From 2fcae0a39c394a66f73c69ee320d2fe0d5351bed Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Wed, 9 Jun 2021 22:05:42 -0400 Subject: [PATCH] fixup all queries for user_deleted_at / mod_deleted_at (untested) --- .../list_tts_inference_results.rs | 34 +++--- src/common_queries/list_tts_models.rs | 22 ++-- .../list_w2l_inference_results.rs | 34 +++--- src/common_queries/list_w2l_templates.rs | 22 ++-- src/common_queries/query_user_profile.rs | 6 +- src/common_queries/query_w2l_template.rs | 25 +++-- .../endpoints/tts/get_tts_model.rs | 6 +- .../endpoints/tts/get_tts_result.rs | 5 +- .../endpoints/tts/list_tts_models.rs | 6 +- .../endpoints/users/get_profile.rs | 6 +- src/http_server/endpoints/users/logout.rs | 5 +- .../endpoints/w2l/delete_w2l_template.rs | 104 ++++++++++++++---- .../w2l/enqueue_infer_w2l_with_uploads.rs | 6 +- .../endpoints/w2l/get_w2l_result.rs | 5 +- src/http_server/web_utils/session_checker.rs | 3 +- src/job_queries/tts_inference_job_queries.rs | 3 +- src/job_queries/w2l_inference_job_queries.rs | 3 +- 17 files changed, 200 insertions(+), 95 deletions(-) diff --git a/src/common_queries/list_tts_inference_results.rs b/src/common_queries/list_tts_inference_results.rs index 786151b1e5..73391cc518 100644 --- a/src/common_queries/list_tts_inference_results.rs +++ b/src/common_queries/list_tts_inference_results.rs @@ -136,13 +136,14 @@ SELECT FROM tts_results LEFT OUTER JOIN tts_models - ON tts_results.model_token = tts_models.token + ON tts_results.model_token = tts_models.token LEFT OUTER JOIN users - ON tts_results.maybe_creator_user_token = users.token + ON tts_results.maybe_creator_user_token = users.token WHERE - tts_results.deleted_at IS NULL - AND tts_results.is_mod_hidden_from_public IS FALSE + tts_results.is_mod_hidden_from_public IS FALSE AND tts_models.is_mod_disabled IS FALSE + AND tts_results.user_deleted_at IS NULL + AND tts_results.mod_deleted_at IS NULL "#) .fetch_all(mysql_pool) .await? @@ -168,11 +169,12 @@ SELECT FROM tts_results LEFT OUTER JOIN tts_models - ON tts_results.model_token = tts_models.token + ON tts_results.model_token = tts_models.token LEFT OUTER JOIN users - ON tts_results.maybe_creator_user_token = users.token + ON tts_results.maybe_creator_user_token = users.token WHERE - tts_results.deleted_at IS NULL + tts_results.user_deleted_at IS NULL + AND tts_results.mod_deleted_at IS NULL "#) .fetch_all(mysql_pool) .await? @@ -210,14 +212,15 @@ SELECT FROM tts_results LEFT OUTER JOIN tts_models - ON tts_results.model_token = tts_models.token + ON tts_results.model_token = tts_models.token LEFT OUTER JOIN users - ON tts_results.maybe_creator_user_token = users.token + ON tts_results.maybe_creator_user_token = users.token WHERE - tts_results.deleted_at IS NULL + users.username = ? AND tts_results.is_mod_hidden_from_public IS FALSE AND tts_models.is_mod_disabled IS FALSE - AND users.username = ? + AND tts_results.user_deleted_at IS NULL + AND tts_results.mod_deleted_at IS NULL "#, scope_creator_username) .fetch_all(mysql_pool) @@ -244,12 +247,13 @@ SELECT FROM tts_results LEFT OUTER JOIN tts_models - ON tts_results.model_token = tts_models.token + ON tts_results.model_token = tts_models.token LEFT OUTER JOIN users - ON tts_results.maybe_creator_user_token = users.token + ON tts_results.maybe_creator_user_token = users.token WHERE - tts_results.deleted_at