feat: Enhance FTP browsing permissions handling and improve error messages

Author: frasermolyneux

src/XtremeIdiots.Portal.Web/ApiControllers/FtpBrowseApiController.cs

@@ -2,13 +2,16 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using XtremeIdiots.Portal.Integrations.Servers.Api.Client.V1;
+using XtremeIdiots.Portal.Repository.Api.Client.V1;
 using XtremeIdiots.Portal.Web.Auth.Constants;
 
 namespace XtremeIdiots.Portal.Web.ApiControllers;
 
-[Authorize(Policy = AuthPolicies.GameServers_Credentials_Ftp_Write)]
+[Authorize]
 [Route("api/ftp")]
 public class FtpBrowseApiController(
+    IAuthorizationService authorizationService,
+    IRepositoryApiClient repositoryApiClient,
     IServersApiClient serversApiClient,
     TelemetryClient telemetryClient,
     ILogger<FtpBrowseApiController> logger,
@@ -19,6 +22,15 @@ public async Task<IActionResult> Browse(Guid gameServerId, [FromQuery] string? p
     {
         return await ExecuteWithErrorHandlingAsync(async () =>
         {
+            var gameServerResponse = await repositoryApiClient.GameServers.V1.GetGameServer(gameServerId).ConfigureAwait(false);
+            if (!gameServerResponse.IsSuccess || gameServerResponse.Result?.Data is null)
+                return Forbid();
+
+            var gameServer = gameServerResponse.Result.Data;
+            var authResult = await authorizationService.AuthorizeAsync(User, gameServer.GameType, AuthPolicies.GameServers_Credentials_Ftp_Write).ConfigureAwait(false);
+            if (!authResult.Succeeded)
+                return Forbid();
+
             var result = await serversApiClient.FtpBrowse.V1.BrowseDirectory(gameServerId, path).ConfigureAwait(false);
 
             if (!result.IsSuccess || result.Result?.Data == null)

src/XtremeIdiots.Portal.Web/wwwroot/js/ftp-browser.js

@@ -40,7 +40,10 @@
 
         fetch('/api/ftp/' + _gameServerId + '/browse?path=' + encodeURIComponent(path))
             .then(function (response) {
+                if (response.status === 403) throw new Error('You do not have permission to browse this server\'s files.');
                 if (!response.ok) throw new Error('Failed to browse directory (HTTP ' + response.status + ')');
+                var contentType = response.headers.get('content-type') || '';
+                if (!contentType.includes('application/json')) throw new Error('Unexpected response from server.');
                 return response.json();
             })
             .then(function (data) {