Admin API: Check rights, require OPERATOR

1 files changed, 5 insertions, 2 deletions

diff --git a/extra/admin-api/Spacebar.AdminAPI/Controllers/Media/UserMediaController.cs b/extra/admin-api/Spacebar.AdminAPI/Controllers/Media/UserMediaController.cs

index a06d110bb..a4d915e5a 100644
--- a/extra/admin-api/Spacebar.AdminAPI/Controllers/Media/UserMediaController.cs
+++ b/extra/admin-api/Spacebar.AdminAPI/Controllers/Media/UserMediaController.cs
@@ -1,6 +1,8 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
+using Spacebar.AdminAPI.Extensions;
 using Spacebar.AdminApi.Models;
+using Spacebar.AdminAPI.Services;
 using Spacebar.Db.Contexts;
 using Spacebar.Db.Models;
 using Spacebar.RabbitMqUtilities;
@@ -9,10 +11,11 @@ namespace Spacebar.AdminAPI.Controllers.Media;
 
 [ApiController]
 [Route("/media/user")]
-public class UserMediaController(ILogger<UserMediaController> logger, SpacebarDbContext db, RabbitMQService mq, IServiceProvider sp) : ControllerBase {
-
+public class UserMediaController(ILogger<UserMediaController> logger, SpacebarDbContext db, RabbitMQService mq, AuthenticationService auth, IServiceProvider sp) : ControllerBase {
     [HttpGet("{userId}/attachments")]
     public async IAsyncEnumerable<Attachment> GetAttachmentsByUser(string userId) {
+        (await auth.GetCurrentUser(Request)).GetRights().AssertHasAllRights(SpacebarRights.Rights.OPERATOR);
+        
         var db2 = sp.CreateScope().ServiceProvider.GetService<SpacebarDbContext>();
         var attachments = db.Attachments
             // .IgnoreAutoIncludes()