Restrict running commercials to staff with full broadcast permissions

slmnio · Nov 26, 2022 · fb5356f · fb5356f
1 parent b5bf86b
commit fb5356f
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/server/src/actions/start-commercial.js b/server/src/actions/start-commercial.js
@@ -15,7 +15,9 @@ module.exports = {
      * @returns {Promise<void>}
      */
     // eslint-disable-next-line no-empty-pattern
-    async handler(success, error, { commercialDuration }, { client }, { get, auth }) {
+    async handler(success, error, { commercialDuration }, { client, user }, { get, auth }) {
+        if (!user.airtable?.website_settings?.includes("Full broadcast permissions")) return error("You don't have permission to start a commercial", 403);
+
         const broadcast = await get(client?.broadcast?.[0]);
         if (!broadcast) return error("No broadcast associated");
         if (!broadcast.channel) return error("No channel associated with broadcast");

diff --git a/website/src/views/Dashboard.vue b/website/src/views/Dashboard.vue
@@ -13,7 +13,7 @@
             <MatchEditor :match="liveMatch"></MatchEditor>
         </div>
         <Predictions v-if="liveMatch" :client="client"/>
-        <Commercials :client="client" />
+        <Commercials v-if="hasPermission('Full broadcast permissions')" :client="client" />
         <b-button class="mt-2" variant="secondary" @click="updateTitle">
             <i class="fal fa-fw fa-wand-magic mr-1"></i>Update title
         </b-button>
@@ -76,9 +76,11 @@ export default {
     methods: {
         url,
         togglePlayerCams,
-
         async updateTitle() {
             await updateAutomaticTitle(this.$root.auth, "self", "create");
+        },
+        hasPermission(permission) {
+            return (this.user.website_settings || []).includes(permission);
         }
     }
 };