From 1073fd4d72e414b50e4adaabc95e35a979ef5640 Mon Sep 17 00:00:00 2001 From: EETagent Date: Sat, 5 Nov 2022 17:43:13 +0100 Subject: [PATCH] fix: fix admin guard to really check for admin role --- api/src/guards/request/auth/admin.rs | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/api/src/guards/request/auth/admin.rs b/api/src/guards/request/auth/admin.rs index b22a145..7933258 100644 --- a/api/src/guards/request/auth/admin.rs +++ b/api/src/guards/request/auth/admin.rs @@ -30,7 +30,13 @@ impl<'r> FromRequest<'r> for AdminAuth { let session = AdminService::auth(conn, uuid).await; match session { - Ok(model) => Outcome::Success(AdminAuth(model)), + Ok(model) => { + if model.is_admin { + Outcome::Success(AdminAuth(model)) + } else { + Outcome::Failure((Status::Forbidden, None)) + } + }, Err(e) => Outcome::Failure( (Status::from_code(e.code()).unwrap_or(Status::InternalServerError), None) ),