From 484e6788e36f267ed19d883e9eec6bca6512b536 Mon Sep 17 00:00:00 2001
From: kasisnu <5044120+kasisnu@users.noreply.github.com>
Date: Wed, 4 Oct 2023 18:56:49 +0530
Subject: [PATCH] enforce user token check

---
 .../voice_designer/update_dataset.rs          | 31 +++++++++++--------
 .../service/web/storyteller_web/src/routes.rs |  2 +-
 2 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/voice_designer/update_dataset.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/voice_designer/update_dataset.rs
index 53113430e6..4462d971e5 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/voice_designer/update_dataset.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/voice_designer/update_dataset.rs
@@ -96,24 +96,31 @@ pub async fn update_dataset_handler(
     }
   };
 
-
   let dataset_token = path.dataset_token.clone();
   let dataset_lookup_result = get_dataset_by_token(
     &ZsDatasetToken::new(dataset_token.clone()),
     &server_state.mysql_pool,
   ).await;
 
-    let dataset = match dataset_lookup_result {
-        Ok(Some(dataset)) => dataset,
-        Ok(None) => {
-          warn!("Dataset not found: {:?}", dataset_token);
-          return Err(UpdateDatasetError::NotFound);
-        },
-        Err(err) => {
+  let dataset = match dataset_lookup_result {
+      Ok(Some(dataset)) => dataset,
+      Ok(None) => {
+        warn!("Dataset not found: {:?}", dataset_token);
+        return Err(UpdateDatasetError::NotFound);
+      },
+      Err(err) => {
         warn!("Error looking up dataset: {:?}", err);
         return Err(UpdateDatasetError::ServerError);
-        }
-    };
+      }
+  };
+
+  let is_creator = dataset.maybe_creator_user_token == Some(user_session.user_token);
+  let is_mod = user_session.can_ban_users;
+
+  if !is_creator && !is_mod {
+    warn!("user is not allowed to edit this dataset: {}", user_session.user_token);
+    return Err(UpdateDatasetError::NotAuthorized);
+  }
 
   let mut title = None;
   let mut ietf_language_tag = None;
@@ -156,10 +163,8 @@ pub async fn update_dataset_handler(
         .map_err(|_| UpdateDatasetError::BadInput("bad record visibility".to_string()))?;
   }
 
-  let is_mod = user_session.can_ban_users;
 
   let ip_address = get_request_ip(&http_request);
-
   let mut maybe_mod_user_token = None;
 
   if is_mod {
@@ -167,7 +172,7 @@ pub async fn update_dataset_handler(
   }
   let query_result = update_dataset(
     UpdateDatasetArgs {
-      dataset_token: &ZsDatasetToken::new(path.dataset_token.clone()),
+      dataset_token: &ZsDatasetToken::new(dataset_token.clone()),
       dataset_title: title.as_deref(),
       maybe_creator_user_token: Some(user_session.user_token.clone().as_ref()),
       creator_ip_address: ip_address.as_ref(),
diff --git a/crates/service/web/storyteller_web/src/routes.rs b/crates/service/web/storyteller_web/src/routes.rs
index dc24ea971d..fe0ba78f04 100644
--- a/crates/service/web/storyteller_web/src/routes.rs
+++ b/crates/service/web/storyteller_web/src/routes.rs
@@ -174,7 +174,7 @@ pub fn add_routes<T, B> (app: App<T>) -> App<T>
   app = add_subscription_routes(app); /* /v1/subscriptions/... */
 
   // TODO find a long term feature flag solution, since this code is likely deployed into production we don't want the route found.
-  let enable_voice_designer_route = true;
+  let enable_voice_designer_route = false;
   if (enable_voice_designer_route) { 
     app = add_voice_designer_routes(app); /* /v1/voice_designer */
   }