Merge pull request lichess-org#16315 from veloce/study_mobile_scopes

[Mobile] Add missing mobile scopes to study endpoints
johndoknjas · Nov 3, 2024 · eab13f7 · eab13f7
2 parents b0da0fa + 3020054
commit eab13f7
Showing 1 changed file with 12 additions and 11 deletions.
diff --git a/app/controllers/Study.scala b/app/controllers/Study.scala
@@ -417,7 +417,7 @@ final class Study(
   def pgn(id: StudyId) = Open:
     pgnWithFlags(id, identity)
 
-  def apiPgn(id: StudyId) = AnonOrScoped(_.Study.Read): ctx ?=>
+  def apiPgn(id: StudyId) = AnonOrScoped(_.Study.Read, _.Web.Mobile): ctx ?=>
     pgnWithFlags(id, identity)
 
   def pgnWithFlags(id: StudyId, flags: Update[WithFlags])(using Context) =
@@ -439,14 +439,15 @@ final class Study(
   def chapterPgn(id: StudyId, chapterId: StudyChapterId) = Open:
     doChapterPgn(id, chapterId, notFound, privateUnauthorizedFu, privateForbiddenFu)
 
-  def apiChapterPgn(id: StudyId, chapterId: StudyChapterId) = AnonOrScoped(_.Study.Read): ctx ?=>
-    doChapterPgn(
-      id,
-      chapterId,
-      fuccess(studyNotFoundText),
-      _ => fuccess(privateUnauthorizedText),
-      _ => fuccess(privateForbiddenText)
-    )
+  def apiChapterPgn(id: StudyId, chapterId: StudyChapterId) =
+    AnonOrScoped(_.Study.Read, _.Web.Mobile): ctx ?=>
+      doChapterPgn(
+        id,
+        chapterId,
+        fuccess(studyNotFoundText),
+        _ => fuccess(privateUnauthorizedText),
+        _ => fuccess(privateForbiddenText)
+      )
 
   private def doChapterPgn(
       id: StudyId,
@@ -467,7 +468,7 @@ final class Study(
       }
     }
 
-  def exportPgn(username: UserStr) = OpenOrScoped(_.Study.Read): ctx ?=>
+  def exportPgn(username: UserStr) = OpenOrScoped(_.Study.Read, _.Web.Mobile): ctx ?=>
     val name =
       if username.value == "me"
       then ctx.me.fold(UserName("me"))(_.username)
@@ -485,7 +486,7 @@ final class Study(
         .pipe(asAttachmentStream(s"${name}-${if isMe then "all" else "public"}-studies.pgn"))
         .as(pgnContentType)
 
-  def apiListByOwner(username: UserStr) = OpenOrScoped(_.Study.Read): ctx ?=>
+  def apiListByOwner(username: UserStr) = OpenOrScoped(_.Study.Read, _.Web.Mobile): ctx ?=>
     val isMe = ctx.is(username)
     apiC.jsonDownload:
       env.study.studyRepo