Merge pull request #1178 from lnbits/refactor/depend_admin_user

Refactor: `require_admin_user` decorator

lnbits/core/views/api.py

@@ -36,6 +36,7 @@ from lnbits.decorators import (
     check_admin,
     get_key_type,
     require_admin_key,
+    require_admin_user,
     require_invoice_key,
 )
 from lnbits.helpers import url_for, urlsafe_short_hash
@@ -664,7 +665,7 @@ async def img(request: Request, data):
     )
 
 
-@core_app.get("/api/v1/audit/", dependencies=[Depends(check_admin)])
+@core_app.get("/api/v1/audit", dependencies=[Depends(check_admin)])
 async def api_auditor():
     WALLET = get_wallet_class()
     total_balance = await get_total_balance()

lnbits/decorators.py

@@ -172,6 +172,23 @@ async def get_key_type(
     )
 
 
+async def require_admin_user(
+    r: Request,
+    api_key_header: str = Security(api_key_header),  # type: ignore
+    api_key_query: str = Security(api_key_query),  # type: ignore
+):
+
+    token = api_key_header or api_key_query
+    wallet = await get_key_type(r, token)
+
+    if wallet.wallet.user not in settings.lnbits_admin_users:
+        raise HTTPException(
+            status_code=HTTPStatus.FORBIDDEN, detail="Not an admin user"
+        )
+    else:
+        return wallet
+
+
 async def require_admin_key(
     r: Request,
     api_key_header: str = Security(api_key_header),  # type: ignore

lnbits/extensions/satspay/views_api.py

@@ -11,6 +11,7 @@ from lnbits.decorators import (
     check_admin,
     get_key_type,
     require_admin_key,
+    require_admin_user,
     require_invoice_key,
 )
 from lnbits.extensions.satspay import satspay_ext
@@ -148,7 +149,7 @@ async def api_charge_balance(charge_id):
 @satspay_ext.post("/api/v1/themes/{css_id}", dependencies=[Depends(check_admin)])
 async def api_themes_save(
     data: SatsPayThemes,
-    wallet: WalletTypeInfo = Depends(require_invoice_key),
+    wallet: WalletTypeInfo = Depends(require_admin_key),
     css_id: str = Query(...),
 ):