Move from role-based to permissions-based checks

src/command-handler.ts

@@ -148,8 +148,7 @@ export class CommandHandler {
                     JSON.stringify(command_body),
                 );
                 if (command.permissions !== undefined) {
-                    const member = await this.wheatley.try_fetch_guild_member(await command_obj.get_member());
-                    if (!member || !member.permissions.has(command.permissions)) {
+                    if (!(await this.wheatley.check_permissions(command_obj.user, command.permissions))) {
                         await command_obj.reply({
                             files: ["https://miro.medium.com/v2/resize:fit:750/1*lMV_u6tnu9WmFuJRyhTsFQ.jpeg"],
                             should_text_reply: true,
@@ -209,8 +208,7 @@ export class CommandHandler {
             const command_options: unknown[] = [];
             const command_object = new TextBasedCommand(interaction.commandName, command, interaction, this.wheatley);
             if (command.permissions !== undefined) {
-                const member = await this.wheatley.try_fetch_guild_member(interaction.user.id);
-                if (!member || !member.permissions.has(command.permissions)) {
+                if (!(await this.wheatley.check_permissions(interaction.user, command.permissions))) {
                     await interaction.reply({
                         files: ["https://miro.medium.com/v2/resize:fit:750/1*lMV_u6tnu9WmFuJRyhTsFQ.jpeg"],
                     });

src/components/anti-everyone.ts

@@ -25,7 +25,7 @@ export default class AntiEveryone extends BotComponent {
             // bot
             message.author.bot ||
             // mod
-            this.wheatley.is_authorized_mod(message.author) ||
+            (await this.wheatley.check_permissions(message.author, Discord.PermissionFlagsBits.MentionEveryone)) ||
             // outside of TCCPP (like DMs)
             message.guildId != this.wheatley.guild.id
         ) {

src/components/anti-invite-links.ts

@@ -50,7 +50,7 @@ export default class AntiInviteLinks extends BotComponent {
     }
 
     async handle_message(message: Discord.Message) {
-        if (this.wheatley.is_authorized_mod(message.author)) {
+        if (await this.wheatley.check_permissions(message.author, Discord.PermissionFlagsBits.ModerateMembers)) {
             return;
         }
         const match = match_invite(message.content);

src/components/help.ts

@@ -82,7 +82,7 @@ export default class Help extends BotComponent {
                     },
                 ),
         ];
-        if (this.wheatley.is_authorized_mod(command.user)) {
+        if (await this.wheatley.check_permissions(command.user, Discord.PermissionFlagsBits.ModerateMembers)) {
             embeds.push(
                 new Discord.EmbedBuilder().setColor(colors.wheatley).addFields(
                     {

src/components/moderation/kick.ts

@@ -30,7 +30,7 @@ export default class Kick extends ModerationComponent {
         await super.setup(commands);
         commands.add(
             new TextBasedCommandBuilder("kick", EarlyReplyMode.visible)
-                .set_permissions(Discord.PermissionFlagsBits.BanMembers)
+                .set_permissions(Discord.PermissionFlagsBits.KickMembers)
                 .set_description("Kick user")
                 .add_user_option({
                     title: "user",

src/components/moderation/massban.ts

@@ -26,7 +26,7 @@ export default class Massban extends BotComponent {
             }
             if (message.content.startsWith("!wban")) {
                 assert(message.member != null);
-                if (this.wheatley.is_authorized_mod(message.member)) {
+                if (await this.wheatley.check_permissions(message.member, Discord.PermissionFlagsBits.BanMembers)) {
                     await this.do_mass_ban(message);
                 } else {
                     await message.reply(`Unauthorized ${this.wheatley.emoji.access_denied}`);

src/components/moderation/moderation-common.ts

@@ -57,11 +57,11 @@ import { CommandSetBuilder } from "../../command-abstractions/command-set-builde
 
 export const duration_regex = /perm\b|(\d+)\s*([a-zA-Z]+)/;
 
