feat(commands): restrict maintenance mode to admins only

Akinator31 · Akinator31 · commit d4aeab4e3304 · 2025-12-12T08:55:04.000+01:00
diff --git a/rustmail/src/commands/status/common.rs b/rustmail/src/commands/status/common.rs
@@ -1,6 +1,6 @@
 use strum::EnumString;
 
-#[derive(EnumString)]
+#[derive(EnumString, PartialEq)]
 #[strum(serialize_all = "snake_case")]
 pub enum BotStatus {
     Online,
diff --git a/rustmail/src/commands/status/slash_command/status.rs b/rustmail/src/commands/status/slash_command/status.rs
@@ -1,19 +1,66 @@
 use crate::commands::status::BotStatus;
 use crate::commands::{BoxFuture, RegistrableCommand};
 use crate::config::Config;
-use crate::errors::ModmailResult;
+use crate::errors::{CommandError, ModmailError, ModmailResult};
 use crate::handlers::InteractionHandler;
 use crate::i18n::get_translated_message;
 use crate::utils::{MessageBuilder, defer_response};
 use serenity::FutureExt;
 use serenity::all::{
     ActivityData, CommandDataOptionValue, CommandInteraction, CommandOptionType, Context,
-    CreateCommand, CreateCommandOption, ResolvedOption,
+    CreateCommand, CreateCommandOption, Permissions, ResolvedOption,
 };
 use std::str::FromStr;
 use std::sync::Arc;
 use std::sync::atomic::Ordering;
 
+async fn is_interaction_user_admin_or_super_admin(
+    ctx: &Context,
+    command: &CommandInteraction,
+    config: &Config,
+) -> bool {
+    let user_id = command.user.id.get();
+
+    if config.bot.panel_super_admin_users.contains(&user_id) {
+        return true;
+    }
+
+    let guild_id = match command.guild_id {
+        Some(id) => id,
+        None => return false,
+    };
+
+    let member = match guild_id.member(&ctx.http, command.user.id).await {
+        Ok(m) => m,
+        Err(_) => return false,
+    };
+
+    if !config.bot.panel_super_admin_roles.is_empty() {
+        for role_id in &member.roles {
+            if config.bot.panel_super_admin_roles.contains(&role_id.get()) {
+                return true;
+            }
+        }
+    }
+
+    let guild = match guild_id.to_partial_guild(&ctx.http).await {
+        Ok(g) => g,
+        Err(_) => return false,
+    };
+
+    if guild.owner_id == command.user.id {
+        return true;
+    }
+
+    member.roles.iter().any(|role_id| {
+        guild
+            .roles
+            .get(role_id)
+            .map(|role| role.permissions.contains(Permissions::ADMINISTRATOR))
+            .unwrap_or(false)
+    })
+}
+
 pub struct StatusCommand;
 
 impl RegistrableCommand for StatusCommand {
@@ -136,6 +183,16 @@ impl RegistrableCommand for StatusCommand {
                 Err(_) => return Ok(()),
             };
 
+            if bot_status == BotStatus::Maintenance {
+                let is_allowed =
+                    is_interaction_user_admin_or_super_admin(&ctx, &command, &config).await;
+                if !is_allowed {
+                    return Err(ModmailError::Command(
+                        CommandError::MaintenanceModeNotAllowed,
+                    ));
+                }
+            }
+
             let message_key = match bot_status {
                 BotStatus::Online => {
                     handler.maintenance_mode.store(false, Ordering::Relaxed);
diff --git a/rustmail/src/commands/status/text_command/status.rs b/rustmail/src/commands/status/text_command/status.rs
@@ -4,11 +4,54 @@ use crate::errors::{CommandError, ModmailError, ModmailResult};
 use crate::handlers::GuildMessagesHandler;
 use crate::i18n::get_translated_message;
 use crate::utils::{MessageBuilder, extract_reply_content};
-use serenity::all::{ActivityData, Context, Message};
+use serenity::all::{ActivityData, Context, Message, Permissions};
 use std::str::FromStr;
 use std::sync::Arc;
 use std::sync::atomic::Ordering;
 
+async fn is_user_admin_or_super_admin(ctx: &Context, msg: &Message, config: &Config) -> bool {
+    let user_id = msg.author.id.get();
+
+    if config.bot.panel_super_admin_users.contains(&user_id) {
+        return true;
+    }
+
+    let guild_id = match msg.guild_id {
+        Some(id) => id,
+        None => return false,
+    };
+
+    let member = match guild_id.member(&ctx.http, msg.author.id).await {
+        Ok(m) => m,
+        Err(_) => return false,
+    };
+
+    if !config.bot.panel_super_admin_roles.is_empty() {
+        for role_id in &member.roles {
+            if config.bot.panel_super_admin_roles.contains(&role_id.get()) {
+                return true;
+            }
+        }
+    }
+
+    let guild = match guild_id.to_partial_guild(&ctx.http).await {
+        Ok(g) => g,
+        Err(_) => return false,
+    };
+
+    if guild.owner_id == msg.author.id {
+        return true;
+    }
+
+    member.roles.iter().any(|role_id| {
+        guild
+            .roles
+            .get(role_id)
+            .map(|role| role.permissions.contains(Permissions::ADMINISTRATOR))
+            .unwrap_or(false)
+    })
+}
+
 pub async fn status_command(
     ctx: Context,
     msg: Message,
@@ -25,6 +68,14 @@ pub async fn status_command(
         Err(_) => return Err(ModmailError::Command(CommandError::InvalidStatusValue)),
     };
 
