From 4aef026594c81d560b592e6575b5252aae08ad96 Mon Sep 17 00:00:00 2001
From: justcool393 <justcool393@gmail.com>
Date: Wed, 5 Oct 2022 20:37:18 -0700
Subject: [PATCH] add and remove admin permissions

---
 files/helpers/const.py | 3 +++
 files/routes/admin.py  | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/files/helpers/const.py b/files/helpers/const.py
index cefd6a5e5..a91983c84 100644
--- a/files/helpers/const.py
+++ b/files/helpers/const.py
@@ -148,6 +148,9 @@ PERMS = { # Minimum admin_level to perform action.
 	'PRINT_MARSEYBUX_FOR_KIPPY_ON_PCMEMES': 3,
 	'VIEW_ACTIVE_USERS': 2,
 	'MERGE_USERS': 3, # note: extra check for Aevann
+	'ADMIN_ADD': 3, # note: explicitly disabled on rDrama
+	'ADMIN_REMOVE': 3,
+	'ADMIN_ADD_PERM_LEVEL': 2, # permission level given when user added via site
 }
 
 FEATURES = {
diff --git a/files/routes/admin.py b/files/routes/admin.py
index 668bda938..74dc8f458 100644
--- a/files/routes/admin.py
+++ b/files/routes/admin.py
@@ -156,13 +156,13 @@ def merge_all(v, id):
 
 
 @app.post("/@<username>/make_admin")
-@admin_level_required(3)
+@admin_level_required(PERMS['ADMIN_ADD'])
 def make_admin(v, username):
 	if SITE == 'rdrama.net': abort(403)
 
 	user = get_user(username)
 
-	user.admin_level = 2
+	user.admin_level = PERMS['ADMIN_ADD_PERM_LEVEL']
 	g.db.add(user)
 
 	ma = ModAction(
@@ -176,7 +176,7 @@ def make_admin(v, username):
 
 
 @app.post("/@<username>/remove_admin")
-@admin_level_required(3)
+@admin_level_required(PERMS['ADMIN_REMOVE'])
 def remove_admin(v, username):
 	user = get_user(username)
 	user.admin_level = 0