From 427f54175c275c756564cf9f520b130400d2f63f Mon Sep 17 00:00:00 2001
From: Snakes <duolsm@outlook.com>
Date: Sun, 27 Nov 2022 16:49:20 -0500
Subject: [PATCH] WPD: constantify badge whitelist, extend set.

---
 files/helpers/const.py | 26 +++++++++++++++++++-------
 files/routes/admin.py  | 18 +++++++++++++-----
 2 files changed, 32 insertions(+), 12 deletions(-)

diff --git a/files/helpers/const.py b/files/helpers/const.py
index 528366c52..3dee13b1b 100644
--- a/files/helpers/const.py
+++ b/files/helpers/const.py
@@ -473,16 +473,22 @@ HOUSE_SWITCH_COST = 2000
 
 DONATE_SERVICE = "Gumroad" if not KOFI_TOKEN or  KOFI_TOKEN == DEFAULT_CONFIG_VALUE else "KoFi"
 DONATE_LINK = GUMROAD_LINK if not KOFI_TOKEN or KOFI_TOKEN == DEFAULT_CONFIG_VALUE else KOFI_LINK
-
 TIERS_ID_TO_NAME = {
-		1: "Paypig",
-		2: "Renthog",
-		3: "Landchad",
-		4: "Terminally online turboautist",
-		5: "JIDF Bankroller",
-		6: "Rich Bich"
+	1: "Paypig",
+	2: "Renthog",
+	3: "Landchad",
+	4: "Terminally online turboautist",
+	5: "JIDF Bankroller",
+	6: "Rich Bich",
 }
 
+BADGE_BLACKLIST = { # only grantable by AEVANN_ID except on PCM
+	16, 17, 21, 22, 23, 24, 25, 26, 27, # Marsey Artist x2 / Patron Tiers
+	94, 95, 96, 97, 98, 109, 67, 68, 83, 84, 87, 90, 140, 179, 185, # Award Status
+	137, # Lottery Winner
+}
+BADGE_WHITELIST = None # Falsey allows all non-blacklisted, or set() of permitted IDs
+
 if SITE == 'rdrama.net':
 	FEATURES['PRONOUNS'] = True
 	FEATURES['HOUSES'] = True
@@ -665,6 +671,12 @@ elif SITE == 'watchpeopledie.tv':
 		6: "Jigsaw"
 	}
 
+	BADGE_WHITELIST = {
+		85, 99, 101, # Sigma, Artist Badges x2
+		59, 60, 66, 104, 108, # Classic Accolades, Nword
+		117, 124, 144, 145, 146, 147, 148, 149, # Census Reused for Fun
+	}
+
 else: # localhost or testing environment implied
 	FEATURES['ASSET_SUBMISSIONS'] = True
 	FEATURES['PRONOUNS'] = True
diff --git a/files/routes/admin.py b/files/routes/admin.py
index 6bd254d10..a5c4ed96e 100644
--- a/files/routes/admin.py
+++ b/files/routes/admin.py
@@ -514,8 +514,16 @@ def under_attack(v):
 @admin_level_required(PERMS['USER_BADGES'])
 def badge_grant_get(v):
 	grant = request.url.endswith("grant")
-	badges = g.db.query(BadgeDef).order_by(BadgeDef.id).all()
-	return render_template("admin/badge_admin.html", v=v, badge_types=badges, grant=grant)
+
+	query = g.db.query(BadgeDef)
+	if BADGE_BLACKLIST and v.id != AEVANN_ID and SITE != 'pcmemes.net':
+		query = query.filter(BadgeDef.id.notin_(BADGE_BLACKLIST))
+	if BADGE_WHITELIST:
+		query = query.filter(BadgeDef.id.in_(BADGE_WHITELIST))
+	badge_types = query.order_by(BadgeDef.id).all()
+
+	return render_template("admin/badge_admin.html", v=v,
+		badge_types=badge_types, grant=grant)
 
 @app.post("/admin/badge_grant")
 @feature_required('BADGES')
@@ -531,10 +539,10 @@ def badge_grant_post(v):
 	try: badge_id = int(request.values.get("badge_id"))
 	except: abort(400)
 
-	if SITE == 'watchpeopledie.tv' and badge_id not in {99,101}:
+	if BADGE_WHITELIST and badge_id not in BADGE_WHITELIST:
 		abort(403)
-
-	if badge_id in {16,17,21,22,23,24,25,26,27,94,95,96,97,98,109,137,67,68,83,84,87,90,140} and v.id != AEVANN_ID and SITE != 'pcmemes.net':
+	elif (BADGE_BLACKLIST and badge_id in BADGE_BLACKLIST
+			and v.id != AEVANN_ID and SITE != 'pcmemes.net'):
 		abort(403)
 
 	if user.has_badge(badge_id):