password_write_access(&state, &headers, "pad", &slug).await?;
-    let can_manage_authorship = account_owner || guest_owner || password_write_access;
+    let can_manage_authorship =
+        can_manage_resource_settings(account_owner, guest_owner, password_write_access);
     let upload_max_size_bytes = resource_upload_limit(&state, &headers, "pad", &slug).await?;
     let can_upload_files = upload_max_size_bytes.is_some();
     let can_save_editor_settings = (personal_editor_settings || can_manage_authorship)
@@ -174,7 +177,11 @@ pub async fn pad_info(
         personal_editor_settings,
         can_save_editor_settings,
         can_manage_authorship,
-        can_set_password: pad.password_hash.is_none() && (account_owner || guest_owner),
+        can_set_password: can_set_resource_password(
+            pad.password_hash.is_some(),
+            account_owner,
+            guest_owner,
+        ),
         files: markdown_file_references(&state, Some(pad.id), None, None).await?,
     }))
 }
@@ -195,12 +202,17 @@ pub async fn set_pad_password(
         &state, "pad", &slug, user_session_token(&headers),
     ).await.unwrap_or(false);
     let guest_owner = pad_creator_is_requester(&headers, &pad);
-    if !account_owner && !guest_owner {
+    if !can_set_resource_password(pad.password_hash.is_some(), account_owner, guest_owner) {
         return Err(ApiError::forbidden("Only the note owner can set its password."));
     }
+    let except_client_id =
+        crate::websocket::clean_collaboration_client_id(payload.client_id);
     let password = validate_password(Some(payload.password.as_str()))?
         .ok_or_else(|| ApiError::bad_request("Password is required."))?;
     db::set_pad_password(&state.db, &slug, password).await?;
+    state
+        .notify_pad_password_required(&slug, except_client_id)
+        .await;
     Ok(Json(serde_json::json!({"ok": true, "protected": true})))
 }
 
@@ -213,8 +225,11 @@ pub async fn set_pad_editor_settings(
     let pad = db::find_pad(&state.db, &slug)
         .await?
         .ok_or_else(ApiError::not_found_note)?;
-    let creator_can_manage_authorship = pad_creator_is_requester(&headers, &pad)
-        || has_password_write_access(&state, &headers, "pad", &slug).await?;
+    let creator_can_manage_authorship = can_manage_resource_settings(
+        false,
+        pad_creator_is_requester(&headers, &pad),
+        has_password_write_access(&state, &headers, "pad", &slug).await?,
+    );
     save_editor_settings(
         &state,
         &headers,