mirrors/lnbits-legend
1
0
Fork 0
mirror of https://github.com/lnbits/lnbits-legend.git synced 2025-02-23 14:40:47 +01:00
Code Issues Projects Releases Packages Wiki Activity

protect listing and deleteing user and wallets

Browse source
This commit is contained in:
Tiago vasconcelos 2022-05-11 16:30:15 +01:00
parent 2d5f30acfd
commit a0a2ecd424
2 changed files with 10 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
lnbits/extensions/usermanager/templates/usermanager/index.html
View file

@ -299,7 +299,7 @@
.request( .request(
'GET', 'GET',
'/usermanager/api/v1/users', '/usermanager/api/v1/users',
this.g.user.wallets[0].inkey this.g.user.wallets[0].adminkey
) )
.then(function (response) { .then(function (response) {
self.users = response.data.map(function (obj) { self.users = response.data.map(function (obj) {
@ -362,7 +362,7 @@
.request( .request(
'DELETE', 'DELETE',
'/usermanager/api/v1/users/' + userId, '/usermanager/api/v1/users/' + userId,
self.g.user.wallets[0].inkey self.g.user.wallets[0].adminkey
) )
.then(function (response) { .then(function (response) {
self.users = _.reject(self.users, function (obj) { self.users = _.reject(self.users, function (obj) {
@ -389,7 +389,7 @@
.request( .request(
'GET', 'GET',
'/usermanager/api/v1/wallets', '/usermanager/api/v1/wallets',
this.g.user.wallets[0].inkey this.g.user.wallets[0].adminkey
) )
.then(function (response) { .then(function (response) {
self.wallets = response.data.map(function (obj) { self.wallets = response.data.map(function (obj) {
@ -447,7 +447,7 @@
.request( .request(
'DELETE', 'DELETE',
'/usermanager/api/v1/wallets/' + userId, '/usermanager/api/v1/wallets/' + userId,
self.g.user.wallets[0].inkey self.g.user.wallets[0].adminkey
) )
.then(function (response) { .then(function (response) {
self.wallets = _.reject(self.wallets, function (obj) { self.wallets = _.reject(self.wallets, function (obj) {

12
lnbits/extensions/usermanager/views_api.py
View file

@ -6,7 +6,7 @@ from starlette.exceptions import HTTPException
from lnbits.core import update_user_extension from lnbits.core import update_user_extension
from lnbits.core.crud import get_user from lnbits.core.crud import get_user
from lnbits.decorators import WalletTypeInfo, get_key_type from lnbits.decorators import WalletTypeInfo, get_key_type, require_admin_key
from . import usermanager_ext from . import usermanager_ext
from .crud import ( from .crud import (
@ -27,7 +27,7 @@ from .models import CreateUserData, CreateUserWallet
@usermanager_ext.get("/api/v1/users", status_code=HTTPStatus.OK) @usermanager_ext.get("/api/v1/users", status_code=HTTPStatus.OK)
async def api_usermanager_users(wallet: WalletTypeInfo = Depends(get_key_type)): async def api_usermanager_users(wallet: WalletTypeInfo = Depends(require_admin_key)):
user_id = wallet.wallet.user user_id = wallet.wallet.user
return [user.dict() for user in await get_usermanager_users(user_id)] return [user.dict() for user in await get_usermanager_users(user_id)]
@ -52,7 +52,7 @@ async def api_usermanager_users_create(
@usermanager_ext.delete("/api/v1/users/{user_id}") @usermanager_ext.delete("/api/v1/users/{user_id}")
async def api_usermanager_users_delete( async def api_usermanager_users_delete(
user_id, wallet: WalletTypeInfo = Depends(get_key_type) user_id, wallet: WalletTypeInfo = Depends(require_admin_key)
): ):
user = await get_usermanager_user(user_id) user = await get_usermanager_user(user_id)
if not user: if not user:
@ -93,7 +93,7 @@ async def api_usermanager_wallets_create(
@usermanager_ext.get("/api/v1/wallets") @usermanager_ext.get("/api/v1/wallets")
async def api_usermanager_wallets(wallet: WalletTypeInfo = Depends(get_key_type)): async def api_usermanager_wallets(wallet: WalletTypeInfo = Depends(require_admin_key)):
admin_id = wallet.wallet.user admin_id = wallet.wallet.user
return [wallet.dict() for wallet in await get_usermanager_wallets(admin_id)] return [wallet.dict() for wallet in await get_usermanager_wallets(admin_id)]
@ -107,7 +107,7 @@ async def api_usermanager_wallet_transactions(
@usermanager_ext.get("/api/v1/wallets/{user_id}") @usermanager_ext.get("/api/v1/wallets/{user_id}")
async def api_usermanager_users_wallets( async def api_usermanager_users_wallets(
user_id, wallet: WalletTypeInfo = Depends(get_key_type) user_id, wallet: WalletTypeInfo = Depends(require_admin_key)
): ):
return [ return [
s_wallet.dict() for s_wallet in await get_usermanager_users_wallets(user_id) s_wallet.dict() for s_wallet in await get_usermanager_users_wallets(user_id)
@ -116,7 +116,7 @@ async def api_usermanager_users_wallets(
@usermanager_ext.delete("/api/v1/wallets/{wallet_id}") @usermanager_ext.delete("/api/v1/wallets/{wallet_id}")
async def api_usermanager_wallets_delete( async def api_usermanager_wallets_delete(
wallet_id, wallet: WalletTypeInfo = Depends(get_key_type) wallet_id, wallet: WalletTypeInfo = Depends(require_admin_key)
): ):
get_wallet = await get_usermanager_wallet(wallet_id) get_wallet = await get_usermanager_wallet(wallet_id)
if not get_wallet: if not get_wallet: