new finctions and fixes

src/api/files.rs

@@ -16,7 +16,6 @@ pub async fn upload_pad_file(
     Path(slug): Path<String>,
     mut multipart: Multipart,
 ) -> Result<Json<serde_json::Value>, ApiError> {
-    require_authenticated_upload(&state, &headers).await?;
     let mut password: Option<String> = None;
     let mut access_token: Option<String> = None;
     let mut file: Option<(String, Vec<u8>)> = None;
@@ -61,6 +60,14 @@ pub async fn upload_pad_file(
         &headers,
     )
     .await?;
+    require_upload_permission(
+        &state,
+        &headers,
+        "pad",
+        &slug,
+        resource_request_token(&headers, "pad", &slug, access_token.as_deref()),
+    )
+    .await?;
     let level = if db::verify_pad_password(&pad, password.as_deref())
         || (pad.is_private == 0 && pad.password_hash.is_none())
     {
@@ -205,7 +212,6 @@ pub async fn upload_note_file(
     Path((workspace_slug, note_slug)): Path<(String, String)>,
     mut multipart: Multipart,
 ) -> Result<Json<serde_json::Value>, ApiError> {
-    require_authenticated_upload(&state, &headers).await?;
     let mut password: Option<String> = None;
     let mut access_token: Option<String> = None;
     let mut file: Option<(String, Vec<u8>)> = None;
@@ -252,6 +258,20 @@ pub async fn upload_note_file(
     )
     .await?;
 
+    require_upload_permission(
+        &state,
+        &headers,
+        "workspace",
+        &workspace_slug,
+        resource_request_token(
+            &headers,
+            "workspace",
+            &workspace_slug,
+            access_token.as_deref(),
+        ),
+    )
+    .await?;
+
     let level = if db::verify_workspace_password(&workspace, password.as_deref())
         || (workspace.is_private == 0 && workspace.password_hash.is_none())
     {
@@ -438,17 +458,33 @@ pub async fn delete_note_file(
     Ok(Json(serde_json::json!({"ok": true})))
 }
 
-async fn require_authenticated_upload(
+async fn require_upload_permission(
     state: &SharedState,
     headers: &HeaderMap,
+    kind: &str,
+    slug: &str,
+    resource_token: Option<&str>,
 ) -> Result<(), ApiError> {
+    let permission = crate::auth::share_link_permission(state, kind, slug, resource_token)
+        .await
+        .map_err(|error| ApiError::forbidden(&error.message))?;
+    if permission.as_deref() == Some("rw") {
+        return Ok(());
+    }
+
     let user = crate::auth::optional_user(state, headers)
         .await
         .map_err(|error| ApiError::forbidden(&error.message))?;
-    if user.is_none() {
-        return Err(ApiError::forbidden("Log in to upload files."));
+    if user.is_some() {
+        return Ok(());
+    }
+
+    match permission.as_deref() {
+        Some("ro") => Err(ApiError::forbidden("Read-only access.")),
+        _ => Err(ApiError::forbidden(
+            "Log in or use a read-write share link to upload files.",
+        )),
     }
-    Ok(())
 }
 
 pub async fn download_file(