-export const moderation_on_team_member_message: string = "Can't apply this moderation on team members";
-export const joke_responses = [
+export const joke_responses_other = ["You have no power over this user :(", "lol, nice try!", "One day, maybe ;)"];
+export const joke_responses_self = [
     "You won't get off that easy! ;)",
     "Try again next time lmao",
-    "Didn't work. Maybe a skill issue?",
+    "Didn't work. skill issue?",
 ];
 
 function millis_of_time_unit(u: string) {
@@ -564,14 +564,19 @@ export abstract class ModerationComponent extends BotComponent {
         basic_moderation_info: basic_moderation,
     ) {
         try {
-            if (this.wheatley.is_authorized_mod(user)) {
-                // Check if the mod is trying to ban themselves
-                if (basic_moderation_info.type == "ban" && command.user.id == user.id) {
-                    // If the mod is trying to ban themselves then troll them ;)
-                    await this.reply_with_error(command, unwrap(get_random_array_element(joke_responses)));
-                } else {
-                    await this.reply_with_error(command, moderation_on_team_member_message);
+            const target = await this.wheatley.try_fetch_guild_member(user);
+            const issuer = unwrap(await this.wheatley.try_fetch_guild_member(command.user));
+            if (target && target.roles.highest.position >= issuer.roles.highest.position) {
+                if (
+                    command.user.id == user.id &&
+                    (basic_moderation_info.type == "ban" || basic_moderation_info.type == "kick")
+                ) {
+                    // Mod is trying to ban/kick themselves => troll them ;)
+                    await this.reply_with_error(command, unwrap(get_random_array_element(joke_responses_self)));
+                    return;
                 }
+                // Mod is trying to ban/kick above their paygrade => troll them :D
+                await this.reply_with_error(command, unwrap(get_random_array_element(joke_responses_other)));
                 return;
             }
             const base_moderation: basic_moderation_with_user = { ...basic_moderation_info, user: user.id };
@@ -646,9 +651,11 @@ export abstract class ModerationComponent extends BotComponent {
         basic_moderation_info: basic_moderation,
     ) {
         try {
+            const issuer = unwrap(await this.wheatley.try_fetch_guild_member(command.user));
             for (const user of users) {
-                if (this.wheatley.is_authorized_mod(user)) {
-                    await this.reply_with_error(command, moderation_on_team_member_message);
+                const target = await this.wheatley.try_fetch_guild_member(user);
+                if (target && target.roles.highest.position >= issuer.roles.highest.position) {
+                    await this.reply_with_error(command, unwrap(get_random_array_element(joke_responses_other)));
                     continue;
                 }
                 const base_moderation: basic_moderation_with_user = { ...basic_moderation_info, user: user.id };

src/components/moderation/modlogs.ts

@@ -216,7 +216,9 @@ export default class Modlogs extends BotComponent {
     override async on_interaction_create(interaction: Discord.Interaction<Discord.CacheType>) {
         if (interaction.isButton()) {
             if (interaction.customId.startsWith("modlogs_page_")) {
-                if (!this.wheatley.is_authorized_mod(interaction.user)) {
+                if (
+                    !(await this.wheatley.check_permissions(interaction.user, Discord.PermissionFlagsBits.BanMembers))
+                ) {
                     await interaction.reply({
                         content: "Error: You are not authorized",
                         ephemeral: true,

src/components/moderation/modmail.ts

@@ -198,8 +198,7 @@ export default class Modmail extends BotComponent {
         });
         await this.log_action(interaction.member, "Monkey pressed the button");
         try {
-            // can't apply roles to root
-            if (!this.wheatley.is_root(interaction.user)) {
+            if ((await this.wheatley.try_fetch_guild_member(interaction.user))?.manageable) {
                 const member = await this.wheatley.guild.members.fetch(interaction.user.id);
                 await member.roles.add(this.wheatley.roles.monke);
                 this.monke_set.set(interaction.user.id, Date.now());
@@ -219,8 +218,7 @@ export default class Modmail extends BotComponent {
                     ephemeral: true,
                 });
                 try {
-                    // can't apply roles to root
-                    if (!this.wheatley.is_root(interaction.user)) {
+                    if ((await this.wheatley.try_fetch_guild_member(interaction.user))?.manageable) {
                         await member.roles.remove(this.wheatley.roles.monke);
                         this.monke_set.remove(member.id);
                     }

