Implement permission checks

1 files changed, 37 insertions, 14 deletions

diff --git a/app.py b/app.py
index 95d1025..7d93b4f 100644
--- a/app.py
+++ b/app.py
@@ -14,7 +14,7 @@ from flask import (
     g,
     flash,
 )
-from werkzeug.exceptions import HTTPException
+from werkzeug.exceptions import HTTPException, NotImplemented
 
 from captcha import Captcha
 from presets import GUEST_CAPTCHA, GUIDE_CAPTCHAS
@@ -68,16 +68,44 @@ def context_processor():
     return dict(has_captcha=has_captcha)
 
 
+@app.before_request
+def before_request():
+    if request.endpoint == "static":
+        return
+    db = get_db()
+    cur = db.cursor()
+    cur.execute("SELECT public FROM permit WHERE endpoint=?", (request.endpoint,))
+    public = cur.fetchone()
+    if public is None:
+        raise NotImplemented
+    match public[0]:
+        case 2:
+            return
+        case 1:
+            if "username" in session:
+                return
+            flash("You must be logged in to access this content.")
+            return redirect(url_for("guest_login"))
+        case 0:
+            if "username" in session:
+                cur = db.cursor()
+                cur.execute(
+                    "SELECT 1 FROM permit_override WHERE username=? AND endpoint=?",
+                    (session["username"], request.endpoint),
+                )
+                if cur.fetchone():
+                    return
+                flash("This content requires additional permissions to view.")
+            else:
+                flash("You must be logged in to access this content.")
+            return redirect(url_for("login"))
+        case _:
+            raise NotImplemented
+
+
 @app.errorhandler(HTTPException)
 def handle_bad_request(e):
-    if request.endpoint != "static":
-        # TODO: Create an actual error page.
-        if "username" not in session:
-            flash("Guest access is temporarily restricted. Please log in to continue.")
-            return redirect(url_for("login"))
-        flash(f"Error {e.code}: {e.name}")
-        flash("You have been redirected to the main page.")
-        return redirect(url_for("index"))
+    # TODO: Create an actual error page.
     return e
 
 
@@ -157,11 +185,6 @@ def logout():
 
 @app.route("/hyde")
 def hydematch():
-    if "username" not in session:
-        flash(
-            "The Drosera Springs Wrestling Database is only available to logged-in users."
-        )
-        return redirect(url_for("login"))
     db = get_db()
     cur = db.cursor()
     cur.execute("SELECT * FROM matches ORDER BY id DESC")