prevent locked templates/models from being edited by non-mods

src/http_server/endpoints/tts/edit_tts_model.rs

@@ -126,22 +126,15 @@ pub async fn edit_tts_model_handler(
   };
 
   // NB: Second set of permission checks
-  let mut editor_is_original_user = false;
-  let mut editor_is_moderator = false;
+  let is_author = model_record.creator_user_token == user_session.user_token;
+  let is_mod = user_session.can_edit_other_users_tts_models ;
 
-  if model_record.creator_user_token == user_session.user_token {
-    editor_is_original_user = true;
-  }
-
-  if user_session.can_edit_other_users_tts_models {
-    editor_is_moderator = true;
-  }
-
-  if !editor_is_original_user && !editor_is_moderator {
+  if !is_author && !is_mod {
+    warn!("user is not allowed to edit model: {}", user_session.user_token);
     return Err(EditTtsModelError::NotAuthorized);
   }
 
-  if !editor_is_moderator {
+  if !is_mod {
     if model_record.is_locked_from_user_modification || model_record.is_mod_disabled {
       return Err(EditTtsModelError::NotAuthorized);
     }
@@ -174,7 +167,7 @@ pub async fn edit_tts_model_handler(
 
   let ip_address = get_request_ip(&http_request);
 
-  let query_result = if editor_is_original_user {
+  let query_result = if is_author {
     // We need to store the IP address details.
     sqlx::query!(
         r#"

src/http_server/endpoints/w2l/delete_w2l_template.rs

@@ -110,9 +110,13 @@ pub async fn delete_w2l_template_handler(
     }
   };
 
+  // NB: First permission check.
+  // Only mods should see deleted models (both user_* and mod_* deleted).
+  let is_mod_that_can_see_deleted = user_session.can_delete_other_users_w2l_templates;
+
   let template_query_result = select_w2l_template_by_token(
     &path.slug,
-    true, // Only mods can perform this action
+    is_mod_that_can_see_deleted,
     &server_state.mysql_pool,
   ).await;
 
@@ -125,6 +129,7 @@ pub async fn delete_w2l_template_handler(
     Ok(Some(template)) => template,
   };
 
+  // NB: Second set of permission checks
   let is_author = w2l_template.creator_user_token == user_session.user_token;
   let is_mod = user_session.can_delete_other_users_w2l_templates;
 
@@ -133,6 +138,12 @@ pub async fn delete_w2l_template_handler(
     return Err(DeleteW2lTemplateError::NotAuthorized);
   }
 
+  if !is_mod {
+    if w2l_template.is_locked_from_user_modification || w2l_template.is_mod_disabled {
+      return Err(DeleteW2lTemplateError::NotAuthorized);
+    }
+  }
+
   let ip_address = get_request_ip(&http_request);
 
   let query_result = if request.set_delete {
@@ -151,6 +162,7 @@ pub async fn delete_w2l_template_handler(
     }
   } else {
     if is_author {
+      // NB: Technically only mods can see their own templates here
       user_undelete_template(
         &path.slug,
         &user_session.user_token,