From 0d9a70f34b037fdf56fec2d46170f0dad8d9ccd2 Mon Sep 17 00:00:00 2001
From: Jemma Poffinbarger <git@jemsoftware.dev>
Date: Mon, 29 Jul 2024 13:43:20 -0500
Subject: [PATCH] fix: Check user accessLevel instead of server setting for
 access to test environments

---
 src/middleware/checkBan.js | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/src/middleware/checkBan.js b/src/middleware/checkBan.js
index 8ec66b2..f2f7730 100644
--- a/src/middleware/checkBan.js
+++ b/src/middleware/checkBan.js
@@ -11,7 +11,28 @@ async function checkBan(request, response, next) {
 		return next();
 	}
 
-	if (config.server_environment !== 'prod' && request.user.serverAccessLevel !== 'test' && request.user.serverAccessLevel !== 'dev') {
+	// Set access levels
+	request.tester = request.user.accessLevel >= 1 && request.user.accessLevel <= 3;
+	request.moderator = request.user.accessLevel == 2 || request.user.accessLevel == 3;
+	request.developer = request.user.accessLevel == 3;
+
+	// Check if user has access to the environment
+	let accessAllowed = false;
+	switch (config.server_environment) {
+		case 'dev':
+			accessAllowed = request.developer;
+			break;
+		case 'test':
+			accessAllowed = request.tester || request.moderator || request.developer;
+			break;
+		case 'prod':
+			accessAllowed = true;
+			break;
+		default:
+			accessAllowed = false;
+	}
+
+	if (!accessAllowed) {
 		response.status(500);
 		if (request.directory === 'web') {
 			return response.render('web/login.ejs', {toast: 'No access. Must be tester or dev', cdnURL: config.CDN_domain,});
@@ -22,9 +43,6 @@ async function checkBan(request, response, next) {
 			});
 		}
 	}
-	// Set moderator status
-	request.moderator = request.user.accessLevel == 2 || request.user.accessLevel == 3;
-	request.developer = request.user.accessLevel == 3;
 	const user = await db.getUserSettings(request.pid);
 	if (user && moment(user.ban_lift_date) <= moment() && user.account_status !== 3) {
 		user.account_status = 0;