From df765663eb6f99d27394dea84506cb470ac696a5 Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Mon, 7 Jun 2021 03:11:11 -0400
Subject: [PATCH] good permissions settings for w2l templates!

---
 .../users/list_user_w2l_templates.rs          | 26 ++++++++++++++++++-
 .../endpoints/w2l/get_w2l_template.rs         |  3 ++-
 .../endpoints/w2l/list_w2l_templates.rs       |  9 ++++---
 3 files changed, 33 insertions(+), 5 deletions(-)

diff --git a/src/http_server/endpoints/users/list_user_w2l_templates.rs b/src/http_server/endpoints/users/list_user_w2l_templates.rs
index 6bd5f5a995..c1eef4c609 100644
--- a/src/http_server/endpoints/users/list_user_w2l_templates.rs
+++ b/src/http_server/endpoints/users/list_user_w2l_templates.rs
@@ -86,10 +86,34 @@ pub async fn list_user_w2l_templates_handler(
 {
   info!("Fetching templates for user: {}", &path.username);
 
+  let maybe_user_session = server_state
+      .session_checker
+      .maybe_get_user_session(&http_request, &server_state.mysql_pool)
+      .await
+      .map_err(|e| {
+        warn!("Session checker error: {:?}", e);
+        ListW2lTemplatesForUserError::ServerError
+      })?;
+
+  let mut viewer_is_original_user = false;
+  let mut viewer_is_moderator = false;
+
+  match maybe_user_session {
+    None => {},
+    Some(session) => {
+      viewer_is_moderator = session.can_delete_other_users_w2l_templates;
+      viewer_is_original_user = &session.username == &path.username;
+    },
+  };
+
+  // The original user can see all their uploads, as can mods.
+  // Once they've been approved, everyone can see them.
+  let require_mod_approved = !(viewer_is_original_user || viewer_is_moderator);
+
   let query_results = list_w2l_templates(
     &server_state.mysql_pool,
     Some(path.username.as_ref()),
-    false
+    require_mod_approved
   ).await;
 
   let templates = match query_results {
diff --git a/src/http_server/endpoints/w2l/get_w2l_template.rs b/src/http_server/endpoints/w2l/get_w2l_template.rs
index 13e8ee32f0..8cff2298fe 100644
--- a/src/http_server/endpoints/w2l/get_w2l_template.rs
+++ b/src/http_server/endpoints/w2l/get_w2l_template.rs
@@ -98,7 +98,8 @@ pub async fn get_w2l_template_handler(
 
   if let Some(user_session) = maybe_user_session {
     // NB: Moderators can see deleted templates.
-    show_deleted_templates = user_session.can_approve_w2l_templates;
+    // Original creators cannot see them (unless they're moderators!)
+    show_deleted_templates = user_session.can_delete_other_users_w2l_templates;
   }
 
   let template_query_result = select_w2l_template_by_token(
diff --git a/src/http_server/endpoints/w2l/list_w2l_templates.rs b/src/http_server/endpoints/w2l/list_w2l_templates.rs
index 21e9b67cbd..c055b01454 100644
--- a/src/http_server/endpoints/w2l/list_w2l_templates.rs
+++ b/src/http_server/endpoints/w2l/list_w2l_templates.rs
@@ -75,11 +75,14 @@ pub async fn list_w2l_templates_handler(
   http_request: HttpRequest,
   server_state: web::Data<Arc<ServerState>>) -> Result<HttpResponse, ListW2lTemplatesError>
 {
-  let scope_creator = None;
+  let no_scope_creator = None;
+
+  // TODO(bt): Ideally we show users their own W2L templates here before they're mod approved.
+
   let query_results = list_w2l_templates(
     &server_state.mysql_pool,
-    scope_creator,
-    false,
+    no_scope_creator,
+    true,
   ).await;
 
   let templates = match query_results {