correct authentication

web/src/macros.rs

@@ -56,14 +56,28 @@ macro_rules! check_authorization {
             Some(user_id) => {
                 match GuildId($guild).to_guild_cached($ctx) {
                     Some(guild) => {
-                        let member = guild.member($ctx, UserId(user_id)).await;
+                        let member_res = guild.member($ctx, UserId(user_id)).await;
 
-                        match member {
+                        match member_res {
                             Err(_) => {
                                 return Err(json!({"error": "User not in guild"}));
                             }
 
-                            Ok(_) => {}
+                            Ok(member) => {
+                                let permissions_res = member.permissions($ctx);
+
+                                match permissions_res {
+                                    Err(_) => {
+                                        return Err(json!({"error": "Couldn't fetch permissions"}));
+                                    }
+
+                                    Ok(permissions) => {
+                                        if !(permissions.manage_messages() || permissions.manage_guild() || permissions.administrator()) {
+                                            return Err(json!({"error": "Incorrect permissions"}));
+                                        }
+                                    }
+                                }
+                            }
                         }
                     }