security upgrade

src/api/pads_public.rs

@@ -34,6 +34,7 @@ pub struct PadInfo {
     created_at: String,
     updated_at: String,
     can_delete_files: bool,
+    can_upload_files: bool,
     global_color: Option<String>,
     note_color: Option<String>,
     authorship_mode: String,
@@ -64,11 +65,23 @@ pub async fn create_pad(
         ));
     }
     let slug = unique_pad_slug(&state, &base).await?;
-    let pad = db::create_pad(&state.db, &slug, title, password).await?;
-    if let Some(user) = crate::auth::optional_user(&state, &headers)
+    let account_user = crate::auth::optional_user(&state, &headers)
         .await
-        .map_err(|e| ApiError::forbidden(&e.message))?
-    {
+        .map_err(|e| ApiError::forbidden(&e.message))?;
+    let created_by_guest_id = if account_user.is_none() {
+        requester_guest_id(&headers)
+    } else {
+        None
+    };
+    let pad = db::create_pad(
+        &state.db,
+        &slug,
+        title,
+        password,
+        created_by_guest_id,
+    )
+    .await?;
+    if let Some(user) = account_user {
         sqlx::query(queries::get(state.db.kind(), queries::USER_ATTACH_PAD))
             .bind(user.id)
             .bind(&pad.slug)
@@ -109,7 +122,7 @@ pub async fn pad_info(
     .await?;
     let resource_editor_settings =
         db::load_resource_editor_settings(&state.db, "pad", &slug).await?;
-    let can_manage_authorship = crate::auth::is_resource_owner(
+    let account_owner = crate::auth::is_resource_owner(
         &state,
         "pad",
         &slug,
@@ -117,7 +130,12 @@ pub async fn pad_info(
     )
     .await
     .unwrap_or(false);
-    let can_save_editor_settings = personal_editor_settings
+    let guest_owner = pad_creator_is_requester(&headers, &pad);
+    let password_write_access = has_password_write_access(&state, &headers, "pad", &slug).await?;
+    let can_manage_authorship = account_owner || guest_owner || password_write_access;
+    let can_upload_files = session_user(&state, &headers).await?.is_some()
+        && has_write_permission(&state, &headers, "pad", &slug).await?;
+    let can_save_editor_settings = (personal_editor_settings || can_manage_authorship)
         && has_write_permission(&state, &headers, "pad", &slug).await?;
     if pad.is_private == 0
         && !db::pad_public_page_disabled(&state.db, pad.id).await?
@@ -136,6 +154,7 @@ pub async fn pad_info(
         created_at: db::normalize_timestamp(&pad.created_at),
         updated_at: db::normalize_timestamp(&pad.updated_at),
         can_delete_files: can_manage_authorship,
+        can_upload_files,
         global_color,
         note_color,
         authorship_mode: resource_editor_settings.authorship_mode,
@@ -162,6 +181,8 @@ pub async fn set_pad_editor_settings(
     let pad = db::find_pad(&state.db, &slug)
         .await?
         .ok_or_else(ApiError::not_found_note)?;
+    let creator_can_manage_authorship = pad_creator_is_requester(&headers, &pad)
+        || has_password_write_access(&state, &headers, "pad", &slug).await?;
     save_editor_settings(
         &state,
         &headers,
@@ -170,6 +191,7 @@ pub async fn set_pad_editor_settings(
         "pad",
         &slug,
         db::EditorPreferenceResource::Pad(pad.id),
+        creator_can_manage_authorship,
         payload,
     )
     .await