feat(panel): add all permissions to admin section on panel

Akinator31 · Akinator31 · commit 5ca9f9a89f22 · 2025-12-01T15:06:13.000+01:00
diff --git a/rustmail/src/api/utils/panel_permissions.rs b/rustmail/src/api/utils/panel_permissions.rs
@@ -4,8 +4,7 @@ use serenity::all::{GuildId, Http, UserId};
 use sqlx::{Pool, Row, Sqlite, query};
 use std::sync::Arc;
 
-pub fn get_panel_permissions_cache(
-) -> Arc<moka::future::Cache<String, Vec<PanelPermission>>> {
+pub fn get_panel_permissions_cache() -> Arc<moka::future::Cache<String, Vec<PanelPermission>>> {
     use std::sync::OnceLock;
     static CACHE: OnceLock<Arc<moka::future::Cache<String, Vec<PanelPermission>>>> =
         OnceLock::new();
@@ -41,11 +40,7 @@ pub async fn is_super_admin(
 
         if let Ok(member) = guild_id_obj.member(bot_http, user_id_obj).await {
             for role_id in &member.roles {
-                if config
-                    .bot
-                    .panel_super_admin_roles
-                    .contains(&role_id.get())
-                {
+                if config.bot.panel_super_admin_roles.contains(&role_id.get()) {
                     return true;
                 }
             }
@@ -78,9 +73,7 @@ pub async fn get_user_panel_permissions(
             PanelPermission::ManageApiKeys,
             PanelPermission::ManagePermissions,
         ];
-        cache
-            .insert(user_id.to_string(), permissions.clone())
-            .await;
+        cache.insert(user_id.to_string(), permissions.clone()).await;
         return permissions;
     }
 
@@ -90,6 +83,8 @@ pub async fn get_user_panel_permissions(
             PanelPermission::ManageBot,
             PanelPermission::ManageConfig,
             PanelPermission::ManageTickets,
+            PanelPermission::ManageApiKeys,
+            PanelPermission::ManagePermissions,
         ];
     }
 
@@ -114,16 +109,33 @@ pub async fn get_user_panel_permissions(
     let user_id_num = match user_id.parse::<u64>() {
         Ok(id) => id,
         Err(_) => {
-            cache
-                .insert(user_id.to_string(), permissions.clone())
-                .await;
+            cache.insert(user_id.to_string(), permissions.clone()).await;
             return permissions;
         }
     };
 
     let guild_id_obj = GuildId::new(guild_id);
     let user_id_obj = UserId::new(user_id_num);
 
+    let everyone_role_id = guild_id.to_string();
+    if let Ok(rows) = query(
+        "SELECT permission FROM panel_permissions WHERE subject_type = 'role' AND subject_id = ?",
+    )
+    .bind(&everyone_role_id)
+    .fetch_all(db_pool)
+    .await
+    {
+        for row in rows {
+            if let Ok(perm_str) = row.try_get::<String, _>("permission") {
+                if let Some(perm) = PanelPermission::from_str(&perm_str) {
+                    if !permissions.contains(&perm) {
+                        permissions.push(perm);
+                    }
+                }
+            }
+        }
+    }
+
     if let Ok(member) = guild_id_obj.member(bot_http, user_id_obj).await {
         for role_id in &member.roles {
             let role_id_str = role_id.get().to_string();
@@ -147,9 +159,7 @@ pub async fn get_user_panel_permissions(
         }
     }
 
-    cache
-        .insert(user_id.to_string(), permissions.clone())
-        .await;
+    cache.insert(user_id.to_string(), permissions.clone()).await;
     permissions
 }
 
diff --git a/rustmail_panel/src/components/api_keys.rs b/rustmail_panel/src/components/api_keys.rs
@@ -1,3 +1,5 @@
+use crate::components::forbidden::Forbidden403;
+use crate::types::PanelPermission;
 use gloo_net::http::Request;
 use serde::{Deserialize, Serialize};
 use wasm_bindgen_futures::spawn_local;
@@ -79,6 +81,35 @@ pub fn api_keys_page() -> Html {
     let show_create_modal = use_state(|| false);
     let created_key = use_state(|| None::<String>);
 
