From 95e43ac88a322251a5e5a7d529b7b20a511978fd Mon Sep 17 00:00:00 2001
From: metamuffin <metamuffin@disroot.org>
Date: Wed, 4 Oct 2023 23:32:24 +0200
Subject: more permissions

---
 server/src/routes/stream.rs | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

(limited to 'server/src')

diff --git a/server/src/routes/stream.rs b/server/src/routes/stream.rs
index b1248ba..0569903 100644
--- a/server/src/routes/stream.rs
+++ b/server/src/routes/stream.rs
@@ -6,8 +6,11 @@
 use super::ui::{account::session::Session, error::MyError};
 use crate::{database::Database, federation::Federation};
 use anyhow::{anyhow, Result};
-use jellybase::{permission::NodePermissionExt, CONF};
-use jellycommon::{stream::StreamSpec, MediaSource};
+use jellybase::{
+    permission::{NodePermissionExt, PermissionSetExt},
+    CONF,
+};
+use jellycommon::{stream::StreamSpec, user::UserPermission, MediaSource};
 use log::{info, warn};
 use rocket::{
     get, head,
@@ -55,6 +58,11 @@ pub async fn r_stream(
         .ok_or(anyhow!("item does not contain media"))?;
 
     if let MediaSource::Remote { host, remote_id } = source {
+        session
+            .user
+            .permissions
+            .assert(&UserPermission::FederatedContent)?;
+
         let (username, password, _) = CONF
             .remote_credentials
             .get(host)
@@ -91,7 +99,7 @@ pub async fn r_stream(
 
     let head = jellystream::stream_head(&spec);
 
-    match jellystream::stream(node, spec, urange).await {
+    match jellystream::stream(node, spec, urange, &session.user.permissions).await {
         Ok(stream) => Ok(Either::Left(StreamResponse {
             stream,
             range,
-- 
cgit v1.2.3-70-g09d2