Allow verified role to be restricted per server based on api key perm…

…issions
vennekilde · Oct 6, 2024 · d86fae5 · d86fae5
1 parent 6443d31
commit d86fae5
Show file tree

Hide file tree

Showing 7 changed files with 285 additions and 98 deletions.
diff --git a/api/openapi.yaml b/api/openapi.yaml
@@ -609,6 +609,8 @@ components:
             bun: ",nullzero,notnull,default:current_timestamp"
         id:
           type: string
+          x-oapi-codegen-extra-tags:
+            bun: ",pk"
         name:
           type: string
         world:
@@ -653,6 +655,13 @@ components:
           type: boolean
           x-oapi-codegen-extra-tags:
             bun: '-'
+        api_keys:
+          type: array
+          items:
+            $ref: '#/components/schemas/TokenInfo'
+          x-go-type-skip-optional-pointer: true
+          x-oapi-codegen-extra-tags:
+            bun: rel:has-many,join:id=account_id
     PlatformLink:
       type: object
       required:
@@ -681,7 +690,42 @@ components:
           type: integer
           format: int64
           x-go-name: UserID
-
+    TokenInfo:
+      type: object
+      required:
+        - id
+        - name
+        - account_id
+        - permissions
+      properties:
+        db_created:
+          type: string
+          format: date-time
+          x-go-type-skip-optional-pointer: true
+          x-oapi-codegen-extra-tags:
+            bun: ",nullzero,notnull,default:current_timestamp,scanonly"
+        db_updated:
+          type: string
+          format: date-time
+          x-go-type-skip-optional-pointer: true
+          x-oapi-codegen-extra-tags:
+            bun: ",nullzero,notnull,default:current_timestamp"
+        last_success:
+          type: string
+          format: date-time
+          x-go-type-skip-optional-pointer: true
+        id:
+          type: string
+        name:
+          type: string
+        account_id:
+          type: string
+        permissions:
+          type: array
+          items:
+            type: string
+          x-go-type-skip-optional-pointer: true
+
     EphemeralAssociation:
       type: object
       properties:

diff --git a/internal/api/api.gen.go b/internal/api/api.gen.go
diff --git a/internal/backend/service.go b/internal/backend/service.go
@@ -15,15 +15,16 @@ import (
 const PlatformID = 2
 
 const (
-	SettingWvWWorld           = "wvw_world"
-	SettingPrimaryRole        = "wvw_primary_role"
-	SettingLinkedRole         = "wvw_linked_role"
-	SettingAssociatedRoles    = "wvw_associated_roles"
-	SettingAccRepEnabled      = "acc_rep_nick"
-	SettingGuildTagRepEnabled = "guild_tag_rep_nick"
-	SettingEnforceGuildRep    = "enforce_guild_rep"
-	SettingGuildCommonRole    = "verification_role"
-	SettingGuildVerifyRoles   = "guild_verify_roles"
+	SettingWvWWorld                 = "wvw_world"
+	SettingPrimaryRole              = "wvw_primary_role"
+	SettingLinkedRole               = "wvw_linked_role"
+	SettingAssociatedRoles          = "wvw_associated_roles"
+	SettingAccRepEnabled            = "acc_rep_nick"
+	SettingGuildTagRepEnabled       = "guild_tag_rep_nick"
+	SettingEnforceGuildRep          = "enforce_guild_rep"
+	SettingGuildCommonRole          = "verification_role"
+	SettingGuildVerifyRoles         = "guild_verify_roles"
+	SettingGuildRequiredPermissions = "guild_required_permissions"
 )
 
 type Service struct {

diff --git a/internal/guild/guilds.go b/internal/guild/guilds.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"regexp"
 	"slices"
+	"strings"
 	"time"
 
 	"github.com/MrGunflame/gw2api"
@@ -156,7 +157,10 @@ func (g *GuildRoleHandler) CheckRoles(guildID string, member *discordgo.Member,
 					favoredGuildRoleID = role.ID
 				}
 				if len(verifiedRoles) == 0 || slices.Contains(verifiedRoles, role.ID) {
-					isVerified = true
+					// Ensure they are allowed to be verified
+					if g.CanHaveGuildVerifiedRole(guildID, account.ApiKeys) {
+						isVerified = true
+					}
 				}
 			}
 		}
@@ -242,16 +246,33 @@ nextRole:
 	}
 }
 
-func (g *GuildRoleHandler) AddVerificationRole(guildID string, userID string) error {
-	verificationRole := g.service.GetSetting(guildID, backend.SettingGuildCommonRole)
-	if verificationRole != "" {
-		err := g.discord.GuildMemberRoleAdd(guildID, userID, verificationRole)
-		if err != nil {
-			return err
+// CanHaveGuildVerifiedRole check if the user has the required API Key permissions to have the guild verification role on this server
+func (g *GuildRoleHandler) CanHaveGuildVerifiedRole(guildID string, apiKeys []api.TokenInfo) bool {
+	requiredPermissions := g.service.GetSettingSlice(guildID, backend.SettingGuildRequiredPermissions)
+	if len(requiredPermissions) == 0 {
+		return true
+	}
+
+	apiPermissions := make(map[string]struct{})
+	for _, apiKey := range apiKeys {
+		for _, permission := range apiKey.Permissions {
+			permission := strings.Split(permission, ",")
+			for _, p := range permission {
+				apiPermissions[p] = struct{}{}
+			}
 		}
 	}
 
-	return nil
+outer:
+	for _, requiredPermission := range requiredPermissions {
+		for permission := range apiPermissions {
+			if permission == requiredPermission {
+				continue outer
+			}
+		}
+		return false
+	}
+	return true
 }
 
 func (g *GuildRoleHandler) SetGuildRole(guildID string, userID string, roleID string) error {

diff --git a/internal/interaction/interaction_cmd_rep.go b/internal/interaction/interaction_cmd_rep.go
@@ -195,11 +195,6 @@ func (c *RepCmd) handleRepFromStatus(s *discordgo.Session, event *discordgo.Inte
 			}
 		}
 	} else {
-		err := c.guildRoleHandler.AddVerificationRole(event.GuildID, user.ID)
-		if err != nil {
-			onError(s, event, err)
-		}
-
 		_, err = s.FollowupMessageCreate(event.Interaction, false, &discordgo.WebhookParams{
 			Content: "Pick guild to represent",
 			Flags:   discordgo.MessageFlagsEphemeral,