IS NULL - AND users.username = ? + users.username = ? + AND tts_results.user_deleted_at IS NULL + AND tts_results.mod_deleted_at IS NULL "#, scope_creator_username) .fetch_all(mysql_pool) diff --git a/src/common_queries/list_tts_models.rs b/src/common_queries/list_tts_models.rs index 31d073866b..29f38189ae 100644 --- a/src/common_queries/list_tts_models.rs +++ b/src/common_queries/list_tts_models.rs @@ -118,10 +118,11 @@ SELECT tts.updated_at FROM tts_models as tts JOIN users -ON users.token = tts.creator_user_token + ON users.token = tts.creator_user_token WHERE - tts.deleted_at IS NULL - AND tts.is_mod_disabled IS FALSE + tts.is_mod_disabled IS FALSE + AND tts.user_deleted_at IS NULL + AND tts.mod_deleted_at IS NULL "#) .fetch_all(mysql_pool) .await? @@ -143,9 +144,10 @@ SELECT tts.updated_at FROM tts_models as tts JOIN users -ON users.token = tts.creator_user_token + ON users.token = tts.creator_user_token WHERE - tts.deleted_at IS NULL + tts.user_deleted_at IS NULL + AND tts.mod_deleted_at IS NULL "#) .fetch_all(mysql_pool) .await? @@ -182,9 +184,10 @@ JOIN users ON users.token = tts.creator_user_token WHERE - tts.deleted_at IS NULL + users.username = ? AND tts.is_mod_disabled IS FALSE - AND users.username = ? + AND tts.user_deleted_at IS NULL + AND tts.mod_deleted_at IS NULL "#, scope_creator_username) .fetch_all(mysql_pool) @@ -210,8 +213,9 @@ JOIN users ON users.token = tts.creator_user_token WHERE - tts.deleted_at IS NULL - AND users.username = ? + users.username = ? + AND tts.user_deleted_at IS NULL + AND tts.mod_deleted_at IS NULL "#, scope_creator_username) .fetch_all(mysql_pool) diff --git a/src/common_queries/list_w2l_inference_results.rs b/src/common_queries/list_w2l_inference_results.rs index e81b91258c..ce241d7a48 100644 --- a/src/common_queries/list_w2l_inference_results.rs +++ b/src/common_queries/list_w2l_inference_results.rs @@ -153,13 +153,14 @@ SELECT FROM w2l_results LEFT OUTER JOIN w2l_templates - ON w2l_results.maybe_w2l_template_token = w2l_templates.token + ON w2l_results.maybe_w2l_template_token = w2l_templates.token LEFT OUTER JOIN users - ON w2l_results.maybe_creator_user_token = users.token + ON w2l_results.maybe_creator_user_token = users.token WHERE - w2l_results.deleted_at IS NULL - AND w2l_results.is_mod_hidden_from_public IS FALSE + w2l_results.is_mod_hidden_from_public IS FALSE AND w2l_templates.is_mod_public_listing_approved IS TRUE + AND w2l_results.user_deleted_at IS NULL + AND w2l_results.mod_deleted_at IS NULL "#) .fetch_all(mysql_pool) .await? @@ -189,11 +190,12 @@ SELECT FROM w2l_results LEFT OUTER JOIN w2l_templates - ON w2l_results.maybe_w2l_template_token = w2l_templates.token + ON w2l_results.maybe_w2l_template_token = w2l_templates.token LEFT OUTER JOIN users - ON w2l_results.maybe_creator_user_token = users.token + ON w2l_results.maybe_creator_user_token = users.token WHERE - w2l_results.deleted_at IS NULL + w2l_results.user_deleted_at IS NULL + AND w2l_results.mod_deleted_at IS NULL "#) .fetch_all(mysql_pool) .await? @@ -235,14 +237,15 @@ SELECT FROM w2l_results LEFT OUTER JOIN w2l_templates - ON w2l_results.maybe_w2l_template_token = w2l_templates.token + ON w2l_results.maybe_w2l_template_token = w2l_templates.token LEFT OUTER JOIN users - ON w2l_results.maybe_creator_user_token = users.token + ON w2l_results.maybe_creator_user_token = users.token