]> Untitled Git - lemmy.git/blob - crates/api/src/site/resolve_object.rs
Check user accepted before sending jwt in password reset (fixes #2591) (#2597)
[lemmy.git] / crates / api / src / site / resolve_object.rs
1 use crate::Perform;
2 use actix_web::web::Data;
3 use diesel::NotFound;
4 use lemmy_api_common::{
5   site::{ResolveObject, ResolveObjectResponse},
6   utils::{check_private_instance, get_local_user_view_from_jwt_opt},
7 };
8 use lemmy_apub::fetcher::search::{search_query_to_object_id, SearchableObjects};
9 use lemmy_db_schema::{newtypes::PersonId, source::local_site::LocalSite, utils::DbPool};
10 use lemmy_db_views::structs::{CommentView, PostView};
11 use lemmy_db_views_actor::structs::{CommunityView, PersonViewSafe};
12 use lemmy_utils::{error::LemmyError, ConnectionId};
13 use lemmy_websocket::LemmyContext;
14
15 #[async_trait::async_trait(?Send)]
16 impl Perform for ResolveObject {
17   type Response = ResolveObjectResponse;
18
19   #[tracing::instrument(skip(context, _websocket_id))]
20   async fn perform(
21     &self,
22     context: &Data<LemmyContext>,
23     _websocket_id: Option<ConnectionId>,
24   ) -> Result<ResolveObjectResponse, LemmyError> {
25     let local_user_view =
26       get_local_user_view_from_jwt_opt(self.auth.as_ref(), context.pool(), context.secret())
27         .await?;
28     let local_site = LocalSite::read(context.pool()).await?;
29     check_private_instance(&local_user_view, &local_site)?;
30
31     let res = search_query_to_object_id(&self.q, local_user_view.is_none(), context)
32       .await
33       .map_err(|e| e.with_message("couldnt_find_object"))?;
34     convert_response(res, local_user_view.map(|l| l.person.id), context.pool())
35       .await
36       .map_err(|e| e.with_message("couldnt_find_object"))
37   }
38 }
39
40 async fn convert_response(
41   object: SearchableObjects,
42   user_id: Option<PersonId>,
43   pool: &DbPool,
44 ) -> Result<ResolveObjectResponse, LemmyError> {
45   use SearchableObjects::*;
46   let removed_or_deleted;
47   let mut res = ResolveObjectResponse {
48     comment: None,
49     post: None,
50     community: None,
51     person: None,
52   };
53   match object {
54     Person(p) => {
55       removed_or_deleted = p.deleted;
56       res.person = Some(PersonViewSafe::read(pool, p.id).await?)
57     }
58     Community(c) => {
59       removed_or_deleted = c.deleted || c.removed;
60       res.community = Some(CommunityView::read(pool, c.id, user_id).await?)
61     }
62     Post(p) => {
63       removed_or_deleted = p.deleted || p.removed;
64       res.post = Some(PostView::read(pool, p.id, user_id).await?)
65     }
66     Comment(c) => {
67       removed_or_deleted = c.deleted || c.removed;
68       res.comment = Some(CommentView::read(pool, c.id, user_id).await?)
69     }
70   };
71   // if the object was deleted from database, dont return it
72   if removed_or_deleted {
73     return Err(NotFound {}.into());
74   }
75   Ok(res)
76 }