+    let permissions = use_state(|| None::<Vec<PanelPermission>>);
+    {
+        let permissions = permissions.clone();
+        use_effect_with((), move |_| {
+            spawn_local(async move {
+                if let Ok(resp) = Request::get("/api/user/permissions").send().await {
+                    if let Ok(perms) = resp.json::<Vec<PanelPermission>>().await {
+                        permissions.set(Some(perms));
+                    }
+                }
+            });
+            || ()
+        });
+    }
+
+    if let Some(perms) = (*permissions).as_ref() {
+        if !perms.contains(&PanelPermission::ManageApiKeys) {
+            return html! {
+                <Forbidden403 required_permission="Gérer les clés API" />
+            };
+        }
+    } else {
+        return html! {
+            <div class="flex items-center justify-center min-h-[70vh]">
+                <div class="text-gray-400 animate-pulse">{"Vérification des permissions..."}</div>
+            </div>
+        };
+    }
+
     {
         let api_keys = api_keys.clone();
         let loading = loading.clone();
diff --git a/rustmail_panel/src/components/configuration.rs b/rustmail_panel/src/components/configuration.rs
@@ -1,3 +1,5 @@
+use crate::components::forbidden::Forbidden403;
+use crate::types::PanelPermission;
 use gloo_net::http::Request;
 use i18nrs::yew::use_translation;
 use wasm_bindgen_futures::spawn_local;
@@ -18,6 +20,35 @@ pub fn configuration_page() -> Html {
 
     let expanded_sections = use_state(|| vec![true, false, false, false, false, false, false, false]);
 
+    let permissions = use_state(|| None::<Vec<PanelPermission>>);
+    {
+        let permissions = permissions.clone();
+        use_effect_with((), move |_| {
+            spawn_local(async move {
+                if let Ok(resp) = Request::get("/api/user/permissions").send().await {
+                    if let Ok(perms) = resp.json::<Vec<PanelPermission>>().await {
+                        permissions.set(Some(perms));
+                    }
+                }
+            });
+            || ()
+        });
+    }
+
+    if let Some(perms) = (*permissions).as_ref() {
+        if !perms.contains(&PanelPermission::ManageConfig) {
+            return html! {
+                <Forbidden403 required_permission="Gérer la configuration" />
+            };
+        }
+    } else {
+        return html! {
+            <div class="flex items-center justify-center min-h-[70vh]">
+                <div class="text-gray-400 animate-pulse">{"Vérification des permissions..."}</div>
+            </div>
+        };
+    }
+
     {
         let bot_status = bot_status.clone();
         let is_loading = is_loading.clone();
diff --git a/rustmail_panel/src/components/forbidden.rs b/rustmail_panel/src/components/forbidden.rs
@@ -0,0 +1,59 @@
+use crate::pages::panel::PanelRoute;
+use yew::prelude::*;
+use yew_router::prelude::*;
+
+#[derive(Properties, PartialEq)]
+pub struct Forbidden403Props {
+    pub required_permission: String,
+}
+
+#[function_component(Forbidden403)]
+pub fn forbidden_403(props: &Forbidden403Props) -> Html {
+    let navigator = use_navigator().unwrap();
+
+    let go_home = {
+        let navigator = navigator.clone();
+        Callback::from(move |_| {
+            navigator.push(&PanelRoute::Home);
+        })
+    };
+
+    html! {
+        <div class="flex flex-col items-center justify-center min-h-[calc(100vh-12rem)] px-4">
+            <div class="max-w-md w-full bg-gradient-to-br from-slate-800 to-slate-900 rounded-xl shadow-2xl p-8 border border-slate-700 text-center">
+                <div class="flex justify-center mb-6">
+                    <div class="bg-red-500/10 p-4 rounded-full">
+                        <svg class="w-16 h-16 text-red-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"></path>
+                        </svg>
+                    </div>
+                </div>
+
+                <h1 class="text-3xl font-bold text-white mb-3">{"Accès refusé"}</h1>
+
+                <p class="text-gray-400 mb-2">
+                    {"Vous n'avez pas la permission nécessaire pour accéder à cette page."}
+                </p>
+
+                <div class="bg-slate-900/50 border border-slate-700 rounded-lg p-4 mb-6">
+                    <p class="text-sm text-gray-500 mb-1">{"Permission requise :"}</p>
+                    <p class="text-lg font-semibold text-red-400">{&props.required_permission}</p>
+                </div>
+
+                <p class="text-sm text-gray-500 mb-6">
+                    {"Contactez un administrateur si vous pensez que vous devriez avoir accès à cette section."}
+                </p>
+
+                <button
+                    onclick={go_home}
+                    class="w-full px-6 py-3 bg-gradient-to-r from-blue-600 to-blue-700 hover:from-blue-700 hover:to-blue-800 text-white font-semibold rounded-lg transition-all duration-200 shadow-lg hover:shadow-xl flex items-center justify-center space-x-2"
+                >
+                    <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M3 12l2-2m0 0l7-7 7 7M5 10v10a1 1 0 001 1h3m10-11l2 2m-2-2v10a1 1 0 01-1 1h-3m-6 0a1 1 0 001-1v-4a1 1 0 011-1h2a1 1 0 011 1v4a1 1 0 001 1m-6 0h6"></path>
+                    </svg>
+                    <span>{"Retour à l'accueil"}</span>
+                </button>
+            </div>
+        </div>
+    }
+}
diff --git a/rustmail_panel/src/components/mod.rs b/rustmail_panel/src/components/mod.rs
@@ -1,5 +1,6 @@
 pub mod api_keys;
 pub mod configuration;
+pub mod forbidden;
 pub mod home;
 pub mod language_switcher;
 pub mod logout_button;
diff --git a/rustmail_panel/src/components/ticket.rs b/rustmail_panel/src/components/ticket.rs
@@ -1,3 +1,5 @@
+use crate::components::forbidden::Forbidden403;
+use crate::types::PanelPermission;
 use crate::utils::markdown::markdown_to_html_safe;
 use gloo_net::http::Request;
 use i18nrs::yew::use_translation;
@@ -128,6 +130,35 @@ pub fn tickets_list() -> Html {
     let total_pages = use_state(|| 1i64);
     let total_tickets = use_state(|| 0i64);
 