WHERE - w2l_results.deleted_at IS NULL + users.username = ? AND w2l_results.is_mod_hidden_from_public IS FALSE AND w2l_templates.is_mod_public_listing_approved IS TRUE - AND users.username = ? + AND w2l_results.user_deleted_at IS NULL + AND w2l_results.mod_deleted_at IS NULL "#, scope_creator_username) .fetch_all(mysql_pool) @@ -273,12 +276,13 @@ SELECT FROM w2l_results LEFT OUTER JOIN w2l_templates - ON w2l_results.maybe_w2l_template_token = w2l_templates.token + ON w2l_results.maybe_w2l_template_token = w2l_templates.token LEFT OUTER JOIN users - ON w2l_results.maybe_creator_user_token = users.token + ON w2l_results.maybe_creator_user_token = users.token WHERE - w2l_results.deleted_at IS NULL - AND users.username = ? + users.username = ? + AND w2l_results.user_deleted_at IS NULL + AND w2l_results.mod_deleted_at IS NULL "#, scope_creator_username) .fetch_all(mysql_pool) diff --git a/src/common_queries/list_w2l_templates.rs b/src/common_queries/list_w2l_templates.rs index 4fd6e4cc8e..0e20e95032 100644 --- a/src/common_queries/list_w2l_templates.rs +++ b/src/common_queries/list_w2l_templates.rs @@ -131,10 +131,11 @@ SELECT w2l.updated_at FROM w2l_templates as w2l JOIN users -ON users.token = w2l.creator_user_token + ON users.token = w2l.creator_user_token WHERE - w2l.deleted_at IS NULL - AND w2l.is_mod_public_listing_approved IS TRUE + w2l.is_mod_public_listing_approved IS TRUE + AND w2l.user_deleted_at IS NULL + AND w2l.mod_deleted_at IS NULL "#) .fetch_all(mysql_pool) .await? @@ -161,9 +162,10 @@ SELECT w2l.updated_at FROM w2l_templates as w2l JOIN users -ON users.token = w2l.creator_user_token + ON users.token = w2l.creator_user_token WHERE - w2l.deleted_at IS NULL + w2l.user_deleted_at IS NULL + AND w2l.mod_deleted_at IS NULL "#) .fetch_all(mysql_pool) .await? @@ -205,9 +207,10 @@ JOIN users ON users.token = w2l.creator_user_token WHERE - w2l.deleted_at IS NULL + users.username = ? AND w2l.is_mod_public_listing_approved IS TRUE - AND users.username = ? + AND w2l.user_deleted_at IS NULL + AND w2l.mod_deleted_at IS NULL "#, scope_creator_username) .fetch_all(mysql_pool) @@ -238,8 +241,9 @@ JOIN users ON users.token = w2l.creator_user_token WHERE - w2l.deleted_at IS NULL - AND users.username = ? + users.username = ? + AND w2l.user_deleted_at IS NULL + AND w2l.mod_deleted_at IS NULL "#, scope_creator_username) .fetch_all(mysql_pool) diff --git a/src/common_queries/query_user_profile.rs b/src/common_queries/query_user_profile.rs index df5f8a3861..3c17625e76 100644 --- a/src/common_queries/query_user_profile.rs +++ b/src/common_queries/query_user_profile.rs @@ -89,8 +89,10 @@ SELECT github_username, created_at FROM users -WHERE users.username = ? -AND users.deleted_at IS NULL +WHERE + users.username = ? + AND users.user_deleted_at IS NULL + AND users.mod_deleted_at IS NULL "#, username, ) diff --git a/src/common_queries/query_w2l_template.rs b/src/common_queries/query_w2l_template.rs index c6fa76ca4c..9c7bced44d 100644 --- a/src/common_queries/query_w2l_template.rs +++ b/src/common_queries/query_w2l_template.rs @@ -30,7 +30,8 @@ pub struct W2lTemplateRecordForResponse { pub is_mod_disabled: bool, pub created_at: DateTime, pub updated_at: DateTime, - pub deleted_at: Option>, + pub user_deleted_at: Option>, + pub mod_deleted_at: Option>, } #[derive(Serialize)] @@ -51,7 +52,8 @@ pub struct W2lTemplateRecordRaw { pub is_mod_disabled: i8, pub created_at: DateTime, pub updated_at: DateTime, - pub deleted_at: Option>, + pub user_deleted_at: Option>, + pub mod_deleted_at: Option>, } pub async fn select_w2l_template_by_token( @@ -99,7 +101,8 @@ pub async fn select_w2l_template_by_token( is_mod_disabled: i8_to_bool(template.is_mod_disabled), created_at: template.created_at.clone(), updated_at: template.updated_at.clone(), - deleted_at: template.deleted_at.clone(), + user_deleted_at: template.user_deleted_at.clone(), + mod_deleted_at: template.mod_deleted_at.clone(), }; Ok(Some(template_for_response)) @@ -129,10 +132,11 @@ SELECT w2l.is_mod_disabled, w2l.created_at, w2l.updated_at, - w2l.deleted_at + w2l.user_deleted_at, + w2l.mod_deleted_at FROM w2l_templates as w2l JOIN users -ON users.token = w2l.creator_user_token + ON users.token = w2l.creator_user_token WHERE w2l.token = ? "#, w2l_template_token @@ -165,12 +169,15 @@ SELECT w2l.is_mod_disabled, w2l.created_at, w2l.updated_at, - w2l.deleted_at + w2l.user_deleted_at, + w2l.mod_deleted_at FROM w2l_templates as w2l JOIN users -ON users.token = w2l.creator_user_token -WHERE w2l.token = ? -AND w2l.deleted_at IS NULL + ON users.token = w2l.creator_user_token +WHERE + w2l.token = ? + AND w2l.user_deleted_at IS NULL + AND w2l.mod_deleted_at IS NULL "#, w2l_template_token ) diff --git a/src/http_server/endpoints/tts/get_tts_model.rs b/src/http_server/endpoints/tts/get_tts_model.rs index 9cffbab77f..76fb2efa00 100644 --- a/src/http_server/endpoints/tts/get_tts_model.rs +++ b/src/http_server/endpoints/tts/get_tts_model.rs @@ -138,8 +138,10 @@ SELECT FROM tts_models as tts JOIN users ON users.token = tts.creator_user_token -WHERE tts.updatable_slug = ? -AND tts.deleted_at IS NULL +WHERE + tts.updatable_slug = ? + AND tts.user_deleted_at IS NULL + AND tts.mod_deleted_at IS NULL "#, &path.slug ) diff --git a/src/http_server/endpoints/tts/get_tts_result.rs b/src/http_server/endpoints/tts/get_tts_result.rs index c2ec9c531e..7727778d83 100644 --- a/src/http_server/endpoints/tts/get_tts_result.rs +++ b/src/http_server/endpoints/tts/get_tts_result.rs @@ -184,8 +184,9 @@ LEFT OUTER JOIN users LEFT OUTER JOIN users as model_users ON tts_models.creator_user_token = model_users.token WHERE - tts_results.deleted_at IS NULL - AND tts_results.token = ? + tts_results.token = ? + AND tts_results.user_deleted_at IS NULL + AND tts_results.mod_deleted_at IS NULL "#, &path.token ) diff --git a/src/http_server/endpoints/tts/list_tts_models.rs b/src/http_server/endpoints/tts/list_tts_models.rs index 4f58eb9874..f8155e41e2 100644 --- a/src/http_server/endpoints/tts/list_tts_models.rs +++ b/src/http_server/endpoints/tts/list_tts_models.rs @@ -117,8 +117,10 @@ SELECT tts.updated_at FROM tts_models as tts JOIN users -ON users.token = tts.creator_user_token -WHERE tts.deleted_at IS NULL + ON users.token = tts.creator_user_token +WHERE + tts.user_deleted_at IS NULL + AND tts.mod_deleted_at IS NULL "#, ) .fetch_all(&server_state.mysql_pool) diff --git a/src/http_server/endpoints/users/get_profile.rs b/src/http_server/endpoints/users/get_profile.rs index f66fc92037..1124cd02ab 100644 --- a/src/http_server/endpoints/users/get_profile.rs +++ b/src/http_server/endpoints/users/get_profile.rs @@ -168,8 +168,10 @@ SELECT website_url, created_at FROM users -WHERE users.username = ? -AND users.deleted_at