Fix users cannot access public admin HTTP endpoints

turms-im · Nov 21, 2024 · d4aa686 · d4aa686
1 parent e887b2f
commit d4aa686
Showing 1 changed file with 12 additions and 12 deletions.
diff --git a/...ommon/src/main/java/im/turms/server/common/access/admin/web/HttpRequestAuthenticator.java b/...ommon/src/main/java/im/turms/server/common/access/admin/web/HttpRequestAuthenticator.java
@@ -63,19 +63,19 @@ public Mono<Long> authenticate(
                                     + HttpHeaderNames.AUTHORIZATION
                                     + "\"")));
         }
-        return adminService.authenticate(credentials.first(), credentials.second())
-                .flatMap(id -> adminService
+        Mono<Long> authenticate =
+                adminService.authenticate(credentials.first(), credentials.second())
+                        .switchIfEmpty(UNAUTHENTICATED);
+        return permission == null
+                ? authenticate
+                : authenticate.flatMap(id -> adminService
                         .isAdminAuthorized(params, paramValues, id, permission.value())
-                        .flatMap(authorized -> {
-                            if (authorized) {
-                                return Mono.just(id);
-                            }
-                            return Mono.error(new HttpResponseException(
-                                    HttpHandlerResult
-                                            .unauthorized("Unauthorized to access the resource: "
-                                                    + permission.value())));
-                        }))
-                .switchIfEmpty(UNAUTHENTICATED);
+                        .flatMap(authorized -> authorized
+                                ? Mono.just(id)
+                                : Mono.error(new HttpResponseException(
+                                        HttpHandlerResult.unauthorized(
+                                                "Unauthorized to access the resource: "
+                                                        + permission.value())))));
     }
 
     @Nullable