From 739cd1ba90bc0411c7d4d48943f84f19db6aced2 Mon Sep 17 00:00:00 2001
From: Santo Cariotti <santo@dcariotti.me>
Date: Tue, 3 Sep 2024 12:36:24 +0200
Subject: Limit `users` query to admins only

---
 src/graphql/types/user.rs | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/graphql/types/user.rs b/src/graphql/types/user.rs
index 85f559e..69ffc38 100644
--- a/src/graphql/types/user.rs
+++ b/src/graphql/types/user.rs
@@ -57,7 +57,15 @@ pub async fn get_users<'ctx>(
     let auth: &Authentication = ctx.data().unwrap();
     match auth {
         Authentication::NotLogged => Err("Unauthorized".to_string()),
-        Authentication::Logged(_claims) => {
+        Authentication::Logged(claims) => {
+            let claim_user = find_user(client, claims.user_id)
+                .await
+                .expect("Should not be here");
+
+            if !claim_user.is_admin {
+                return Err("Unauthorized".to_string());
+            }
+
             let rows = client
                 .query(
                     "SELECT id, email, password, name, address, is_admin FROM users LIMIT $1 OFFSET $2",
-- 
cgit v1.2.3-18-g5258