Merge branch 'master' into dependabot/cargo/pointercrate-247c716ce2

Author: stadust

pointercrate-demonlist-api/src/endpoints/player.rs

@@ -14,7 +14,7 @@ use pointercrate_demonlist::{
         claim::{ListedClaim, PatchPlayerClaim, PlayerClaim, PlayerClaimPagination},
         DatabasePlayer, FullPlayer, PatchPlayer, Player, PlayerPagination, RankedPlayer, RankingPagination,
     },
-    LIST_HELPER,
+    LIST_HELPER, LIST_MODERATOR,
 };
 use pointercrate_user::{auth::ApiToken, MODERATOR};
 use pointercrate_user_api::auth::Auth;
@@ -70,6 +70,7 @@ pub async fn get(player_id: i32, pool: &State<PointercratePool>) -> Result<Tagge
 pub async fn patch(
     player_id: i32, mut auth: Auth<ApiToken>, precondition: Precondition, patch: Json<PatchPlayer>,
 ) -> Result<Tagged<FullPlayer>> {
+    auth.require_permission(LIST_MODERATOR)?;
     let player = Player::by_id(player_id, &mut auth.connection)
         .await?
         .upgrade(&mut auth.connection)

pointercrate-test/tests/demonlist/player/mod.rs

@@ -73,7 +73,7 @@ async fn test_list_helper_pagination(pool: Pool<Postgres>) {
 async fn test_patch_player_nationality(pool: Pool<Postgres>) {
     let (client, mut connection) = pointercrate_test::demonlist::setup_rocket(pool).await;
     let player = DatabasePlayer::by_name_or_create("stardust1971", &mut connection).await.unwrap();
-    let user = pointercrate_test::user::system_user_with_perms(LIST_HELPER, &mut connection).await;
+    let user = pointercrate_test::user::system_user_with_perms(LIST_MODERATOR, &mut connection).await;
 
     // Try to set subdivision when no nation is set. Should fail.
     let result: serde_json::Value = client