IS NULL +WHERE + users.username = ? + AND users.user_deleted_at IS NULL + AND users.mod_deleted_at IS NULL "#, &path.username, ) diff --git a/src/http_server/endpoints/users/logout.rs b/src/http_server/endpoints/users/logout.rs index f66d445653..6a5f3e9960 100644 --- a/src/http_server/endpoints/users/logout.rs +++ b/src/http_server/endpoints/users/logout.rs @@ -107,8 +107,9 @@ async fn delete_session(session_token: &str, mysql_pool: &MySqlPool) -> AnyhowRe r#" UPDATE user_sessions SET deleted_at = CURRENT_TIMESTAMP() -WHERE token = ? -AND deleted_at IS NULL +WHERE + token = ? + AND deleted_at IS NULL "#, session_token.to_string(), ) diff --git a/src/http_server/endpoints/w2l/delete_w2l_template.rs b/src/http_server/endpoints/w2l/delete_w2l_template.rs index b46a81af0c..203dd96468 100644 --- a/src/http_server/endpoints/w2l/delete_w2l_template.rs +++ b/src/http_server/endpoints/w2l/delete_w2l_template.rs @@ -110,11 +110,6 @@ pub async fn delete_w2l_template_handler( } }; - if !user_session.can_delete_other_users_w2l_templates { - warn!("user is not allowed to delete templates: {}", user_session.user_token); - return Err(DeleteW2lTemplateError::NotAuthorized); - } - let template_query_result = select_w2l_template_by_token( &path.slug, true, // Only mods can perform this action @@ -130,20 +125,44 @@ pub async fn delete_w2l_template_handler( Ok(Some(template)) => template, }; + let is_author = w2l_template.creator_user_token == user_session.user_token; + let is_mod = user_session.can_delete_other_users_w2l_templates; + + if !is_author && !is_mod { + warn!("user is not allowed to delete templates: {}", user_session.user_token); + return Err(DeleteW2lTemplateError::NotAuthorized); + } + let ip_address = get_request_ip(&http_request); let query_result = if request.set_delete { - delete_template( - &path.slug, - &user_session.user_token, - &server_state.mysql_pool - ).await + if is_author { + user_delete_template( + &path.slug, + &user_session.user_token, + &server_state.mysql_pool + ).await + } else { + mod_delete_template( + &path.slug, + &user_session.user_token, + &server_state.mysql_pool + ).await + } } else { - undelete_template( - &path.slug, - &user_session.user_token, - &server_state.mysql_pool - ).await + if is_author { + user_undelete_template( + &path.slug, + &user_session.user_token, + &server_state.mysql_pool + ).await + } else { + mod_undelete_template( + &path.slug, + &user_session.user_token, + &server_state.mysql_pool + ).await + } }; match query_result { @@ -166,7 +185,7 @@ pub async fn delete_w2l_template_handler( .body(body)) } -async fn delete_template( +async fn user_delete_template( template_token: &str, mod_user_token: &str, mysql_pool: &MySqlPool @@ -175,7 +194,30 @@ async fn delete_template( r#" UPDATE w2l_templates SET - deleted_at = CURRENT_TIMESTAMP, + user_deleted_at = CURRENT_TIMESTAMP, + maybe_mod_user_token = ? +WHERE + token = ? +LIMIT 1 + "#, + mod_user_token, + template_token, + ) + .execute(mysql_pool) + .await?; + Ok(()) +} + +async fn mod_delete_template( + template_token: &str, + mod_user_token: &str, + mysql_pool: &MySqlPool +) -> Result<(), sqlx::Error> { + let _r = sqlx::query!