1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Plugs.UserIsAdminPlug do
6 import Pleroma.Web.TranslationHelpers
10 alias Pleroma.Web.OAuth
16 def call(%{assigns: %{user: %User{is_admin: true}} = assigns} = conn, _) do
17 token = assigns[:token]
20 not Pleroma.Config.enforce_oauth_admin_scope_usage?() ->
23 token && OAuth.Scopes.contains_admin_scopes?(token.scopes) ->
24 # Note: checking for _any_ admin scope presence, not necessarily fitting requested action.
25 # Thus, controller must explicitly invoke OAuthScopesPlug to verify scope requirements.
26 # Admin might opt out of admin scope for some apps to block any admin actions from them.
40 |> render_error(:forbidden, "User is not an admin or OAuth admin scope is not granted.")