From 71a6d9028391161bf5fda59eb06f954d4cbac5e9 Mon Sep 17 00:00:00 2001
From: Ben Arc <ben@arc.wales>
Date: Wed, 21 Apr 2021 16:00:11 +0100
Subject: [PATCH] Changed permission for deleting,

---
 lnbits/extensions/copilot/templates/copilot/_api_docs.html | 5 ++++-
 lnbits/extensions/copilot/views_api.py                     | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/lnbits/extensions/copilot/templates/copilot/_api_docs.html b/lnbits/extensions/copilot/templates/copilot/_api_docs.html
index 048458195..d6289be9c 100644
--- a/lnbits/extensions/copilot/templates/copilot/_api_docs.html
+++ b/lnbits/extensions/copilot/templates/copilot/_api_docs.html
@@ -155,12 +155,15 @@
             ><span class="text-blue">GET</span>
             /api/v1/copilot/ws/&lt;copilot_id&gt;/&lt;comment&gt;/&lt;data&gt;</code
           >
+          <h5 class="text-caption q-mt-sm q-mb-none">Headers</h5>
+          <code>{"X-Api-Key": &lt;admin_key&gt;}</code><br />
           <h5 class="text-caption q-mt-sm q-mb-none">Returns 200</h5>
           <code></code>
           <h5 class="text-caption q-mt-sm q-mb-none">Curl example</h5>
           <code
             >curl -X GET {{ request.url_root }}/api/v1/copilot/ws/&lt;string,
-            copilot_id&gt;/&lt;string, comment&gt;/&lt;string, gif name&gt;
+            copilot_id&gt;/&lt;string, comment&gt;/&lt;string, gif name&gt; -H
+            "X-Api-Key: {{ g.user.wallets[0].adminkey }}"
           </code>
         </q-card-section>
       </q-card>
diff --git a/lnbits/extensions/copilot/views_api.py b/lnbits/extensions/copilot/views_api.py
index 2089831da..c5c2fdb91 100644
--- a/lnbits/extensions/copilot/views_api.py
+++ b/lnbits/extensions/copilot/views_api.py
@@ -82,7 +82,7 @@ async def api_copilot_retrieve(copilot_id):
 
 
 @copilot_ext.route("/api/v1/copilot/<copilot_id>", methods=["DELETE"])
-@api_check_wallet_key("invoice")
+@api_check_wallet_key("admin")
 async def api_copilot_delete(copilot_id):
     copilot = await get_copilot(copilot_id)
 
@@ -95,11 +95,11 @@ async def api_copilot_delete(copilot_id):
 
 
 @copilot_ext.route("/api/v1/copilot/ws/<copilot_id>/<comment>/<data>", methods=["GET"])
+@api_check_wallet_key("admin")
 async def api_copilot_ws_relay(copilot_id, comment, data):
     copilot = await get_copilot(copilot_id)
 
     if not copilot:
         return jsonify({"message": "copilot does not exist"}), HTTPStatus.NOT_FOUND
     await updater(data, comment, copilot_id)
-    print(comment)
     return "", HTTPStatus.OK