diff options
Diffstat (limited to 'src/routes/user.rs')
| -rw-r--r-- | src/routes/user.rs | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/src/routes/user.rs b/src/routes/user.rs index 4b76423..31366a0 100644 --- a/src/routes/user.rs +++ b/src/routes/user.rs @@ -142,10 +142,11 @@ async fn get_user(Path(user_id): Path<i32>) -> Result<Json<UserList>, AppError> } /// Edit an user with id = `user_id`. Only staffers and owner of that account can perform this -/// action +/// action. +/// Only staffers can update the user `is_staff` value async fn edit_user( Path(user_id): Path<i32>, - Json(payload): Json<UserEdit>, + Json(mut payload): Json<UserEdit>, claims: Claims, ) -> Result<Json<UserList>, AppError> { let mut user = match User::find_by_id(user_id).await { @@ -168,6 +169,10 @@ async fn edit_user( } } + if !claimed.is_staff.unwrap() && user.is_staff != payload.is_staff { + payload.is_staff = user.is_staff; + } + if user.email != payload.email && User::email_has_taken(&payload.email).await? { return Err(AppError::BadRequest( "An user with this email already exists".to_string(), |