fix: scope admin configuration changes to the target configuration

Author: ahmedhamouda78

apps/discord-bot-frontend/src/lib/server/require-configuration-admin.ts

@@ -0,0 +1,20 @@
+import { getUserAccess } from '$lib/discord/get-user-access'
+
+/**
+ * Returns whether the given Discord user administers the specified configuration.
+ * A configuration's id is the Discord guild id, so access is resolved directly
+ * from the configuration id.
+ */
+export async function isConfigurationAdmin(
+  discordUserId: string | undefined,
+  configurationId: string | undefined
+): Promise<boolean> {
+  if (!discordUserId || !configurationId) return false
+  try {
+    const access = await getUserAccess(discordUserId, configurationId)
+    return access.isAdmin
+  } catch {
+    // no access when the membership lookup fails
+    return false
+  }
+}

apps/discord-bot-frontend/src/routes/api/admin/configure/+server.ts

@@ -2,10 +2,22 @@ import type { RequestHandler } from '@sveltejs/kit'
 import { json } from '@sveltejs/kit'
 import { prisma } from '$lib/db'
 import { ACCESS_LEVELS } from '$lib/constants'
+import { isConfigurationAdmin } from '$lib/server/require-configuration-admin'
 
-export const POST: RequestHandler = async ({ request }) => {
+export const POST: RequestHandler = async ({ request, locals }) => {
   const { id, name, adminRoles, staffRoles, contributorRoles } =
     await request.json()
+
+  // Ensure the caller administers the target configuration. Creating a new
+  // configuration remains available to a guild owner (getUserAccess falls back
+  // to owner status when no configuration exists yet).
+  if (!locals.session?.user) {
+    return new Response('Unauthorized', { status: 401 })
+  }
+  if (!(await isConfigurationAdmin(locals.session.user.discordUserId, id))) {
+    return new Response('Forbidden', { status: 403 })
+  }
+
   const record = await prisma.configuration.findUnique({
     where: { id },
     include: {
@@ -115,8 +127,17 @@ export const POST: RequestHandler = async ({ request }) => {
   }
 }
 
-export const DELETE: RequestHandler = async ({ request }) => {
+export const DELETE: RequestHandler = async ({ request, locals }) => {
   const { id } = await request.json()
+
+  // Ensure the caller administers the target configuration.
+  if (!locals.session?.user) {
+    return new Response('Unauthorized', { status: 401 })
+  }
+  if (!(await isConfigurationAdmin(locals.session.user.discordUserId, id))) {
+    return new Response('Forbidden', { status: 403 })
+  }
+
   return json(
     await prisma.configuration.delete({
       where: { id },

apps/discord-bot-frontend/src/routes/api/admin/feature/+server.ts

@@ -1,6 +1,7 @@
 import type { FEATURE_CODES } from '$lib/constants'
 import { type RequestHandler } from '@sveltejs/kit'
 import { prisma } from '$lib/db'
+import { isConfigurationAdmin } from '$lib/server/require-configuration-admin'
 
 type Payload = {
   /**
@@ -17,7 +18,7 @@ type Payload = {
   enabled: boolean
 }
 
-export const POST: RequestHandler = async ({ request }) => {
+export const POST: RequestHandler = async ({ request, locals }) => {
   let body: Payload
   try {
     /**
@@ -41,6 +42,19 @@ export const POST: RequestHandler = async ({ request }) => {
     return new Response('Invalid request', { status: 400 })
   }
 
+  // Ensure the caller administers the target configuration.
+  if (!locals.session?.user) {
+    return new Response('Unauthorized', { status: 401 })
+  }
+  if (
+    !(await isConfigurationAdmin(
+      locals.session.user.discordUserId,
+      configurationId
+    ))
+  ) {
+    return new Response('Forbidden', { status: 403 })
+  }
+
   try {
     const updated = await prisma.configuration.update({
       where: {