feat: [torrust#615] authorization layer implemented for the get torre…

…nts handler
mario-nt · Aug 3, 2024 · 1342dce · 1342dce
1 parent f264e75
commit 1342dce
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 3 deletions.
diff --git a/src/services/authorization.rs b/src/services/authorization.rs
@@ -48,6 +48,7 @@ pub enum ACTION {
     GetTorrent,
     AddTorrent,
     GetCanonicalInfoHash,
+    GenerateTorrentInfoListing,
 }
 
 pub struct Service {
@@ -190,20 +191,23 @@ impl CasbinConfiguration {
                 admin, GetTorrent
                 admin, AddTorrent
                 admin, GetCanonicalInfoHash
+                admin, GenerateTorrentInfoListing
                 registered, GetCategories
                 registered, GetImageByUrl
                 registered, GetPublicSettings
                 registered, GetTags
                 registered, GetTorrent
                 registered, AddTorrent
                 registered, GetCanonicalInfoHash
+                registered, GenerateTorrentInfoListing
                 guest, GetCategories
                 guest, GetTags
                 guest, GetAboutPage
                 guest, GetLicensePage
                 guest, GetPublicSettings
                 guest, GetTorrent
                 guest, GetCanonicalInfoHash
+                guest, GenerateTorrentInfoListing
                 ",
             ),
         }

diff --git a/src/services/torrent.rs b/src/services/torrent.rs
@@ -347,7 +347,15 @@ impl Index {
     /// # Errors
     ///
     /// Returns a `ServiceError::DatabaseError` if the database query fails.
-    pub async fn generate_torrent_info_listing(&self, request: &ListingRequest) -> Result<TorrentsResponse, ServiceError> {
+    pub async fn generate_torrent_info_listing(
+        &self,
+        request: &ListingRequest,
+        opt_user_id: Option<UserId>,
+    ) -> Result<TorrentsResponse, ServiceError> {
+        self.authorization_service
+            .authorize(ACTION::GenerateTorrentInfoListing, opt_user_id)
+            .await?;
+
         let torrent_listing_specification = self.listing_specification_from_user_request(request).await;
 
         let torrents_response = self

diff --git a/src/web/api/server/v1/contexts/torrent/handlers.rs b/src/web/api/server/v1/contexts/torrent/handlers.rs
@@ -131,8 +131,16 @@ async fn redirect_to_download_url_using_canonical_info_hash_if_needed(
 ///
 /// It returns an error if the database query fails.
 #[allow(clippy::unused_async)]
-pub async fn get_torrents_handler(State(app_data): State<Arc<AppData>>, Query(criteria): Query<ListingRequest>) -> Response {
-    match app_data.torrent_service.generate_torrent_info_listing(&criteria).await {
+pub async fn get_torrents_handler(
+    State(app_data): State<Arc<AppData>>,
+    Query(criteria): Query<ListingRequest>,
+    ExtractOptionalLoggedInUser(opt_user_id): ExtractOptionalLoggedInUser,
+) -> Response {
+    match app_data
+        .torrent_service
+        .generate_torrent_info_listing(&criteria, opt_user_id)
+        .await
+    {
         Ok(torrents_response) => Json(OkResponseData { data: torrents_response }).into_response(),
         Err(error) => error.into_response(),
     }