( + r#" +UPDATE w2l_templates +SET + mod_deleted_at = CURRENT_TIMESTAMP, maybe_mod_user_token = ? WHERE token = ? @@ -189,7 +231,7 @@ LIMIT 1 Ok(()) } -async fn undelete_template( +async fn user_undelete_template( template_token: &str, mod_user_token: &str, mysql_pool: &MySqlPool @@ -199,7 +241,7 @@ async fn undelete_template( r#" UPDATE w2l_templates SET - deleted_at = NULL, + user_deleted_at = NULL, maybe_mod_user_token = ? WHERE token = ? @@ -212,3 +254,27 @@ LIMIT 1 .await?; Ok(()) } + +async fn mod_undelete_template( + template_token: &str, + mod_user_token: &str, + mysql_pool: &MySqlPool +) -> Result<(), sqlx::Error> { + + let _r = sqlx::query!( + r#" +UPDATE w2l_templates +SET + mod_deleted_at = NULL, + maybe_mod_user_token = ? +WHERE + token = ? +LIMIT 1 + "#, + mod_user_token, + template_token, + ) + .execute(mysql_pool) + .await?; + Ok(()) +} diff --git a/src/http_server/endpoints/w2l/enqueue_infer_w2l_with_uploads.rs b/src/http_server/endpoints/w2l/enqueue_infer_w2l_with_uploads.rs index f657ecdd93..83602a62bb 100644 --- a/src/http_server/endpoints/w2l/enqueue_infer_w2l_with_uploads.rs +++ b/src/http_server/endpoints/w2l/enqueue_infer_w2l_with_uploads.rs @@ -372,8 +372,10 @@ async fn check_template_exists(template_token: &str, mysql_pool: &MySqlPool) -> SELECT token as template_token FROM w2l_templates -WHERE token = ? -AND deleted_at IS NULL +WHERE + token = ? + AND user_deleted_at IS NULL + AND mod_deleted_at IS NULL "#, &template_token ) diff --git a/src/http_server/endpoints/w2l/get_w2l_result.rs b/src/http_server/endpoints/w2l/get_w2l_result.rs index 02dc49528c..a7a1f85b5a 100644 --- a/src/http_server/endpoints/w2l/get_w2l_result.rs +++ b/src/http_server/endpoints/w2l/get_w2l_result.rs @@ -190,8 +190,9 @@ LEFT OUTER JOIN users LEFT OUTER JOIN users as template_users ON w2l_templates.creator_user_token = template_users.token WHERE - w2l_results.deleted_at IS NULL - AND w2l_results.token = ? + w2l_results.token = ? + AND w2l_results.user_deleted_at IS NULL + AND w2l_results.mod_deleted_at IS NULL "#, &path.token ) diff --git a/src/http_server/web_utils/session_checker.rs b/src/http_server/web_utils/session_checker.rs index d9ff4c4b6a..9c52114c26 100644 --- a/src/http_server/web_utils/session_checker.rs +++ b/src/http_server/web_utils/session_checker.rs @@ -213,7 +213,8 @@ LEFT OUTER JOIN user_roles ON users.user_role_slug = user_roles.slug WHERE user_sessions.token = ? AND user_sessions.deleted_at IS NULL - AND users.deleted_at IS NULL + AND users.user_deleted_at IS NULL + AND users.mod_deleted_at IS NULL "#, session_token.to_string(), ) diff --git a/src/job_queries/tts_inference_job_queries.rs b/src/job_queries/tts_inference_job_queries.rs index 38f0106ecc..621c9d5aae 100644 --- a/src/job_queries/tts_inference_job_queries.rs +++ b/src/job_queries/tts_inference_job_queries.rs @@ -331,7 +331,8 @@ FROM tts_models as tts JOIN users ON users.token = tts.creator_user_token WHERE tts.token = ? -AND tts.deleted_at IS NULL +AND tts.user_deleted_at IS NULL +AND tts.mod_deleted_at IS NULL "#, &model_token ) diff --git a/src/job_queries/w2l_inference_job_queries.rs b/src/job_queries/w2l_inference_job_queries.rs index d17c198c2a..42eec12078 100644 --- a/src/job_queries/w2l_inference_job_queries.rs +++ b/src/job_queries/w2l_inference_job_queries.rs @@ -353,7 +353,8 @@ FROM w2l_templates as w2l JOIN users ON users.token = w2l.creator_user_token WHERE w2l.token = ? -AND w2l.deleted_at IS NULL +AND w2l.user_deleted_at IS NULL +AND w2l.mod_deleted_at IS NULL "#, &template_token )