fix2 tokens

src/api/pads_public.rs

@@ -29,6 +29,7 @@ pub struct PadInfo {
     slug: String,
     title: String,
     protected: bool,
+    access_level: String,
     allow_public_task_updates: bool,
     public_page_unprotected: bool,
     public_page_enabled: bool,
@@ -106,6 +107,15 @@ pub async fn pad_info(
         .await?
         .ok_or_else(ApiError::not_found_note)?;
     ensure_private_resource_access(&state, &headers, "pad", &pad.slug, pad.is_private).await?;
+    let access_level = effective_header_access_level(
+        &state,
+        &headers,
+        "pad",
+        &pad.slug,
+        pad.is_private,
+        pad.password_hash.is_some(),
+    )
+    .await?;
     let (global_color, note_color) = editor_colors(&state, &headers, "pad", &slug).await?;
     let (editor_preferences, personal_editor_settings) =
         user_editor_preferences(&state, &headers, db::EditorPreferenceResource::Pad(pad.id))
@@ -133,6 +143,7 @@ pub async fn pad_info(
         slug: pad.slug,
         title: pad.title,
         protected: pad.password_hash.is_some(),
+        access_level: access_level_name(access_level).into(),
         allow_public_task_updates: db::pad_public_task_updates(&state.db, pad.id).await?,
         public_page_unprotected: db::pad_public_page_unprotected(&state.db, pad.id).await?,
         public_page_enabled: db::pad_public_page_enabled(&state.db, pad.id).await?,
@@ -256,8 +267,9 @@ pub async fn publish_pad_page(
     {
         AccessLevel::Write
     } else {
-        combined_token_access_level(
+        request_access_level(
             &state,
+            &headers,
             "pad",
             &slug,
             resource_request_token(&headers, "pad", &slug, payload.access_token.as_deref()),
@@ -311,8 +323,9 @@ pub async fn publish_note_page(
     {
         AccessLevel::Write
     } else {
-        combined_token_access_level(
+        request_access_level(
             &state,
+            &headers,
             "workspace",
             &workspace_slug,
             resource_request_token(
@@ -527,8 +540,9 @@ pub async fn pad_restore(
     {
         AccessLevel::Write
     } else {
-        combined_token_access_level(
+        request_access_level(
             &state,
+            &headers,
             "pad",
             &slug,
             resource_request_token(&headers, "pad", &slug, payload.access_token.as_deref()),
@@ -577,7 +591,7 @@ pub(super) async fn authorized_pad(
     let pad = db::find_pad(&state.db, slug)
         .await?
         .ok_or_else(ApiError::not_found_note)?;
-    let token_level = combined_token_access_level(state, "pad", slug, access_token, bearer).await?;
+    let token_level = request_access_level(state, headers, "pad", slug, access_token, bearer).await?;
     if pad.is_private != 0 && token_level == AccessLevel::None {
         return Err(ApiError::not_found_note());
     }