diff --git "a/src/api/routes/applications/\043application_id/guilds/\043guild_id/commands/\043command_id/index.ts" "b/src/api/routes/applications/\043application_id/guilds/\043guild_id/commands/\043command_id/index.ts" index c041e18..c00835a 100644 --- "a/src/api/routes/applications/\043application_id/guilds/\043guild_id/commands/\043command_id/index.ts" +++ "b/src/api/routes/applications/\043application_id/guilds/\043guild_id/commands/\043command_id/index.ts" @@ -19,7 +19,7 @@ import { ApplicationCommandCreateSchema, ApplicationCommandSchema } from "@spacebar/schemas"; import { route } from "@spacebar/api"; import { Request, Response, Router } from "express"; -import { Application, ApplicationCommand, FieldErrors, Guild, Snowflake } from "@spacebar/util"; +import { Application, ApplicationCommand, FieldErrors, Guild, Member, Snowflake } from "@spacebar/util"; const router = Router({ mergeParams: true }); @@ -34,7 +34,12 @@ const guildExists = await Guild.exists({ where: { id: req.params.guild_id } }); if (!guildExists) { - res.status(404).send({ code: 404, message: "Unknown guild" }); + res.status(404).send({ code: 404, message: "Unknown Server" }); + return; + } + + if (!(await Member.exists({ where: { id: req.params.application_id, guild_id: req.params.guild_id } }))) { + res.status(401).send({ code: 401, message: "Missing Access" }); return; } @@ -64,7 +69,12 @@ const guildExists = await Guild.exists({ where: { id: req.params.guild_id } }); if (!guildExists) { - res.status(404).send({ code: 404, message: "Unknown guild" }); + res.status(404).send({ code: 404, message: "Unknown Server" }); + return; + } + + if (!(await Member.exists({ where: { id: req.params.application_id, guild_id: req.params.guild_id } }))) { + res.status(401).send({ code: 401, message: "Missing Access" }); return; } @@ -127,7 +137,12 @@ const guildExists = await Guild.exists({ where: { id: req.params.guild_id } }); if (!guildExists) { - res.status(404).send({ code: 404, message: "Unknown guild" }); + res.status(404).send({ code: 404, message: "Unknown Server" }); + return; + } + + if (!(await Member.exists({ where: { id: req.params.application_id, guild_id: req.params.guild_id } }))) { + res.status(401).send({ code: 401, message: "Missing Access" }); return; } diff --git "a/src/api/routes/applications/\043application_id/guilds/\043guild_id/commands/index.ts" "b/src/api/routes/applications/\043application_id/guilds/\043guild_id/commands/index.ts" index bb52198..38ec8b0 100644 --- "a/src/api/routes/applications/\043application_id/guilds/\043guild_id/commands/index.ts" +++ "b/src/api/routes/applications/\043application_id/guilds/\043guild_id/commands/index.ts" @@ -19,7 +19,7 @@ import { ApplicationCommandCreateSchema, ApplicationCommandSchema } from "@spacebar/schemas"; import { route } from "@spacebar/api"; import { Request, Response, Router } from "express"; -import { Application, ApplicationCommand, FieldErrors, Guild, Snowflake } from "@spacebar/util"; +import { Application, ApplicationCommand, FieldErrors, Guild, Member, Snowflake } from "@spacebar/util"; const router = Router({ mergeParams: true }); @@ -34,7 +34,12 @@ const guildExists = await Guild.exists({ where: { id: req.params.guild_id } }); if (!guildExists) { - res.status(404).send({ code: 404, message: "Unknown guild" }); + res.status(404).send({ code: 404, message: "Unknown Server" }); + return; + } + + if (!(await Member.exists({ where: { id: req.params.application_id, guild_id: req.params.guild_id } }))) { + res.status(401).send({ code: 401, message: "Missing Access" }); return; } @@ -58,7 +63,12 @@ const guildExists = await Guild.exists({ where: { id: req.params.guild_id } }); if (!guildExists) { - res.status(404).send({ code: 404, message: "Unknown guild" }); + res.status(404).send({ code: 404, message: "Unknown Server" }); + return; + } + + if (!(await Member.exists({ where: { id: req.params.application_id, guild_id: req.params.guild_id } }))) { + res.status(401).send({ code: 401, message: "Missing Access" }); return; } @@ -126,7 +136,12 @@ const guildExists = await Guild.exists({ where: { id: req.params.guild_id } }); if (!guildExists) { - res.status(404).send({ code: 404, message: "Unknown guild" }); + res.status(404).send({ code: 404, message: "Unknown Server" }); + return; + } + + if (!(await Member.exists({ where: { id: req.params.application_id, guild_id: req.params.guild_id } }))) { + res.status(401).send({ code: 401, message: "Missing Access" }); return; }