diff --git a/cmd/api/server.go b/cmd/api/server.go index efc42ee..49942b9 100644 --- a/cmd/api/server.go +++ b/cmd/api/server.go @@ -207,7 +207,7 @@ func initializeRoutes(engine *gin.Engine) { // Ranking Queue engine.GET("/v2/ranking/config", handlers.CreateHandler(handlers.GetRankingQueueConfig)) engine.GET("/v2/ranking/queue/mode/:mode", handlers.CreateHandler(handlers.GetRankingQueue)) - engine.GET("/v2/ranking/queue/supervisors/actions", handlers.CreateHandler(handlers.GetRankingSupervisorActions)) + engine.GET("/v2/ranking/queue/supervisors/actions", middleware.RequireAuth, handlers.CreateHandler(handlers.GetRankingSupervisorActions)) engine.POST("/v2/ranking/queue/:id/submit", middleware.RequireAuth, handlers.CreateHandler(handlers.SubmitMapsetToRankingQueue)) engine.POST("/v2/ranking/queue/:id/remove", middleware.RequireAuth, handlers.CreateHandler(handlers.RemoveFromRankingQueue)) engine.GET("/v2/ranking/queue/:id/comments", handlers.CreateHandler(handlers.GetRankingQueueComments)) diff --git a/handlers/handlers.go b/handlers/handlers.go index 4b3d749..89246e3 100644 --- a/handlers/handlers.go +++ b/handlers/handlers.go @@ -101,3 +101,18 @@ func canUserAccessAdminRoute(c *gin.Context) bool { enums.HasUserGroup(user.UserGroups, enums.UserGroupAdmin) || enums.HasUserGroup(user.UserGroups, enums.UserGroupBot) } + +// Returns if a user can access private ranking supervisor endpoints +func canUserAccessSupervisorRoute(c *gin.Context) bool { + user := getAuthedUser(c) + + if user == nil { + return false + } + + return enums.HasUserGroup(user.UserGroups, enums.UserGroupSwan) || + enums.HasUserGroup(user.UserGroups, enums.UserGroupDeveloper) || + enums.HasUserGroup(user.UserGroups, enums.UserGroupAdmin) || + enums.HasUserGroup(user.UserGroups, enums.UserGroupBot) || + enums.HasUserGroup(user.UserGroups, enums.UserGroupRankingSupervisor) +} diff --git a/handlers/ranking_supervisors.go b/handlers/ranking_supervisors.go index c0bf592..f344a05 100644 --- a/handlers/ranking_supervisors.go +++ b/handlers/ranking_supervisors.go @@ -9,6 +9,16 @@ import ( // GetRankingSupervisorActions Retrieves ranking supervisor actions between a given time frame // Endpoint: GET /ranking/queue/supervisors/actions?start=&end= func GetRankingSupervisorActions(c *gin.Context) *APIError { + user := getAuthedUser(c) + + if user == nil { + return nil + } + + if !canUserAccessSupervisorRoute(c) { + return APIErrorForbidden("You do not have permission to access this endpoint.") + } + body := struct { Start int64 `form:"start" json:"start"` End int64 `form:"end" json:"end"`