feat: [#615] authorization layer implemented for the get torrent meth…

…od of the torrent service
torrust · Aug 3, 2024 · 7bb6ff7 · 7bb6ff7
1 parent b5171bf
commit 7bb6ff7
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/src/services/authorization.rs b/src/services/authorization.rs
@@ -45,6 +45,7 @@ pub enum ACTION {
     GetLicensePage,
     GetImageByUrl,
     GetPublicSettings,
+    GetTorrent,
     AddTorrent,
 }
 
@@ -185,17 +186,20 @@ impl CasbinConfiguration {
                 admin, DeleteTorrent
                 admin, BanUser
                 admin, GetImageByUrl
+                admin, GetTorrent
                 admin, AddTorrent
                 registered, GetCategories
                 registered, GetImageByUrl
                 registered, GetPublicSettings
                 registered, GetTags
+                registered, GetTorrent
                 registered, AddTorrent
                 guest, GetCategories
                 guest, GetTags
                 guest, GetAboutPage
                 guest, GetLicensePage
                 guest, GetPublicSettings
+                guest, GetTorrent
                 ",
             ),
         }

diff --git a/src/services/torrent.rs b/src/services/torrent.rs
@@ -263,6 +263,8 @@ impl Index {
     /// This function will return an error if unable to get the torrent from the
     /// database.
     pub async fn get_torrent(&self, info_hash: &InfoHash, opt_user_id: Option<UserId>) -> Result<Torrent, ServiceError> {
+        self.authorization_service.authorize(ACTION::GetTorrent, opt_user_id).await?;
+
         let mut torrent = self.torrent_repository.get_by_info_hash(info_hash).await?;
 
         let tracker_url = self.get_tracker_url().await;