From 347274afb36e926b328e799ca8004fc874ffe4cb Mon Sep 17 00:00:00 2001
From: metamuffin <metamuffin@disroot.org>
Date: Wed, 4 Oct 2023 20:41:59 +0200
Subject: more permission stuff

---
 server/src/routes/stream.rs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'server/src/routes/stream.rs')

diff --git a/server/src/routes/stream.rs b/server/src/routes/stream.rs
index 21575b6..b1248ba 100644
--- a/server/src/routes/stream.rs
+++ b/server/src/routes/stream.rs
@@ -6,7 +6,7 @@
 use super::ui::{account::session::Session, error::MyError};
 use crate::{database::Database, federation::Federation};
 use anyhow::{anyhow, Result};
-use jellybase::CONF;
+use jellybase::{permission::NodePermissionExt, CONF};
 use jellycommon::{stream::StreamSpec, MediaSource};
 use log::{info, warn};
 use rocket::{
@@ -36,7 +36,7 @@ pub async fn r_stream_head(
 
 #[get("/n/<id>/stream?<spec..>")]
 pub async fn r_stream(
-    _sess: Session,
+    session: Session,
     federation: &State<Federation>,
     db: &State<Database>,
     id: &str,
@@ -46,6 +46,7 @@ pub async fn r_stream(
     let node = db
         .node
         .get(&id.to_string())?
+        .only_if_permitted(&session.user.permissions)
         .ok_or(anyhow!("node does not exist"))?;
     let source = node
         .private
-- 
cgit v1.2.3-70-g09d2