Enforce that a given applications emoji set can only be modified by the application itself, or its owner

4 files changed, 22 insertions, 1 deletions

diff --git a/assets/openapi.json b/assets/openapi.json

index 8be85c7b..2a928a2b 100644
--- a/assets/openapi.json
+++ b/assets/openapi.json
@@ -11137,6 +11137,9 @@
                     "owner": {
                         "$ref": "#/components/schemas/User"
                     },
+                    "owner_id": {
+                        "type": "string"
+                    },
                     "flags": {
                         "type": "integer",
                         "default": 0
@@ -11250,6 +11253,7 @@
                     "integration_require_code_grant",
                     "name",
                     "owner",
+                    "owner_id",
                     "redirect_uris",
                     "rpc_application_state",
                     "store_application_state",
diff --git a/assets/schemas.json b/assets/schemas.json

index 3b82e382..b72d9cc1 100644
--- a/assets/schemas.json
+++ b/assets/schemas.json
@@ -11836,6 +11836,9 @@
             "owner": {
                 "$ref": "#/definitions/User"
             },
+            "owner_id": {
+                "type": "string"
+            },
             "flags": {
                 "type": "integer",
                 "default": 0
@@ -11950,6 +11953,7 @@
             "integration_require_code_grant",
             "name",
             "owner",
+            "owner_id",
             "redirect_uris",
             "rpc_application_state",
             "store_application_state",
diff --git a/src/api/routes/applications/#application_id/emojis.ts b/src/api/routes/applications/#application_id/emojis.ts

index d7973fca..7e66afb6 100644
--- a/src/api/routes/applications/#application_id/emojis.ts
+++ b/src/api/routes/applications/#application_id/emojis.ts
@@ -18,7 +18,7 @@
 
 import { Request, Response, Router } from "express";
 import { route } from "@spacebar/api/util/handlers/route";
-import { Emoji } from "@spacebar/database";
+import { Emoji, Application } from "@spacebar/database";
 import { Config, DiscordApiErrors, Snowflake, handleFile } from "@spacebar/util";
 import { ApplicationEmojiModifySchema, EmojiCreateSchema } from "@spacebar/schemas";
 
@@ -97,6 +97,9 @@ router.post(
         const { application_id } = req.params as { [key: string]: string };
         const body = req.body as EmojiCreateSchema;
 
+        const app = await Application.findOne({ where: { id: application_id } });
+        if (req.user_id != app?.id && req.user_id != app?.owner_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;
+
         const id = Snowflake.generate();
         const emoji_count = await Emoji.count({
             where: { application_id: application_id },
@@ -144,6 +147,9 @@ router.patch(
         const { emoji_id, application_id } = req.params as { [key: string]: string };
         const body = req.body as ApplicationEmojiModifySchema;
 
+        const app = await Application.findOne({ where: { id: application_id } });
+        if (req.user_id != app?.id && req.user_id != app?.owner_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;
+
         if (body.name?.includes("-")) body.name = body.name?.replaceAll("-", ""); // Dashes are invalid apparently
 
         await Emoji.findOneOrFail({
@@ -173,6 +179,9 @@ router.delete(
     async (req: Request, res: Response) => {
         const { emoji_id, application_id } = req.params as { [key: string]: string };
 
+        const app = await Application.findOne({ where: { id: application_id } });
+        if (req.user_id != app?.id && req.user_id != app?.owner_id) throw DiscordApiErrors.ACTION_NOT_AUTHORIZED_ON_APPLICATION;
+
         await Emoji.delete({
             id: emoji_id,
             application_id: application_id,
diff --git a/src/database/entities/Application.ts b/src/database/entities/Application.ts

index 1fcb9e07..dc2b6111 100644
--- a/src/database/entities/Application.ts
+++ b/src/database/entities/Application.ts
@@ -58,6 +58,10 @@ export class Application extends BaseClass {
     @ManyToOne(() => User, { onDelete: "CASCADE" })
     owner: User;
 
+    @Column({ type: "int8" })
+    @RelationId((application: Application) => application.owner)
+    owner_id: string;
+
     // TODO: enum this? https://discord.com/developers/docs/resources/application#application-object-application-flags
     @Column()
     flags: number = 0;