hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Require admin access for webhooks

Browse source
This commit is contained in:
Lain Soykaf 2026-05-26 14:32:51 +04:00
commit 27090ad7e6
No known key found for this signature in database
2 changed files with 23 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

18
lib/pleroma/web/router.ex
View file

@ -316,6 +316,15 @@ defmodule Pleroma.Web.Router do
post("/rules", RuleController, :create)
patch("/rules/:id", RuleController, :update)
delete("/rules/:id", RuleController, :delete)
get("/webhooks", WebhookController, :index)
get("/webhooks/:id", WebhookController, :show)
post("/webhooks", WebhookController, :create)
patch("/webhooks/:id", WebhookController, :update)
delete("/webhooks/:id", WebhookController, :delete)
post("/webhooks/:id/enable", WebhookController, :enable)
post("/webhooks/:id/disable", WebhookController, :disable)
post("/webhooks/:id/rotate_secret", WebhookController, :rotate_secret)
end
# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
@ -327,15 +336,6 @@ defmodule Pleroma.Web.Router do
get("/announcements/:id", AnnouncementController, :show)
patch("/announcements/:id", AnnouncementController, :change)
delete("/announcements/:id", AnnouncementController, :delete)
get("/webhooks", WebhookController, :index)
get("/webhooks/:id", WebhookController, :show)
post("/webhooks", WebhookController, :create)
patch("/webhooks/:id", WebhookController, :update)
delete("/webhooks/:id", WebhookController, :delete)
post("/webhooks/:id/enable", WebhookController, :enable)
post("/webhooks/:id/disable", WebhookController, :disable)
post("/webhooks/:id/rotate_secret", WebhookController, :rotate_secret)
end
# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)

15
test/pleroma/web/admin_api/controllers/webhook_controller_test.exs
View file

@ -3,7 +3,7 @@
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.AdminAPI.WebhookControllerTest do
use Pleroma.Web.ConnCase, async: true
use Pleroma.Web.ConnCase, async: false
import Pleroma.Factory
@ -33,6 +33,19 @@ defmodule Pleroma.Web.AdminAPI.WebhookControllerTest do
assert length(response) == 2
end
test "requires an admin even if a moderator can manage announcements" do
clear_config([:instance, :moderator_privileges], [:announcements_manage_announcements])
moderator = insert(:user, is_moderator: true)
token = insert(:oauth_admin_token, user: moderator)
build_conn()
|> assign(:user, moderator)
|> assign(:token, token)
|> get("/api/pleroma/admin/webhooks")
|> json_response(:forbidden)
end
end
describe "POST /api/pleroma/admin/webhooks" do