+    let permissions = use_state(|| None::<Vec<PanelPermission>>);
+    {
+        let permissions = permissions.clone();
+        use_effect_with((), move |_| {
+            spawn_local(async move {
+                if let Ok(resp) = Request::get("/api/user/permissions").send().await {
+                    if let Ok(perms) = resp.json::<Vec<PanelPermission>>().await {
+                        permissions.set(Some(perms));
+                    }
+                }
+            });
+            || ()
+        });
+    }
+
+    if let Some(perms) = (*permissions).as_ref() {
+        if !perms.contains(&PanelPermission::ManageTickets) {
+            return html! {
+                <Forbidden403 required_permission="Gérer les tickets" />
+            };
+        }
+    } else {
+        return html! {
+            <div class="flex items-center justify-center min-h-[70vh]">
+                <div class="text-gray-400 animate-pulse">{"Vérification des permissions..."}</div>
+            </div>
+        };
+    }
+
     {
         let current_page = current_page.clone();
         let page_size = page_size.clone();
@@ -473,6 +504,35 @@ pub fn ticket_details(props: &TicketDetailsProps) -> Html {
     let show_system = use_state(|| true);
     let search_query = use_state(|| String::new());
 
+    let permissions = use_state(|| None::<Vec<PanelPermission>>);
+    {
+        let permissions = permissions.clone();
+        use_effect_with((), move |_| {
+            spawn_local(async move {
+                if let Ok(resp) = Request::get("/api/user/permissions").send().await {
+                    if let Ok(perms) = resp.json::<Vec<PanelPermission>>().await {
+                        permissions.set(Some(perms));
+                    }
+                }
+            });
+            || ()
+        });
+    }
+
+    if let Some(perms) = (*permissions).as_ref() {
+        if !perms.contains(&PanelPermission::ManageTickets) {
+            return html! {
+                <Forbidden403 required_permission="Gérer les tickets" />
+            };
+        }
+    } else {
+        return html! {
+            <div class="flex items-center justify-center min-h-[70vh]">
+                <div class="text-gray-400 animate-pulse">{"Vérification des permissions..."}</div>
+            </div>
+        };
+    }
+
     {
         let id = props.id.clone();
         let ticket = ticket.clone();
diff --git a/rustmail_panel/src/pages/administration.rs b/rustmail_panel/src/pages/administration.rs
diff --git a/rustmail_panel/src/pages/panel.rs b/rustmail_panel/src/pages/panel.rs
