From af9c3233d8847ef7a87fa6d08bd0c4561b5941f0 Mon Sep 17 00:00:00 2001
From: stringsplit <77242831+nbitzz@users.noreply.github.com>
Date: Mon, 2 Oct 2023 19:20:11 -0700
Subject: [PATCH] token-permissions: update primaryApi

---
 src/server/routes/primaryApi.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/server/routes/primaryApi.ts b/src/server/routes/primaryApi.ts
index 0ff3ed7..33558d8 100644
--- a/src/server/routes/primaryApi.ts
+++ b/src/server/routes/primaryApi.ts
@@ -8,7 +8,7 @@ import multer, {memoryStorage} from "multer"
 
 import ServeError from "../lib/errors";
 import Files from "../lib/files";
-import { getAccount } from "../lib/middleware";
+import { getAccount, requiresPermissions } from "../lib/middleware";
 
 let parser = bodyParser.json({
     type: ["text/plain","application/json"]
@@ -115,7 +115,7 @@ primaryApi.head(["/file/:fileId", "/cpt/:fileId/*", "/:fileId"], (req: express.R
 
 // upload handlers
 
-primaryApi.post("/upload",multerSetup.single('file'),async (req,res) => {
+primaryApi.post("/upload", requiresPermissions("upload"), multerSetup.single('file'), async (req,res) => {
     
     let acc = res.locals.acc as Accounts.Account
 
@@ -149,7 +149,7 @@ primaryApi.post("/upload",multerSetup.single('file'),async (req,res) => {
     }
 })
 
-primaryApi.post("/clone", bodyParser.json({type: ["text/plain","application/json"]}) ,(req,res) => {
+primaryApi.post("/clone", requiresPermissions("upload"), bodyParser.json({type: ["text/plain","application/json"]}) ,(req,res) => {
     
     let acc = res.locals.acc as Accounts.Account