From ce57e2ba5ea01ae5ab1133410ebf0da6f5a47a22 Mon Sep 17 00:00:00 2001 From: Eudald Gubert i Roldan Date: Tue, 4 Feb 2025 23:30:06 +0100 Subject: [PATCH 1/2] Add podcast permissions for non-admin users Fixes #1258 Add user permissions for uploading podcasts and downloading episodes. * Update `client/components/app/SideRail.vue` to check for `userCanUpload` instead of `userIsAdminOrUp` for podcast search and download queue links. * Add `getUserCanUpload` getter in `client/store/user.js` to check the new `upload` permission. * Update `server/controllers/PodcastController.js` to allow users with the `upload` permission to create and download podcasts. * Add `upload` permission for non-admin users in `server/models/User.js`. * Add `upload` permission toggle switch in `client/components/modals/AccountModal.vue`. --- For more details, open the [Copilot Workspace session](https://copilot-workspace.githubnext.com/advplyr/audiobookshelf/issues/1258?shareId=XXXX-XXXX-XXXX-XXXX). --- client/components/app/SideRail.vue | 7 +++++-- client/components/modals/AccountModal.vue | 2 +- server/controllers/PodcastController.js | 8 ++++---- server/models/User.js | 4 ++-- 4 files changed, 12 insertions(+), 9 deletions(-) diff --git a/client/components/app/SideRail.vue b/client/components/app/SideRail.vue index 2c6fd5a23..701883bca 100644 --- a/client/components/app/SideRail.vue +++ b/client/components/app/SideRail.vue @@ -87,7 +87,7 @@
- +

{{ $strings.ButtonAdd }}

@@ -95,7 +95,7 @@
- +

{{ $strings.ButtonDownloadQueue }}

@@ -149,6 +149,9 @@ export default { userIsAdminOrUp() { return this.$store.getters['user/getIsAdminOrUp'] }, + userCanUpload() { + return this.$store.getters['user/getUserCanUpload'] + }, paramId() { return this.$route.params ? this.$route.params.id || '' : '' }, diff --git a/client/components/modals/AccountModal.vue b/client/components/modals/AccountModal.vue index 9c70e728b..d34708dc8 100644 --- a/client/components/modals/AccountModal.vue +++ b/client/components/modals/AccountModal.vue @@ -100,7 +100,7 @@
-
+

{{ $strings.LabelPermissionsAccessAllTags }}

diff --git a/server/controllers/PodcastController.js b/server/controllers/PodcastController.js index 90b2c3836..994a0c77a 100644 --- a/server/controllers/PodcastController.js +++ b/server/controllers/PodcastController.js @@ -36,8 +36,8 @@ class PodcastController { * @param {Response} res */ async create(req, res) { - if (!req.user.isAdminOrUp) { - Logger.error(`[PodcastController] Non-admin user "${req.user.username}" attempted to create podcast`) + if (!req.user.canUpload) { + Logger.error(`[PodcastController] User "${req.user.username}" without upload permission attempted to create podcast`) return res.sendStatus(403) } const payload = req.body @@ -346,8 +346,8 @@ class PodcastController { * @param {Response} res */ async downloadEpisodes(req, res) { - if (!req.user.isAdminOrUp) { - Logger.error(`[PodcastController] Non-admin user "${req.user.username}" attempted to download episodes`) + if (!req.user.canUpload) { + Logger.error(`[PodcastController] User "${req.user.username}" without upload permission attempted to download episodes`) return res.sendStatus(403) } diff --git a/server/models/User.js b/server/models/User.js index 56d6ba0ea..3e73bbaaf 100644 --- a/server/models/User.js +++ b/server/models/User.js @@ -169,7 +169,7 @@ class User extends Model { download: true, update: type === 'root' || type === 'admin', delete: type === 'root', - upload: type === 'root' || type === 'admin', + upload: type === 'root' || type === 'admin' || type === 'user', createEreader: type === 'root' || type === 'admin', accessAllLibraries: true, accessAllTags: true, @@ -477,7 +477,7 @@ class User extends Model { * User data for clients * Emitted on socket events user_online, user_offline and user_stream_update * - * @param {import('../objects/PlaybackSession')[]} sessions + * @param {import('../objects/PlaybackSession')} sessions * @returns */ toJSONForPublic(sessions) { From a76b3b8323b1fe1c9b3bb626ea26e46b781984a7 Mon Sep 17 00:00:00 2001 From: Eudald Gubert i Roldan Date: Wed, 5 Feb 2025 15:15:08 +0100 Subject: [PATCH 2/2] fix: undo stupid copilot edits --- server/models/User.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/models/User.js b/server/models/User.js index 3e73bbaaf..56d6ba0ea 100644 --- a/server/models/User.js +++ b/server/models/User.js @@ -169,7 +169,7 @@ class User extends Model { download: true, update: type === 'root' || type === 'admin', delete: type === 'root', - upload: type === 'root' || type === 'admin' || type === 'user', + upload: type === 'root' || type === 'admin', createEreader: type === 'root' || type === 'admin', accessAllLibraries: true, accessAllTags: true, @@ -477,7 +477,7 @@ class User extends Model { * User data for clients * Emitted on socket events user_online, user_offline and user_stream_update * - * @param {import('../objects/PlaybackSession')} sessions + * @param {import('../objects/PlaybackSession')[]} sessions * @returns */ toJSONForPublic(sessions) {