src/components/moderation/modstats.ts

@@ -23,7 +23,7 @@ export default class ModStats extends BotComponent {
         commands.add(
             new TextBasedCommandBuilder("modstats", EarlyReplyMode.none)
                 .set_description("Moderator stats")
-                .set_permissions(Discord.PermissionFlagsBits.BanMembers)
+                .set_permissions(Discord.PermissionFlagsBits.ModerateMembers)
                 .add_user_option({
                     title: "moderator",
                     description: "Moderator",
@@ -60,11 +60,7 @@ export default class ModStats extends BotComponent {
     }
 
     async modstats(command: TextBasedCommand, moderator: Discord.User | null) {
-        if (moderator && !(this.wheatley.is_authorized_mod(moderator) || moderator.id == this.wheatley.user.id)) {
-            await command.reply(`<@${moderator.id}> is not a moderator`);
-            return;
-        }
-        if (!this.wheatley.is_authorized_mod(command.user) && command.channel_id != this.bot_spam.id) {
+        if (command.channel_id != this.bot_spam.id) {
             await command.reply(`Please use in <#${this.bot_spam.id}>`, true);
             return;
         }

src/components/moderation/mute.ts

@@ -28,7 +28,7 @@ export default class Mute extends ModerationComponent {
         await super.setup(commands);
         commands.add(
             new TextBasedCommandBuilder("mute", EarlyReplyMode.visible)
-                .set_permissions(Discord.PermissionFlagsBits.BanMembers)
+                .set_permissions(Discord.PermissionFlagsBits.ModerateMembers)
                 .set_description("Mute user")
                 .add_user_option({
                     title: "user",

src/components/moderation/note.ts

@@ -29,7 +29,7 @@ export default class Note extends ModerationComponent {
         await super.setup(commands);
         commands.add(
             new TextBasedCommandBuilder("note", EarlyReplyMode.ephemeral)
-                .set_permissions(Discord.PermissionFlagsBits.BanMembers)
+                .set_permissions(Discord.PermissionFlagsBits.ModerateMembers)
                 .set_description("Enter note in modlogs")
                 .add_user_option({
                     title: "user",

src/components/moderation/purge.ts

@@ -163,7 +163,12 @@ export default class Purge extends BotComponent {
     override async on_interaction_create(interaction: Discord.Interaction) {
         if (interaction.isButton()) {
             if (interaction.customId.startsWith("abort_purge_")) {
-                if (!this.wheatley.is_authorized_mod(interaction.user)) {
+                if (
+                    !(await this.wheatley.check_permissions(
+                        interaction.user,
+                        Discord.PermissionFlagsBits.ManageMessages,
+                    ))
+                ) {
                     await interaction.reply({
                         content: "Error: You are not authorized",
                         ephemeral: true,

src/components/moderation/rolepersist.ts

@@ -28,7 +28,7 @@ export default class Rolepersist extends ModerationComponent {
     override async setup(commands: CommandSetBuilder) {
         commands.add(
             new TextBasedCommandBuilder("rolepersist", EarlyReplyMode.visible)
-                .set_permissions(Discord.PermissionFlagsBits.BanMembers)
+                .set_permissions(Discord.PermissionFlagsBits.ModerateMembers)
                 .set_description("Rolepersist add/remove")
                 .add_subcommand(
                     new TextBasedCommandBuilder("add", EarlyReplyMode.visible)
@@ -113,7 +113,7 @@ export default class Rolepersist extends ModerationComponent {
         for (const [command, role] of Object.entries(aliases)) {
             commands.add(
                 new TextBasedCommandBuilder(command, EarlyReplyMode.visible)
-                    .set_permissions(Discord.PermissionFlagsBits.BanMembers)
+                    .set_permissions(Discord.PermissionFlagsBits.ModerateMembers)
                     .set_description(`${capitalize(role).replace("_", " ")}`)
                     .add_user_option({
                         title: "user",

src/components/moderation/timeout.ts

@@ -26,7 +26,7 @@ export default class Timeout extends ModerationComponent {
         await super.setup(commands);
         commands.add(
             new TextBasedCommandBuilder("timeout", EarlyReplyMode.visible)
-                .set_permissions(Discord.PermissionFlagsBits.BanMembers)
+                .set_permissions(Discord.PermissionFlagsBits.ModerateMembers)
                 .set_description("Timeout add / remove")
                 .add_subcommand(
                     new TextBasedCommandBuilder("add", EarlyReplyMode.visible)

