From 27090ad7e6042beeedb92ab151bbd2f418454198 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Tue, 26 May 2026 14:32:51 +0400
Subject: [PATCH] Require admin access for webhooks

---
 lib/pleroma/web/router.ex                      | 18 +++++++++---------
 .../controllers/webhook_controller_test.exs    | 15 ++++++++++++++-
 2 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index 4b1c4140b..1800c5ede 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -316,6 +316,15 @@ defmodule Pleroma.Web.Router do
     post("/rules", RuleController, :create)
     patch("/rules/:id", RuleController, :update)
     delete("/rules/:id", RuleController, :delete)
+
+    get("/webhooks", WebhookController, :index)
+    get("/webhooks/:id", WebhookController, :show)
+    post("/webhooks", WebhookController, :create)
+    patch("/webhooks/:id", WebhookController, :update)
+    delete("/webhooks/:id", WebhookController, :delete)
+    post("/webhooks/:id/enable", WebhookController, :enable)
+    post("/webhooks/:id/disable", WebhookController, :disable)
+    post("/webhooks/:id/rotate_secret", WebhookController, :rotate_secret)
   end
 
   # AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
@@ -327,15 +336,6 @@ defmodule Pleroma.Web.Router do
     get("/announcements/:id", AnnouncementController, :show)
     patch("/announcements/:id", AnnouncementController, :change)
     delete("/announcements/:id", AnnouncementController, :delete)
-
-    get("/webhooks", WebhookController, :index)
-    get("/webhooks/:id", WebhookController, :show)
-    post("/webhooks", WebhookController, :create)
-    patch("/webhooks/:id", WebhookController, :update)
-    delete("/webhooks/:id", WebhookController, :delete)
-    post("/webhooks/:id/enable", WebhookController, :enable)
-    post("/webhooks/:id/disable", WebhookController, :disable)
-    post("/webhooks/:id/rotate_secret", WebhookController, :rotate_secret)
   end
 
   # AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
diff --git a/test/pleroma/web/admin_api/controllers/webhook_controller_test.exs b/test/pleroma/web/admin_api/controllers/webhook_controller_test.exs
index 0e3b5311e..78edbf05a 100644
--- a/test/pleroma/web/admin_api/controllers/webhook_controller_test.exs
+++ b/test/pleroma/web/admin_api/controllers/webhook_controller_test.exs
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 
 defmodule Pleroma.Web.AdminAPI.WebhookControllerTest do
-  use Pleroma.Web.ConnCase, async: true
+  use Pleroma.Web.ConnCase, async: false
 
   import Pleroma.Factory
 
@@ -33,6 +33,19 @@ defmodule Pleroma.Web.AdminAPI.WebhookControllerTest do
 
       assert length(response) == 2
     end
+
+    test "requires an admin even if a moderator can manage announcements" do
+      clear_config([:instance, :moderator_privileges], [:announcements_manage_announcements])
+
+      moderator = insert(:user, is_moderator: true)
+      token = insert(:oauth_admin_token, user: moderator)
+
+      build_conn()
+      |> assign(:user, moderator)
+      |> assign(:token, token)
+      |> get("/api/pleroma/admin/webhooks")
+      |> json_response(:forbidden)
+    end
   end
 
   describe "POST /api/pleroma/admin/webhooks" do