diff --git a/crates/core/result/src/axum.rs b/crates/core/result/src/axum.rs index 80417d14c..20fd25df3 100644 --- a/crates/core/result/src/axum.rs +++ b/crates/core/result/src/axum.rs @@ -32,6 +32,7 @@ impl IntoResponse for Error { ErrorType::EmptyMessage => StatusCode::UNPROCESSABLE_ENTITY, ErrorType::PayloadTooLarge => StatusCode::UNPROCESSABLE_ENTITY, ErrorType::CannotRemoveYourself => StatusCode::BAD_REQUEST, + ErrorType::CannotRemoveServerOwner => StatusCode::BAD_REQUEST, ErrorType::GroupTooLarge { .. } => StatusCode::FORBIDDEN, ErrorType::AlreadyInGroup => StatusCode::CONFLICT, ErrorType::NotInGroup => StatusCode::NOT_FOUND, diff --git a/crates/core/result/src/lib.rs b/crates/core/result/src/lib.rs index 922a7676f..a273c4a0f 100644 --- a/crates/core/result/src/lib.rs +++ b/crates/core/result/src/lib.rs @@ -94,6 +94,7 @@ pub enum ErrorType { EmptyMessage, PayloadTooLarge, CannotRemoveYourself, + CannotRemoveServerOwner, GroupTooLarge { max: usize, }, diff --git a/crates/core/result/src/rocket.rs b/crates/core/result/src/rocket.rs index 4a39e2be9..4c3533bc6 100644 --- a/crates/core/result/src/rocket.rs +++ b/crates/core/result/src/rocket.rs @@ -37,6 +37,7 @@ impl<'r> Responder<'r, 'static> for Error { ErrorType::EmptyMessage => Status::UnprocessableEntity, ErrorType::PayloadTooLarge => Status::UnprocessableEntity, ErrorType::CannotRemoveYourself => Status::BadRequest, + ErrorType::CannotRemoveServerOwner => Status::BadRequest, ErrorType::GroupTooLarge { .. } => Status::Forbidden, ErrorType::AlreadyInGroup => Status::Conflict, ErrorType::NotInGroup => Status::NotFound, diff --git a/crates/delta/src/routes/servers/member_remove.rs b/crates/delta/src/routes/servers/member_remove.rs index a7e2f50af..e140d7c91 100644 --- a/crates/delta/src/routes/servers/member_remove.rs +++ b/crates/delta/src/routes/servers/member_remove.rs @@ -2,7 +2,7 @@ use revolt_database::{ util::{permissions::DatabasePermissionQuery, reference::Reference}, Database, RemovalIntention, User, }; -use revolt_permissions::{calculate_server_permissions, ChannelPermission}; +use revolt_permissions::{calculate_server_permissions, ChannelPermission, PermissionQuery}; use revolt_result::{create_error, Result}; use rocket::State; use rocket_empty::EmptyResponse; @@ -29,6 +29,11 @@ pub async fn kick( } let mut query = DatabasePermissionQuery::new(db, &user).server(&server); + + if query.are_we_server_owner().await { + return Err(create_error!(CannotRemoveServerOwner)); + } + calculate_server_permissions(&mut query) .await .throw_if_lacking_channel_permission(ChannelPermission::KickMembers)?;