ocelot-Social-Community/Ocelot-Social
1
0
Fork 0
mirror of https://github.com/Ocelot-Social-Community/Ocelot-Social.git synced 2026-01-20 20:01:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

permissions for pinGroupPost

Browse Source
This commit is contained in:
Ulf Gebhardt 2026-01-17 15:30:13 +01:00
parent 51dbdfa113
commit aa35ab42f2
Signed by: ulfgebhardt
GPG Key ID: DA6B843E748679C9
1 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
backend/src/middleware/permissionsMiddleware.ts
View File

@ -397,6 +397,26 @@ const isAllowedToGenerateGroupInviteCode = rule({
).records[0].get('count')
})
const isAllowedToPinGroupPost = rule({
cache: 'no_cache',
})(async (_parent, args, context: Context) => {
if (!context.user) return false
return (
(
await context.database.query({
query: `
MATCH (post:Post{id: $args.id})-[:IN]->(group:Group)
MATCH (user:User{id: $user.id})-[membership:MEMBER_OF]->(group)
WHERE (membership.role IN ['admin', 'owner'])
RETURN toString(count(group)) as count
`,
variables: { user: context.user, args },
})
).records[0].get('count') === '1'
)
})
// Permissions
export default shield(
{
@ -485,8 +505,8 @@ export default shield(
VerifyEmailAddress: isAuthenticated,
pinPost: isAdmin,
unpinPost: isAdmin,
pinGroupPost: isAuthenticated, // TODO: permissions
unpinGroupPost: isAuthenticated, // TODO: permissions
pinGroupPost: isAllowedToPinGroupPost,
unpinGroupPost: isAllowedToPinGroupPost,
pushPost: isAdmin,
unpushPost: isAdmin,
UpdateDonations: isAdmin,