Allowing configuration endpoint access if user is configuration mod (#3936)

* showing error when fetch failed

* added function to only use an array of middlewares in production

* allowing patch configuration and get schema if user is a configuration mod

* fixed empty middleware not working as expected

backend/src/api/routes/configuration.ts

@@ -1,24 +1,39 @@
 import joi from "joi";
 import { Router } from "express";
-import { asyncHandler, validateRequest } from "../../middlewares/api-utils";
+import {
+  asyncHandler,
+  checkUserPermissions,
+  useInProduction,
+  validateRequest,
+} from "../../middlewares/api-utils";
 import * as ConfigurationController from "../controllers/configuration";
+import { authenticateRequest } from "../../middlewares/auth";
 
 const router = Router();
 
+const checkIfUserIsConfigurationMod = checkUserPermissions({
+  criteria: (user) => {
+    return !!user.configurationMod;
+  },
+});
+
 router.get("/", asyncHandler(ConfigurationController.getConfiguration));
 
-if (process.env.MODE === "dev") {
-  router.patch(
-    "/",
-    validateRequest({
-      body: {
-        configuration: joi.object(),
-      },
-    }),
-    asyncHandler(ConfigurationController.updateConfiguration)
-  );
+router.patch(
+  "/",
+  useInProduction([authenticateRequest(), checkIfUserIsConfigurationMod]),
+  validateRequest({
+    body: {
+      configuration: joi.object(),
+    },
+  }),
+  asyncHandler(ConfigurationController.updateConfiguration)
+);
 
-  router.get("/schema", asyncHandler(ConfigurationController.getSchema));
-}
+router.get(
+  "/schema",
+  useInProduction([authenticateRequest(), checkIfUserIsConfigurationMod]),
+  asyncHandler(ConfigurationController.getSchema)
+);
 
 export default router;

backend/src/middlewares/api-utils.ts

@@ -10,6 +10,12 @@ interface ValidationOptions<T> {
   invalidMessage?: string;
 }
 
+const emptyMiddleware = (
+  _req: MonkeyTypes.Request,
+  _res: Response,
+  next: NextFunction
+): void => next();
+
 /**
  * This utility checks that the server's configuration matches
  * the criteria.
@@ -140,9 +146,19 @@ function validateRequest(validationSchema: ValidationSchema): RequestHandler {
   };
 }
 
+/**
+ * Uses the middlewares only in production. Otherwise, uses an empty middleware.
+ */
+function useInProduction(middlewares: RequestHandler[]): RequestHandler[] {
+  return middlewares.map((middleware) =>
+    process.env.MODE === "dev" ? emptyMiddleware : middleware
+  );
+}
+
 export {
   validateConfiguration,
   checkUserPermissions,
   asyncHandler,
   validateRequest,
+  useInProduction,
 };

backend/src/types/types.d.ts

@@ -171,6 +171,7 @@ declare namespace MonkeyTypes {
     timeTyping?: number;
     uid: string;
     quoteMod?: boolean;
+    configurationMod?: boolean;
     cannotReport?: boolean;
     banned?: boolean;
     canManageApeKeys?: boolean;