tuwunel_api/router/auth/admin.rs
1use ruma::UserId;
2use tuwunel_core::{Result, err};
3
4/// Assert the caller is a server administrator.
5///
6/// Generic Synapse admin
7/// endpoints use this plain check, not the MSC4323 anti-enumeration
8/// `authorize()` guard whose self-target and admin-target ordering does not
9/// fit them.
10pub async fn require_admin(services: &crate::State, sender: &UserId) -> Result {
11 services
12 .admin
13 .user_is_admin(sender)
14 .await
15 .then_some(())
16 .ok_or_else(|| {
17 err!(Request(Forbidden("Only server administrators can use this endpoint")))
18 })
19}