From e1fccd2a66382f7a942a6d76d8ed1b3bb84cb745 Mon Sep 17 00:00:00 2001
From: hippoz <10706925-hippoz@users.noreply.gitlab.com>
Date: Thu, 4 Aug 2022 04:51:09 +0300
Subject: [PATCH] hide "add channel" button if the user cant create channels +
 public user object now shows permissions

---
 frontend/src/components/Sidebar.svelte | 14 ++++++++------
 src/auth.ts                            |  9 ++++++++-
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/frontend/src/components/Sidebar.svelte b/frontend/src/components/Sidebar.svelte
index 3aa6511..579a246 100644
--- a/frontend/src/components/Sidebar.svelte
+++ b/frontend/src/components/Sidebar.svelte
@@ -49,12 +49,14 @@
                 {/if}
             </button>
         {/each}
-        <button on:click="{ () => overlayStore.open('createChannel') }" class="sidebar-button">
-            <div>
-                <PlusIcon />
-            </div>
-            <span>Create Channel</span>
-        </button>
+        {#if $userInfoStore && $userInfoStore.permissions.create_channel}
+            <button on:click="{ () => overlayStore.open('createChannel') }" class="sidebar-button">
+                <div>
+                    <PlusIcon />
+                </div>
+                <span>Create Channel</span>
+            </button>
+        {/if}
         <button on:click="{ () => overlayStore.open('settings') }" class="sidebar-button">
             <div>
                 <SettingsIcon />
diff --git a/src/auth.ts b/src/auth.ts
index a8cace2..46318d6 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -2,6 +2,7 @@ import { NextFunction, Request, Response } from "express";
 import { JwtPayload, sign, verify } from "jsonwebtoken";
 import { query } from "./database";
 import { errors } from "./errors";
+import serverConfig from "./serverconfig";
 
 const jwtSecret = process.env.JWT_SECRET || "[generic token]";
 
@@ -15,8 +16,14 @@ if (jwtSecret === "[generic token]") {
     process.exit(1);
 }
 
+export function getUserPermissions(user: User) {
+    return {
+        create_channel: serverConfig.superuserRequirement.createChannel ? user.is_superuser : true
+    };
+}
+
 export function getPublicUserObject(user: User) {
-    const newUser = { ...user };
+    const newUser = { ...user, permissions: getUserPermissions(user) };
     newUser.password = undefined;
     delete newUser.password;