From 65daeb0247b49e1f7dd85ed28543041c242d31ca Mon Sep 17 00:00:00 2001
From: Zutatensuppe <oo.para@gmail.com>
Date: Sun, 11 Jul 2021 18:44:59 +0200
Subject: [PATCH] only let uploader edit image

---
 src/common/Types.ts                     |  1 +
 src/dbpatches/03_users.sqlite           | 45 +++++++++++++++++++++++++
 src/frontend/components/ImageTeaser.vue | 10 ++++--
 src/frontend/main.ts                    |  8 +++--
 src/frontend/views/NewGame.vue          | 10 ++++--
 src/server/Images.ts                    |  3 ++
 src/server/main.ts                      | 45 +++++++++++++++++++++++++
 7 files changed, 115 insertions(+), 7 deletions(-)
 create mode 100644 src/dbpatches/03_users.sqlite

diff --git a/src/common/Types.ts b/src/common/Types.ts
index 71840bf..acf0d7b 100644
--- a/src/common/Types.ts
+++ b/src/common/Types.ts
@@ -155,6 +155,7 @@ export interface PieceChange {
 export interface ImageInfo
 {
   id: number
+  uploaderUserId: number|null
   filename: string
   url: string
   title: string
diff --git a/src/dbpatches/03_users.sqlite b/src/dbpatches/03_users.sqlite
new file mode 100644
index 0000000..c71908f
--- /dev/null
+++ b/src/dbpatches/03_users.sqlite
@@ -0,0 +1,45 @@
+CREATE TABLE users (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+
+  created TIMESTAMP NOT NULL,
+
+  client_id TEXT NOT NULL,
+  client_secret TEXT NOT NULL
+);
+
+CREATE TABLE images_new (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  uploader_user_id INTEGER,
+
+  created TIMESTAMP NOT NULL,
+
+  filename TEXT NOT NULL UNIQUE,
+  filename_original TEXT NOT NULL,
+  title TEXT NOT NULL,
+
+  width INTEGER NOT NULL,
+  height INTEGER NOT NULL
+);
+
+CREATE TABLE image_x_category_new (
+  image_id INTEGER NOT NULL,
+  category_id INTEGER NOT NULL
+);
+
+INSERT INTO images_new
+SELECT id, NULL, created, filename, filename_original, title, width, height
+FROM images;
+
+INSERT INTO image_x_category_new
+SELECT image_id, category_id
+FROM image_x_category;
+
+PRAGMA foreign_keys = OFF;
+
+DROP TABLE images;
+DROP TABLE image_x_category;
+
+ALTER TABLE images_new RENAME TO images;
+ALTER TABLE image_x_category_new RENAME TO image_x_category;
+
+PRAGMA foreign_keys = ON;
diff --git a/src/frontend/components/ImageTeaser.vue b/src/frontend/components/ImageTeaser.vue
index 770de91..a5fd78d 100644
--- a/src/frontend/components/ImageTeaser.vue
+++ b/src/frontend/components/ImageTeaser.vue
@@ -3,7 +3,7 @@
     class="imageteaser"
     :style="style"
     @click="onClick">
-    <div class="btn edit" @click.stop="onEditClick">✏️</div>
+    <div class="btn edit" v-if="canEdit" @click.stop="onEditClick">✏️</div>
   </div>
 </template>
 <script lang="ts">
@@ -18,12 +18,18 @@ export default defineComponent({
     },
   },
   computed: {
-    style (): object {
+    style(): object {
       const url = this.image.url.replace('uploads/', 'uploads/r/') + '-150x100.webp'
       return {
         'backgroundImage': `url("${url}")`,
       }
     },
+    canEdit(): boolean {
+      if (!this.$me.id) {
+        return false
+      }
+      return this.$me.id === this.image.uploaderUserId
+    },
   },
   emits: {
     click: null,
diff --git a/src/frontend/main.ts b/src/frontend/main.ts
index 082108f..f3334d8 100644
--- a/src/frontend/main.ts
+++ b/src/frontend/main.ts
@@ -32,8 +32,11 @@ import xhr from './xhr'
   xhr.setClientId(clientId)
   xhr.setClientSecret(clientSecret)
 
