From ad86b4b5b9688e545e50342e10875bfbcb20eb60 Mon Sep 17 00:00:00 2001
From: Logan Hanks <logan@reddit.com>
Date: Fri, 21 Sep 2012 11:52:58 -0700
Subject: [PATCH] Add "modconfig" oauth2 scope.

---
 r2/r2/controllers/api.py | 6 +++++-
 r2/r2/models/token.py    | 7 +++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/r2/r2/controllers/api.py b/r2/r2/controllers/api.py
index c261f2684..8f64daaf2 100755
--- a/r2/r2/controllers/api.py
+++ b/r2/r2/controllers/api.py
@@ -1212,6 +1212,7 @@ class ApiController(RedditController, OAuth2ResourceController):
         queries.queue_vote(user, thing, dir, ip, organic, store = store,
                            cheater = (errors.CHEATER, None) in c.errors)
 
+    @require_oauth2_scope("modconfig")
     @validatedForm(VUser(),
                    VModhash(),
                    # nop is safe: handled after auth checks below
@@ -1295,7 +1296,7 @@ class ApiController(RedditController, OAuth2ResourceController):
                 jquery('#preview_comment').html(
                     cssfilter.rendered_comment(comments))
 
-
+    @require_oauth2_scope("modconfig")
     @validatedForm(VSrModerator(),
                    VModhash(),
                    name = VCssName('img_name'))
@@ -1314,6 +1315,7 @@ class ApiController(RedditController, OAuth2ResourceController):
         ModAction.create(c.site, c.user, action='editsettings', 
                          details='del_image', description=name)
 
+    @require_oauth2_scope("modconfig")
     @validatedForm(VSrModerator(),
                    VModhash(),
                    sponsor = VInt("sponsor", min = 0, max = 1))
@@ -1355,6 +1357,7 @@ class ApiController(RedditController, OAuth2ResourceController):
         """
         return "nothing to see here."
 
+    @require_oauth2_scope("modconfig")
     @validate(VSrModerator(),
               VModhash(),
               file = VLength('file', max_length=1024*500),
@@ -1427,6 +1430,7 @@ class ApiController(RedditController, OAuth2ResourceController):
             return UploadedImage(_('saved'), new_url, name, 
                                  errors=errors, form_id=form_id).render()
 
+    @require_oauth2_scope("modconfig")
     @validatedForm(VUser(),
                    VModhash(),
                    VRatelimit(rate_user = True,
diff --git a/r2/r2/models/token.py b/r2/r2/models/token.py
index c6a79d0e9..6f8217156 100644
--- a/r2/r2/models/token.py
+++ b/r2/r2/models/token.py
@@ -114,6 +114,13 @@ class OAuth2Scope:
                 "Approve, remove, mark nsfw, and distinguish content"
                 " in subreddits I moderate."),
         },
+        "modconfig": {
+            "id": "modconfig",
+            "name": _("Moderate Subreddit Configuration"),
+            "description": _(
+                "Manage the configuration, sidebar, and CSS"
+                " of subreddits I moderate."),
+        },
         "modtraffic": {
             "id": "modtraffic",
             "name": _("Subreddit Traffic"),