From 55358e72a43c0134735d92d97899ef16f31d982b Mon Sep 17 00:00:00 2001
From: John Shaughnessy <john@johnshaughnessy.com>
Date: Fri, 23 Jun 2023 14:31:22 -0400
Subject: [PATCH] Check spawn_and_move_media permissions

---
 src/prefabs/prefabs.ts   | 22 ++++++++++++++++++----
 src/utils/permissions.ts |  2 +-
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/src/prefabs/prefabs.ts b/src/prefabs/prefabs.ts
index 3877b4115c..1584653614 100644
--- a/src/prefabs/prefabs.ts
+++ b/src/prefabs/prefabs.ts
@@ -8,8 +8,22 @@ type CameraPrefabT = () => EntityDef;
 type CubeMediaPrefabT = () => EntityDef;
 type MediaPrefabT = (params: MediaLoaderParams) => EntityDef;
 
+type Permission =
+  | "spawn_camera"
+  | "spawn_and_move_media"
+  | "update_hub"
+  | "pin_objects"
+  | "spawn_emoji"
+  | "amplify_audio"
+  | "fly"
+  | "voice_chat"
+  | "spawn_drawing"
+  | "tweet"
+  | "kick_users"
+  | "mute_users";
+
 export type PrefabDefinition = {
-  permission?: "spawn_camera";
+  permission: Permission;
   template: CameraPrefabT | CubeMediaPrefabT | MediaPrefabT;
 };
 
@@ -17,6 +31,6 @@ export type PrefabName = "camera" | "cube" | "media" | "duck";
 
 export const prefabs = new Map<PrefabName, PrefabDefinition>();
 prefabs.set("camera", { permission: "spawn_camera", template: CameraPrefab });
-prefabs.set("cube", { template: CubeMediaFramePrefab });
-prefabs.set("media", { template: MediaPrefab });
-prefabs.set("duck", { template: DuckPrefab });
+prefabs.set("cube", { permission: "spawn_and_move_media", template: CubeMediaFramePrefab });
+prefabs.set("media", { permission: "spawn_and_move_media", template: MediaPrefab });
+prefabs.set("duck", { permission: "spawn_and_move_media", template: DuckPrefab });
diff --git a/src/utils/permissions.ts b/src/utils/permissions.ts
index 402b433d6f..521c28cd6f 100644
--- a/src/utils/permissions.ts
+++ b/src/utils/permissions.ts
@@ -4,5 +4,5 @@ import type { ClientID } from "./networking-types";
 export function hasPermissionToSpawn(creator: ClientID, prefabName: PrefabName) {
   if (creator === "reticulum") return true;
   const perm = prefabs.get(prefabName)!.permission;
-  return !perm || APP.hubChannel!.userCan(creator, perm);
+  return APP.hubChannel!.userCan(creator, perm);
 }