-  const res = await xhr.get(`/api/conf`, {})
-  const conf = await res.json()
+  const meRes = await xhr.get(`/api/me`, {})
+  const me = await meRes.json()
+
+  const confRes = await xhr.get(`/api/conf`, {})
+  const conf = await confRes.json()
 
   const router = VueRouter.createRouter({
     history: VueRouter.createWebHashHistory(),
@@ -53,6 +56,7 @@ import xhr from './xhr'
   })
 
   const app = Vue.createApp(App)
+  app.config.globalProperties.$me = me
   app.config.globalProperties.$config = conf
   app.config.globalProperties.$clientId = clientId
   app.use(router)
diff --git a/src/frontend/views/NewGame.vue b/src/frontend/views/NewGame.vue
index 7d50d08..214dc35 100644
--- a/src/frontend/views/NewGame.vue
+++ b/src/frontend/views/NewGame.vue
@@ -179,9 +179,13 @@ export default defineComponent({
       return await res.json()
     },
     async onSaveImageClick(data: any) {
-      await this.saveImage(data)
-      this.dialog = ''
-      await this.loadImages()
+      const res = await this.saveImage(data)
+      if (res.ok) {
+        this.dialog = ''
+        await this.loadImages()
+      } else {
+        alert(res.error)
+      }
     },
     async postToGalleryClick(data: any) {
       this.uploading = 'postToGallery'
diff --git a/src/server/Images.ts b/src/server/Images.ts
index 2a2c095..dd46e07 100644
--- a/src/server/Images.ts
+++ b/src/server/Images.ts
@@ -85,6 +85,7 @@ const imageFromDb = (db: Db, imageId: number): ImageInfo => {
   const i = db.get('images', { id: imageId })
   return {
     id: i.id,
+    uploaderUserId: i.uploader_user_id,
     filename: i.filename,
     url: `${UPLOAD_URL}/${encodeURIComponent(i.filename)}`,
     title: i.title,
@@ -130,6 +131,7 @@ inner join images i on i.id = ixc.image_id ${where.sql};
 
   return images.map(i => ({
     id: i.id as number,
+    uploaderUserId: i.uploader_user_id,
     filename: i.filename,
     url: `${UPLOAD_URL}/${encodeURIComponent(i.filename)}`,
     title: i.title,
@@ -151,6 +153,7 @@ const allImagesFromDisk = (
     .filter(f => f.toLowerCase().match(/\.(jpe?g|webp|png)$/))
     .map(f => ({
       id: 0,
+      uploaderUserId: null,
       filename: f,
       url: `${UPLOAD_URL}/${encodeURIComponent(f)}`,
       title: f.replace(/\.[a-z]+$/, ''),
diff --git a/src/server/main.ts b/src/server/main.ts
index cbed199..ad29d1d 100644
--- a/src/server/main.ts
+++ b/src/server/main.ts
@@ -57,6 +57,17 @@ const storage = multer.diskStorage({
 })
 const upload = multer({storage}).single('file');
 
+app.get('/api/me', (req, res): void => {
+  let user = db.get('users', {
+    'client_id': req.headers['client-id'],
+    'client_secret': req.headers['client-secret'],
+  })
+  res.send({
+    id: user ? user.id : null,
+    created: user ? user.created : null,
+  })
+})
+
 app.get('/api/conf', (req, res): void => {
   res.send({
     WS_ADDRESS: config.ws.connectstring,
@@ -147,7 +158,25 @@ const setImageTags = (db: Db, imageId: number, tags: string[]): void => {
 }
 
 app.post('/api/save-image', express.json(), (req, res): void => {
+  let user = db.get('users', {
+    'client_id': req.headers['client-id'],
+    'client_secret': req.headers['client-secret'],
+  })
+  let userId: number|null = null
+  if (user) {
+    userId = parseInt(user.id, 10)
+  } else {
+    res.status(403).send({ ok: false, error: 'forbidden' })
+    return
+  }
+
   const data = req.body as SaveImageRequestData
+  let image = db.get('images', {id: data.id})
+  if (parseInt(image.uploader_user_id, 10) !== userId) {
+    res.status(403).send({ ok: false, error: 'forbidden' })
+    return
+  }
+
   db.update('images', {
     title: data.title,
   }, {
@@ -176,10 +205,26 @@ app.post('/api/upload', (req, res): void => {
       res.status(400).send("Something went wrong!");
     }
 
+    let user = db.get('users', {
+      'client_id': req.headers['client-id'],
+      'client_secret': req.headers['client-secret'],
+    })
+    let userId: number|null = null
+    if (user) {
+      userId = user.id
+    } else {
+      userId = db.insert('users', {
+        'client_id': req.headers['client-id'],
+        'client_secret': req.headers['client-secret'],
+        'created': Time.timestamp(),
+      }) as number
+    }
+
     const dim = await Images.getDimensions(
       `${UPLOAD_DIR}/${req.file.filename}`
     )
     const imageId = db.insert('images', {
+      uploader_user_id: userId,
       filename: req.file.filename,
       filename_original: req.file.originalname,
       title: req.body.title || '',