Restrict deletion to deleting your own messages.

2 files changed, 39 insertions, 7 deletions

diff --git a/src/message/routes/message/mod.rs b/src/message/routes/message/mod.rs
index 45a7e9d..e92f556 100644
--- a/src/message/routes/message/mod.rs
+++ b/src/message/routes/message/mod.rs
@@ -20,9 +20,11 @@ pub mod delete {
         State(app): State<App>,
         Path(message): Path<message::Id>,
         RequestedAt(deleted_at): RequestedAt,
-        _: Identity,
+        identity: Identity,
     ) -> Result<Response, Error> {
-        app.messages().delete(&message, &deleted_at).await?;
+        app.messages()
+            .delete(&identity.login, &message, &deleted_at)
+            .await?;
 
         Ok(Response { id: message })
     }
@@ -47,6 +49,9 @@ pub mod delete {
             let Self(error) = self;
             #[allow(clippy::match_wildcard_for_single_variants)]
             match error {
+                DeleteError::NotSender(_) => {
+                    (StatusCode::FORBIDDEN, error.to_string()).into_response()
+                }
                 DeleteError::NotFound(_) | DeleteError::Deleted(_) => {
                     NotFound(error).into_response()
                 }
diff --git a/src/message/routes/message/test.rs b/src/message/routes/message/test.rs
index ae89506..5178ab5 100644
--- a/src/message/routes/message/test.rs
+++ b/src/message/routes/message/test.rs
@@ -8,18 +8,17 @@ pub async fn delete_message() {
     // Set up the environment
 
     let app = fixtures::scratch_app().await;
-    let sender = fixtures::login::create(&app, &fixtures::now()).await;
+    let sender = fixtures::identity::create(&app, &fixtures::now()).await;
     let channel = fixtures::channel::create(&app, &fixtures::now()).await;
-    let message = fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await;
+    let message = fixtures::message::send(&app, &channel, &sender.login, &fixtures::now()).await;
 
     // Send the request
 
-    let deleter = fixtures::identity::create(&app, &fixtures::now()).await;
     let response = delete::handler(
         State(app.clone()),
         Path(message.id.clone()),
         fixtures::now(),
-        deleter,
+        sender,
     )
     .await
     .expect("deleting a valid message succeeds");
@@ -68,7 +67,7 @@ pub async fn delete_deleted() {
     let message = fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await;
 
     app.messages()
-        .delete(&message.id, &fixtures::now())
+        .delete(&sender, &message.id, &fixtures::now())
         .await
         .expect("deleting a recently-sent message succeeds");
 
@@ -155,3 +154,31 @@ pub async fn delete_purged() {
 
     assert!(matches!(error, app::DeleteError::NotFound(id) if id == message.id));
 }
+
+#[tokio::test]
+pub async fn delete_not_sender() {
+    // Set up the environment
+
+    let app = fixtures::scratch_app().await;
+    let sender = fixtures::login::create(&app, &fixtures::now()).await;
+    let channel = fixtures::channel::create(&app, &fixtures::now()).await;
+    let message = fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await;
+
+    // Send the request
+
+    let deleter = fixtures::identity::create(&app, &fixtures::now()).await;
+    let delete::Error(error) = delete::handler(
+        State(app.clone()),
+        Path(message.id.clone()),
+        fixtures::now(),
+        deleter.clone(),
+    )
+    .await
+    .expect_err("deleting a message someone else sent fails");
+
+    // Verify the response
+
+    assert!(
+        matches!(error, app::DeleteError::NotSender(error_sender) if deleter.login == error_sender)
+    );
+}