From eb07c5c9560ebf3628019c169f722182e4d7f80e Mon Sep 17 00:00:00 2001 From: Rory& Date: Mon, 24 Nov 2025 20:24:17 +0100 Subject: Admin API: Check rights, require OPERATOR --- .../Spacebar.AdminAPI/Controllers/Media/UserMediaController.cs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'extra/admin-api/Spacebar.AdminAPI/Controllers/Media/UserMediaController.cs') diff --git a/extra/admin-api/Spacebar.AdminAPI/Controllers/Media/UserMediaController.cs b/extra/admin-api/Spacebar.AdminAPI/Controllers/Media/UserMediaController.cs index a06d110bb..a4d915e5a 100644 --- a/extra/admin-api/Spacebar.AdminAPI/Controllers/Media/UserMediaController.cs +++ b/extra/admin-api/Spacebar.AdminAPI/Controllers/Media/UserMediaController.cs @@ -1,6 +1,8 @@ using Microsoft.AspNetCore.Mvc; using Microsoft.EntityFrameworkCore; +using Spacebar.AdminAPI.Extensions; using Spacebar.AdminApi.Models; +using Spacebar.AdminAPI.Services; using Spacebar.Db.Contexts; using Spacebar.Db.Models; using Spacebar.RabbitMqUtilities; @@ -9,10 +11,11 @@ namespace Spacebar.AdminAPI.Controllers.Media; [ApiController] [Route("/media/user")] -public class UserMediaController(ILogger logger, SpacebarDbContext db, RabbitMQService mq, IServiceProvider sp) : ControllerBase { - +public class UserMediaController(ILogger logger, SpacebarDbContext db, RabbitMQService mq, AuthenticationService auth, IServiceProvider sp) : ControllerBase { [HttpGet("{userId}/attachments")] public async IAsyncEnumerable GetAttachmentsByUser(string userId) { + (await auth.GetCurrentUser(Request)).GetRights().AssertHasAllRights(SpacebarRights.Rights.OPERATOR); + var db2 = sp.CreateScope().ServiceProvider.GetService(); var attachments = db.Attachments // .IgnoreAutoIncludes() -- cgit 1.5.1