From 572ddc69add41e32a8b345ff3eddada2f8e9dbd2 Mon Sep 17 00:00:00 2001
From: Zoe Roux <zoe.roux@zoriya.dev>
Date: Mon, 3 Nov 2025 12:27:30 +0100
Subject: [PATCH] Fix video controller permissions

---
 .env.example                  |  2 +-
 api/src/base.ts               |  9 +++++----
 api/src/controllers/videos.ts | 13 ++++++++++---
 3 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/.env.example b/.env.example
index 3cd7a0ef..d1ea0a24 100644
--- a/.env.example
+++ b/.env.example
@@ -54,7 +54,7 @@ PROTECTED_CLAIMS="permissions,verified"
 # Replace $YOURNAME with the name of the key you want (only alpha are valid)
 # The value will be the apikey (max 128 bytes)
 KEIBI_APIKEY_SCANNER=EJqUB8robwKwLNt37SuHqdcsNGrtwpfYxeExfiAbokpxZVd4WctWr7gnSZ
-KEIBI_APIKEY_SCANNER_CLAIMS='{"permissions": ["core.write"]}'
+KEIBI_APIKEY_SCANNER_CLAIMS='{"permissions": ["core.read", "core.write"]}'
 
 # To debug the front end, you can set the following to an external backend
 KYOO_URL=
diff --git a/api/src/base.ts b/api/src/base.ts
index a4e58355..95994a0f 100644
--- a/api/src/base.ts
+++ b/api/src/base.ts
@@ -13,8 +13,8 @@ import { series } from "./controllers/shows/series";
 import { showsH } from "./controllers/shows/shows";
 import { staffH } from "./controllers/staff";
 import { studiosH } from "./controllers/studios";
-import { videosH } from "./controllers/videos";
-import type { KError } from "./models/error";
+import { videosReadH, videosWriteH } from "./controllers/videos";
+import { KError } from "./models/error";
 
 export const base = new Elysia({ name: "base" })
 	.onError(({ code, error }) => {
@@ -90,7 +90,8 @@ export const handlers = new Elysia({ prefix })
 				.use(imagesH)
 				.use(watchlistH)
 				.use(historyH)
-				.use(nextup),
+				.use(nextup)
+				.use(videosReadH),
 	)
 	.guard(
 		{
@@ -104,5 +105,5 @@ export const handlers = new Elysia({ prefix })
 			// },
 			permissions: ["core.write"],
 		},
-		(app) => app.use(videosH).use(seed),
+		(app) => app.use(videosWriteH).use(seed),
 	);
diff --git a/api/src/controllers/videos.ts b/api/src/controllers/videos.ts
index 2409ed2e..57b987f0 100644
--- a/api/src/controllers/videos.ts
+++ b/api/src/controllers/videos.ts
@@ -439,10 +439,9 @@ function getNextVideoEntry({
 		.as("next");
 }
 
-export const videosH = new Elysia({ prefix: "/videos", tags: ["videos"] })
+export const videosReadH = new Elysia({ prefix: "/videos", tags: ["videos"] })
 	.model({
 		video: Video,
-		"created-videos": t.Array(CreatedVideo),
 		error: t.Object({}),
 	})
 	.use(auth)
@@ -483,7 +482,7 @@ export const videosH = new Elysia({ prefix: "/videos", tags: ["videos"] })
 					message: `No video found with id or slug '${id}'`,
 				});
 			}
-			return video;
+			return video as any;
 		},
 		{
 			detail: {
@@ -806,6 +805,14 @@ export const videosH = new Elysia({ prefix: "/videos", tags: ["videos"] })
 			},
 		},
 	)
+
+export const videosWriteH = new Elysia({ prefix: "/videos", tags: ["videos"] })
+	.model({
+		video: Video,
+		"created-videos": t.Array(CreatedVideo),
+		error: t.Object({}),
+	})
+	.use(auth)
 	.post(
 		"",
 		async ({ body, status }) => {