+    if bot_status == BotStatus::Maintenance
+        && !is_user_admin_or_super_admin(&ctx, &msg, config).await
+    {
+        return Err(ModmailError::Command(
+            CommandError::MaintenanceModeNotAllowed,
+        ));
+    }
+
     let message_key = match bot_status {
         BotStatus::Online => {
             handler.maintenance_mode.store(false, Ordering::Relaxed);
diff --git a/rustmail/src/errors/dictionary.rs b/rustmail/src/errors/dictionary.rs
@@ -251,6 +251,9 @@ impl DictionaryManager {
                 }
                 CommandError::StatusIsMissing => ("status.status_is_missing".to_string(), None),
                 CommandError::InvalidStatusValue => ("status.invalid_status".to_string(), None),
+                CommandError::MaintenanceModeNotAllowed => {
+                    ("status.maintenance_not_allowed".to_string(), None)
+                }
                 _ => ("command.invalid_format".to_string(), None),
             },
             ModmailError::Thread(thread_err) => match thread_err {
diff --git a/rustmail/src/errors/types.rs b/rustmail/src/errors/types.rs
@@ -70,6 +70,7 @@ pub enum CommandError {
     SnippetContentTooLong,
     StatusIsMissing,
     InvalidStatusValue,
+    MaintenanceModeNotAllowed,
 }
 
 #[derive(Debug, Clone)]
@@ -186,6 +187,9 @@ impl fmt::Display for CommandError {
             }
             CommandError::StatusIsMissing => write!(f, "Status is missing"),
             CommandError::InvalidStatusValue => write!(f, "Invalid status value"),
+            CommandError::MaintenanceModeNotAllowed => {
+                write!(f, "Only admins can enable maintenance mode")
+            }
         }
     }
 }
diff --git a/rustmail/src/i18n/language/en.rs b/rustmail/src/i18n/language/en.rs
@@ -1806,6 +1806,10 @@ pub fn load_english_messages(dict: &mut ErrorDictionary) {
         "status.maintenance_mode_active_user".to_string(),
         DictionaryMessage::new("🔧 The support system is currently undergoing maintenance. Your message could not be processed. Please try again later."),
     );
+    dict.messages.insert(
+        "status.maintenance_not_allowed".to_string(),
+        DictionaryMessage::new("Only administrators can enable maintenance mode."),
+    );
     dict.messages.insert(
         "status.maintenance_activity".to_string(),
         DictionaryMessage::new("🔧 Maintenance in progress"),
diff --git a/rustmail/src/i18n/language/fr.rs b/rustmail/src/i18n/language/fr.rs
@@ -1821,6 +1821,10 @@ pub fn load_french_messages(dict: &mut ErrorDictionary) {
         "status.maintenance_mode_active_user".to_string(),
         DictionaryMessage::new("🔧 Le système de support est actuellement en maintenance. Votre message n'a pas pu être traité. Veuillez réessayer plus tard."),
     );
+    dict.messages.insert(
+        "status.maintenance_not_allowed".to_string(),
+        DictionaryMessage::new("Seuls les administrateurs peuvent activer le mode maintenance."),
+    );
     dict.messages.insert(
         "status.maintenance_activity".to_string(),
         DictionaryMessage::new("🔧 Maintenance en cours"),

Original file line number	Diff line number	Diff line change
`@@ -70,6 +70,7 @@ pub enum CommandError {`
`70`	`70`	`SnippetContentTooLong,`
`71`	`71`	`StatusIsMissing,`
`72`	`72`	`InvalidStatusValue,`
	`73`	`+ MaintenanceModeNotAllowed,`
`73`	`74`	`}`
`74`	`75`
`75`	`76`	`#[derive(Debug, Clone)]`
`@@ -186,6 +187,9 @@ impl fmt::Display for CommandError {`
`186`	`187`	`}`
`187`	`188`	`CommandError::StatusIsMissing => write!(f, "Status is missing"),`
`188`	`189`	`CommandError::InvalidStatusValue => write!(f, "Invalid status value"),`
	`190`	`+ CommandError::MaintenanceModeNotAllowed => {`
	`191`	`+ write!(f, "Only admins can enable maintenance mode")`
	`192`	`+ }`
`189`	`193`	`}`
`190`	`194`	`}`
`191`	`195`	`}`