good permissions settings for w2l templates!

src/http_server/endpoints/users/list_user_w2l_templates.rs

@@ -86,10 +86,34 @@ pub async fn list_user_w2l_templates_handler(
 {
   info!("Fetching templates for user: {}", &path.username);
 
+  let maybe_user_session = server_state
+      .session_checker
+      .maybe_get_user_session(&http_request, &server_state.mysql_pool)
+      .await
+      .map_err(|e| {
+        warn!("Session checker error: {:?}", e);
+        ListW2lTemplatesForUserError::ServerError
+      })?;
+
+  let mut viewer_is_original_user = false;
+  let mut viewer_is_moderator = false;
+
+  match maybe_user_session {
+    None => {},
+    Some(session) => {
+      viewer_is_moderator = session.can_delete_other_users_w2l_templates;
+      viewer_is_original_user = &session.username == &path.username;
+    },
+  };
+
+  // The original user can see all their uploads, as can mods.
+  // Once they've been approved, everyone can see them.
+  let require_mod_approved = !(viewer_is_original_user || viewer_is_moderator);
+
   let query_results = list_w2l_templates(
     &server_state.mysql_pool,
     Some(path.username.as_ref()),
-    false
+    require_mod_approved
   ).await;
 
   let templates = match query_results {

src/http_server/endpoints/w2l/get_w2l_template.rs

@@ -98,7 +98,8 @@ pub async fn get_w2l_template_handler(
 
   if let Some(user_session) = maybe_user_session {
     // NB: Moderators can see deleted templates.
-    show_deleted_templates = user_session.can_approve_w2l_templates;
+    // Original creators cannot see them (unless they're moderators!)
+    show_deleted_templates = user_session.can_delete_other_users_w2l_templates;
   }
 
   let template_query_result = select_w2l_template_by_token(

src/http_server/endpoints/w2l/list_w2l_templates.rs

@@ -75,11 +75,14 @@ pub async fn list_w2l_templates_handler(
   http_request: HttpRequest,
   server_state: web::Data<Arc<ServerState>>) -> Result<HttpResponse, ListW2lTemplatesError>
 {
-  let scope_creator = None;
+  let no_scope_creator = None;
+
+  // TODO(bt): Ideally we show users their own W2L templates here before they're mod approved.
+
   let query_results = list_w2l_templates(
     &server_state.mysql_pool,
-    scope_creator,
-    false,
+    no_scope_creator,
+    true,
   ).await;
 
   let templates = match query_results {