Appは管理者/モデレータ権限を使えないように v11

mei23 · Dec 26, 2023 · 9cbbf55 · 9cbbf55
1 parent 0c2490d
commit 9cbbf55
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/src/server/api/call.ts b/src/server/api/call.ts
@@ -59,6 +59,14 @@ export default async (endpoint: string, user: User | null | undefined, app: App
 		});
 	}
 
+	if (app && ep.meta.requireAdmin) {
+		throw new ApiError(accessDenied, { reason: 'Apps cannot use admin privileges.' });
+	}
+
+	if (app && ep.meta.requireModerator) {
+		throw new ApiError(accessDenied, { reason: 'Apps cannot use moderator privileges.' });
+	}
+
 	if (ep.meta.requireCredential && ep.meta.limit && !user!.isAdmin && !user!.isModerator) {
 		// Rate limit
 		await limiter(ep, user!).catch(e => {

diff --git a/src/server/api/endpoints/meta.ts b/src/server/api/endpoints/meta.ts
@@ -92,7 +92,7 @@ export const meta = {
 	}
 };
 
-export default define(meta, async (ps, me) => {
+export default define(meta, async (ps, me, app) => {
 	const instance = await fetchMeta(true);
 
 	const emojis = await Emojis.find({
@@ -182,7 +182,7 @@ export default define(meta, async (ps, me) => {
 		};
 	}
 
-	if (me && (me.isAdmin)) {
+	if (me && me.isAdmin && !app) {
 		response.useStarForReactionFallback = instance.useStarForReactionFallback;
 		response.pinnedUsers = instance.pinnedUsers;
 		response.hiddenTags = instance.hiddenTags;