src/components/moderation/warn.ts

@@ -27,7 +27,7 @@ export default class Warn extends ModerationComponent {
         await super.setup(commands);
         commands.add(
             new TextBasedCommandBuilder("warn", EarlyReplyMode.visible)
-                .set_permissions(Discord.PermissionFlagsBits.BanMembers)
+                .set_permissions(Discord.PermissionFlagsBits.ModerateMembers)
                 .set_description("Warn user")
                 .add_user_option({
                     title: "user",

src/components/thread-control.ts

@@ -51,7 +51,10 @@ export default class ThreadControl extends BotComponent {
                 return true; // just let the user do it, should be fine
             }
             const owner_id = await this.get_owner(thread);
-            if (owner_id == request.user.id || this.wheatley.is_authorized_mod(request.user.id)) {
+            if (
+                owner_id == request.user.id ||
+                (await this.wheatley.check_permissions(request.user, Discord.PermissionFlagsBits.ManageThreads))
+            ) {
                 return true;
             } else {
                 await request.reply({

src/modules/tccpp/components/april1/buzzwords.ts

@@ -325,7 +325,7 @@ export default class Buzzwords extends BotComponent {
             return;
         }
         //if(message.channel.id != "1091502908241084436") return; // for now, for testing
-        if (this.wheatley.is_authorized_mod(message.author)) {
+        if (await this.wheatley.check_permissions(message.author, Discord.PermissionFlagsBits.ModerateMembers)) {
             if (message.content.trim().startsWith("!derailed")) {
                 const ids = message.content.match(/\d{10,}/g);
                 if (!ids || ids.length != 1) {

src/modules/tccpp/components/forum-control.ts

@@ -56,7 +56,10 @@ export default class ForumControl extends BotComponent {
         if (channel.isThread()) {
             const thread = channel;
             const owner_id = await this.get_owner(thread);
-            if (owner_id == request.user.id || this.wheatley.is_authorized_mod(request.user.id)) {
+            if (
+                owner_id == request.user.id ||
+                (await this.wheatley.check_permissions(request.user, Discord.PermissionFlagsBits.ManageThreads))
+            ) {
                 return true;
             } else {
                 await request.reply({

src/modules/tccpp/components/roulette.ts

@@ -110,7 +110,9 @@ export default class Roulette extends BotComponent {
                 this.streaks.set(command.user.id, 0);
                 await this.update_score(command.user.id); // TODO: I forget why this is here
                 try {
-                    if (this.wheatley.is_authorized_mod(command.user)) {
+                    if (
+                        await this.wheatley.check_permissions(command.user, Discord.PermissionFlagsBits.ModerateMembers)
+                    ) {
                         this.disabled_users.insert(command.user.id);
                     } else {
                         await (await command.get_member()).timeout(30 * MINUTE, "Bang");

src/modules/tccpp/components/server-suggestion-reactions.ts

@@ -41,7 +41,7 @@ export default class ServerSuggestionReactions extends BotComponent {
                     });
                     await reaction.users.remove(id);
                 } else if (root_only_reacts.has(reaction.emoji.name!)) {
-                    if (!this.wheatley.is_root(user)) {
+                    if (!(await this.wheatley.check_permissions(user.id, Discord.PermissionFlagsBits.Administrator))) {
                         M.log("removing non-root reaction", {
                             content: reaction.message.content,
                             reaction: reaction.emoji.name,
@@ -136,7 +136,7 @@ export default class ServerSuggestionReactions extends BotComponent {
                     reaction.users.remove(user.id).catch(this.wheatley.critical_error.bind(this.wheatley));
                 }, 5 * MINUTE);
             } else if (root_only_reacts.has(reaction.emoji.name!)) {
-                if (!this.wheatley.is_root(user)) {
+                if (!(await this.wheatley.check_permissions(user.id, Discord.PermissionFlagsBits.Administrator))) {
                     M.log("removing non-root reaction", {
                         content: reaction.message.content,
                         reaction: reaction.emoji.name,