Merge remote-tracking branch 'mathium05/memberEditScrewUp'

2 files changed, 26 insertions, 7 deletions

diff --git a/src/api/routes/guilds/#guild_id/members/#member_id/index.ts b/src/api/routes/guilds/#guild_id/members/#member_id/index.ts

index 2ccece6b..3db964d2 100644
--- a/src/api/routes/guilds/#guild_id/members/#member_id/index.ts
+++ b/src/api/routes/guilds/#guild_id/members/#member_id/index.ts
@@ -96,7 +96,11 @@ router.patch(
         const permission = await getPermission(req.user_id, guild_id);
 
         if ("nick" in body) {
-            permission.hasThrow("MANAGE_NICKNAMES");
+            if (member_id != req.user_id) {
+                permission.hasThrow("MANAGE_NICKNAMES");
+            } else {
+                permission.hasThrow("CHANGE_NICKNAME");
+            }
 
             if (!body.nick) {
                 delete body.nick;
@@ -106,7 +110,7 @@ router.patch(
             }
         }
 
-        if (("bio" in body || "avatar" in body) && req.params.member_id != "@me") {
+        if (("bio" in body || "avatar" in body) && member_id != req.user_id) {
             const rights = await getRights(req.user_id);
             rights.hasThrow("MANAGE_USERS");
         }
diff --git a/src/api/routes/guilds/#guild_id/profile/index.ts b/src/api/routes/guilds/#guild_id/profile/index.ts

index 0e35aac1..74f40874 100644
--- a/src/api/routes/guilds/#guild_id/profile/index.ts
+++ b/src/api/routes/guilds/#guild_id/profile/index.ts
@@ -17,7 +17,7 @@
 */
 
 import { route } from "@spacebar/api";
-import { emitEvent, GuildMemberUpdateEvent, handleFile, Member, OrmUtils } from "@spacebar/util";
+import { emitEvent, getPermission, getRights, GuildMemberUpdateEvent, handleFile, Member, OrmUtils, Permissions } from "@spacebar/util";
 import { Request, Response, Router } from "express";
 import { MemberChangeProfileSchema } from "@spacebar/schemas";
 
@@ -41,16 +41,31 @@ router.patch(
     }),
     async (req: Request, res: Response) => {
         const { guild_id } = req.params as { [key: string]: string };
-        // const member_id =
-        // 	req.params.member_id === "@me" ? req.user_id : req.params.member_id;
+        let { member_id } = req.params as { [key: string]: string };
         const body = req.body as MemberChangeProfileSchema;
+        if (member_id === "@me") member_id = req.user_id;
+
+        const permission = await getPermission(req.user_id, guild_id);
+
+        if (req.user_id === member_id) {
+            if (body.nick) {
+                permission.hasThrow(Permissions.FLAGS.CHANGE_NICKNAME);
+            }
+        } else {
+            if (Object.keys(body).length !== 1 || !body.nick) {
+                const rights = await getRights(req.user_id);
+                rights.hasThrow("MANAGE_USERS");
+            } else {
+                permission.hasThrow(Permissions.FLAGS.MANAGE_NICKNAMES);
+            }
+        }
 
         let member = await Member.findOneOrFail({
-            where: { id: req.user_id, guild_id },
+            where: { id: member_id, guild_id },
             relations: { roles: true, user: true },
         });
 
-        if (body.banner) body.banner = await handleFile(`/guilds/${guild_id}/users/${req.user_id}/avatars`, body.banner as string);
+        if (body.banner) body.banner = await handleFile(`/guilds/${guild_id}/users/${member_id}/avatars`, body.banner as string);
 
         member = await OrmUtils.mergeDeep(member, body);