make

lnbits/core/models/extensions.py

@@ -597,9 +597,7 @@ class InstallableExtension(BaseModel):
             )
             source_repo = f"{github_release.organisation}/{github_release.repository}"
             admin_only = github_release.admin_only or config.admin_only
-            super_user_only = (
+            super_user_only = github_release.super_user_only or config.super_user_only
-                github_release.super_user_only or config.super_user_only
-            )
             latest_extension_release = ExtensionRelease.from_github_release(
                 source_repo, latest_release
             )
@@ -672,10 +670,8 @@ class InstallableExtension(BaseModel):
                             min_lnbits_version=config_json.get("min_lnbits_version"),
                             max_lnbits_version=config_json.get("max_lnbits_version"),
                             admin_only=config_json.get("admin_only", False),
-                            super_user_only=config_json.get(
+                            super_user_only=config_json.get("super_user_only", False),
-                                "super_user_only", False
+                        ),
-                            ),
-                        )
                     ),
                 )
 

lnbits/core/views/extension_api.py

@@ -180,6 +180,19 @@ async def api_update_pay_to_enable(
     )
 
 
+def _check_enable_extension_access(
+    ext_id: str, ext: InstallableExtension, account_id: AccountId
+) -> None:
+    if ext.is_super_user_only and not settings.is_super_user(account_id.id):
+        raise HTTPException(
+            HTTPStatus.FORBIDDEN, f"User not authorized for extension '{ext_id}'."
+        )
+    if ext.is_admin_only and not settings.is_admin_user(account_id.id):
+        raise HTTPException(
+            HTTPStatus.FORBIDDEN, f"User not authorized for extension '{ext_id}'."
+        )
+
+
 @extension_router.put("/{ext_id}/enable")
 async def api_enable_extension(
     ext_id: str, account_id: AccountId = Depends(check_account_id_exists)
@@ -195,14 +208,7 @@ async def api_enable_extension(
         raise ValueError(f"Extension '{ext_id}' is not installed.")
     if not ext.active:
         raise ValueError(f"Extension '{ext_id}' is not activated.")
-    if ext.is_super_user_only and not settings.is_super_user(account_id.id):
+    _check_enable_extension_access(ext_id, ext, account_id)
-        raise HTTPException(
-            HTTPStatus.FORBIDDEN, f"User not authorized for extension '{ext_id}'."
-        )
-    if ext.is_admin_only and not settings.is_admin_user(account_id.id):
-        raise HTTPException(
-            HTTPStatus.FORBIDDEN, f"User not authorized for extension '{ext_id}'."
-        )
 
     user_ext = await get_user_extension(account_id.id, ext_id)
     if not user_ext:

lnbits/templates/pages/extensions.vue

@@ -306,9 +306,7 @@
                 @click="disableExtension(extension)"
                 :label="$t('disable')"
               ></q-btn>
-              <q-badge
+              <q-badge v-if="extension.isSuperUserOnly && !g.user.super_user">
-                v-if="extension.isSuperUserOnly && !g.user.super_user"
-              >
                 Super User Only
               </q-badge>
 

tests/unit/test_decorators.py

@@ -250,7 +250,9 @@ async def test_check_user_extension_access_honors_extension_metadata(
     admin_status = await check_user_extension_access(admin_user.id, admin_only_ext)
     assert admin_status.success is True
 
-    admin_super_status = await check_user_extension_access(admin_user.id, super_only_ext)
+    admin_super_status = await check_user_extension_access(
+        admin_user.id, super_only_ext
+    )
     assert admin_super_status.success is False
 
     previous_super_user = settings.super_user