diff --git a/lnbits/core/models/extensions.py b/lnbits/core/models/extensions.py index e2931d502..d808242af 100644 --- a/lnbits/core/models/extensions.py +++ b/lnbits/core/models/extensions.py @@ -597,9 +597,7 @@ class InstallableExtension(BaseModel): ) source_repo = f"{github_release.organisation}/{github_release.repository}" admin_only = github_release.admin_only or config.admin_only - super_user_only = ( - github_release.super_user_only or config.super_user_only - ) + super_user_only = github_release.super_user_only or config.super_user_only latest_extension_release = ExtensionRelease.from_github_release( source_repo, latest_release ) @@ -672,10 +670,8 @@ class InstallableExtension(BaseModel): min_lnbits_version=config_json.get("min_lnbits_version"), max_lnbits_version=config_json.get("max_lnbits_version"), admin_only=config_json.get("admin_only", False), - super_user_only=config_json.get( - "super_user_only", False - ), - ) + super_user_only=config_json.get("super_user_only", False), + ), ), ) diff --git a/lnbits/core/views/extension_api.py b/lnbits/core/views/extension_api.py index 603104b3c..263746e45 100644 --- a/lnbits/core/views/extension_api.py +++ b/lnbits/core/views/extension_api.py @@ -180,6 +180,19 @@ async def api_update_pay_to_enable( ) +def _check_enable_extension_access( + ext_id: str, ext: InstallableExtension, account_id: AccountId +) -> None: + if ext.is_super_user_only and not settings.is_super_user(account_id.id): + raise HTTPException( + HTTPStatus.FORBIDDEN, f"User not authorized for extension '{ext_id}'." + ) + if ext.is_admin_only and not settings.is_admin_user(account_id.id): + raise HTTPException( + HTTPStatus.FORBIDDEN, f"User not authorized for extension '{ext_id}'." + ) + + @extension_router.put("/{ext_id}/enable") async def api_enable_extension( ext_id: str, account_id: AccountId = Depends(check_account_id_exists) @@ -195,14 +208,7 @@ async def api_enable_extension( raise ValueError(f"Extension '{ext_id}' is not installed.") if not ext.active: raise ValueError(f"Extension '{ext_id}' is not activated.") - if ext.is_super_user_only and not settings.is_super_user(account_id.id): - raise HTTPException( - HTTPStatus.FORBIDDEN, f"User not authorized for extension '{ext_id}'." - ) - if ext.is_admin_only and not settings.is_admin_user(account_id.id): - raise HTTPException( - HTTPStatus.FORBIDDEN, f"User not authorized for extension '{ext_id}'." - ) + _check_enable_extension_access(ext_id, ext, account_id) user_ext = await get_user_extension(account_id.id, ext_id) if not user_ext: diff --git a/lnbits/templates/pages/extensions.vue b/lnbits/templates/pages/extensions.vue index 2eee2feec..9fced14e4 100644 --- a/lnbits/templates/pages/extensions.vue +++ b/lnbits/templates/pages/extensions.vue @@ -306,9 +306,7 @@ @click="disableExtension(extension)" :label="$t('disable')" > - + Super User Only diff --git a/tests/unit/test_decorators.py b/tests/unit/test_decorators.py index 08f3c9c4d..14db8e298 100644 --- a/tests/unit/test_decorators.py +++ b/tests/unit/test_decorators.py @@ -250,7 +250,9 @@ async def test_check_user_extension_access_honors_extension_metadata( admin_status = await check_user_extension_access(admin_user.id, admin_only_ext) assert admin_status.success is True - admin_super_status = await check_user_extension_access(admin_user.id, super_only_ext) + admin_super_status = await check_user_extension_access( + admin_user.id, super_only_ext + ) assert admin_super_status.success is False previous_super_user = settings.super_user