ghost rider

src/inc/routes/apiv2/index.mjs

@@ -11,7 +11,7 @@ import audit from '../../audit.mjs';
 import { parseMultipart, collectBody } from '../../multipart.mjs';
 import { purgeExpiredUploads } from '../../lib_delete.mjs';
 import { calculateExpiresAt } from './upload.mjs';
-import { addPrivateItem, removePrivateItem } from '../../private_items.mjs';
+import { addPrivateItem, removePrivateItem, addUnavailableItem, removeUnavailableItem } from '../../private_items.mjs';
 
 const allowedMimes = ["audio", "image", "video", "%"];
 const getGlobalfilter = () => {
@@ -1067,7 +1067,11 @@ export default router => {
       if (!isOwner && !isMod) return res.json({ success: false, msg: 'Forbidden' }, 403);
 
       // Accept title from JSON or URL-encoded body
-      let rawTitle = req.post?.title ?? req.body?.title ?? null;
+      let body = req.post || req.body || {};
+      if (typeof body === 'string') {
+        try { body = JSON.parse(body); } catch (_) {}
+      }
+      let rawTitle = body?.title ?? null;
       if (rawTitle !== null) rawTitle = String(rawTitle).trim();
       // Empty string → null (clears the title)
       const title = (rawTitle === '' || rawTitle === null) ? null : rawTitle.substring(0, 500);
@@ -1317,7 +1321,7 @@ export default router => {
         }
         const postid = req.post?.postid || req.post?.id || req.body?.postid || req.body?.id;
         const visibility = parseInt(req.post?.visibility ?? req.body?.visibility, 10);
-        if (!postid || isNaN(visibility) || ![0, 1, 2].includes(visibility)) {
+        if (!postid || isNaN(visibility) || ![0, 1, 2, 3].includes(visibility)) {
             return res.json({ success: false, msg: 'Invalid parameters' }, 400);
         }
 
@@ -1340,12 +1344,21 @@ export default router => {
             return res.json({ success: false, msg: 'Unauthorized' }, 403);
         }
 
+        if (visibility === 3 && !isAdmin) {
+            return res.json({ success: false, msg: 'Only moderators or administrators can make an item unavailable' }, 403);
+        }
+
         await db`UPDATE items SET visibility = ${visibility} WHERE id = ${item[0].id}`;
 
         if (visibility === 2) {
             addPrivateItem(item[0].id, item[0].dest, item[0].username);
+            removeUnavailableItem(item[0].id, item[0].dest);
+        } else if (visibility === 3) {
+            addUnavailableItem(item[0].id, item[0].dest, item[0].username);
+            removePrivateItem(item[0].id, item[0].dest);
         } else {
             removePrivateItem(item[0].id, item[0].dest);
+            removeUnavailableItem(item[0].id, item[0].dest);
         }
 
         f0cklib.clearCountCache();