From 7f27eabf3ec3525234625645e37fd0342a715b6b Mon Sep 17 00:00:00 2001
From: advplyr <advplyr@protonmail.com>
Date: Sun, 8 May 2022 18:48:57 -0500
Subject: [PATCH] Update:Authors page check user can access library items and
 can edit

---
 client/pages/author/_id.vue                 | 5 ++++-
 server/controllers/AuthorController.js      | 1 +
 server/controllers/LibraryItemController.js | 7 +------
 server/objects/user/User.js                 | 5 +++++
 4 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/client/pages/author/_id.vue b/client/pages/author/_id.vue
index c800669b..722d8bab 100644
--- a/client/pages/author/_id.vue
+++ b/client/pages/author/_id.vue
@@ -11,7 +11,7 @@
           <div class="flex items-center mb-8">
             <h1 class="text-2xl">{{ author.name }}</h1>
 
-            <button class="w-8 h-8 rounded-full flex items-center justify-center mx-4 cursor-pointer text-gray-300 hover:text-warning transform hover:scale-125 duration-100" @click="editAuthor">
+            <button v-if="userCanUpdate" class="w-8 h-8 rounded-full flex items-center justify-center mx-4 cursor-pointer text-gray-300 hover:text-warning transform hover:scale-125 duration-100" @click="editAuthor">
               <span class="material-icons text-base">edit</span>
             </button>
           </div>
@@ -68,6 +68,9 @@ export default {
     },
     authorSeries() {
       return this.author.series || []
+    },
+    userCanUpdate() {
+      return this.$store.getters['user/getUserCanUpdate']
     }
   },
   methods: {
diff --git a/server/controllers/AuthorController.js b/server/controllers/AuthorController.js
index 23b62ae7..d353a10e 100644
--- a/server/controllers/AuthorController.js
+++ b/server/controllers/AuthorController.js
@@ -16,6 +16,7 @@ class AuthorController {
     // Used on author landing page to include library items and items grouped in series
     if (include.includes('items')) {
       authorJson.libraryItems = this.db.libraryItems.filter(li => {
+        if (!req.user.checkCanAccessLibraryItem(li)) return false // filter out library items user cannot access
         return li.media.metadata.hasAuthor && li.media.metadata.hasAuthor(req.author.id)
       })
 
diff --git a/server/controllers/LibraryItemController.js b/server/controllers/LibraryItemController.js
index c4c03e73..ddf4e1e2 100644
--- a/server/controllers/LibraryItemController.js
+++ b/server/controllers/LibraryItemController.js
@@ -379,13 +379,8 @@ class LibraryItemController {
     var item = this.db.libraryItems.find(li => li.id === req.params.id)
     if (!item || !item.media) return res.sendStatus(404)
 
-    // Check user can access this library
-    if (!req.user.checkCanAccessLibrary(item.libraryId)) {
-      return res.sendStatus(403)
-    }
-
     // Check user can access this library item
-    if (!req.user.checkCanAccessLibraryItemWithTags(item.media.tags)) {
+    if (!req.user.checkCanAccessLibraryItem(item)) {
       return res.sendStatus(403)
     }
 
diff --git a/server/objects/user/User.js b/server/objects/user/User.js
index 14898554..ea1432e7 100644
--- a/server/objects/user/User.js
+++ b/server/objects/user/User.js
@@ -341,6 +341,11 @@ class User {
     return this.itemTagsAccessible.some(tag => tags.includes(tag))
   }
 
+  checkCanAccessLibraryItem(libraryItem) {
+    if (!this.checkCanAccessLibrary(libraryItem.libraryId)) return false
+    return this.checkCanAccessLibraryItemWithTags(libraryItem.media.tags)
+  }
+
   findBookmark(libraryItemId, time) {
     return this.bookmarks.find(bm => bm.libraryItemId === libraryItemId && bm.time == time)
   }