[feature] granular admin scopes for custom emojis (#4489)

This PR adds admin equivalents of the `read:custom_emojis` OAuth scope: `admin:read:custom_emojis` and `admin:write:custom_emojis`.

This is so tools which only touch emojis can run without other admin permissions. (`slurp emojis import` is one such tool.)

I've also sorted the admin section of the scopes lists alphabetically like the non-admin section, and updated the Swagger test script to print the same command path that it actually runs.

## API compatibility

Neither [Mastodon](https://docs.joinmastodon.org/api/oauth-scopes/) nor Akkoma nor Iceshrimp.NET has an equivalent scope, so there are no alternate scope names to worry about.

Co-authored-by: tobi <tobi.smethurst@protonmail.com>
Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4489
Co-authored-by: Vyr Cossont <vyr@noreply.codeberg.org>
Co-committed-by: Vyr Cossont <vyr@noreply.codeberg.org>

11 files changed, 50 insertions, 33 deletions

diff --git a/docs/api/swagger.yaml b/docs/api/swagger.yaml
index 7de635d1e..3454364a1 100644
--- a/docs/api/swagger.yaml
+++ b/docs/api/swagger.yaml
@@ -3849,11 +3849,13 @@ info:
         admin: grants admin access to everything
         admin:read: grants admin read access to everything
         admin:read:accounts: grants admin read access to accounts
+        admin:read:custom_emojis: grants admin read access to custom emojis
         admin:read:domain_allows: grants admin read access to domain_allows
         admin:read:domain_blocks: grants admin read access to domain_blocks
         admin:read:reports: grants admin read access to reports
         admin:write: grants admin write access to everything
         admin:write:accounts: grants write read access to accounts
+        admin:write:custom_emojis: grants admin write access to custom emojis
         admin:write:domain_allows: grants admin write access to domain_allows
         admin:write:domain_blocks: grants write read access to domain_blocks
         admin:write:reports: grants admin write access to reports
@@ -5551,7 +5553,7 @@ paths:
                     description: internal server error
             security:
                 - OAuth2 Bearer:
-                    - admin:read
+                    - admin:read:custom_emojis
             summary: View local and remote emojis available to / known by this instance.
             tags:
                 - admin
@@ -5598,7 +5600,7 @@ paths:
                     description: internal server error
             security:
                 - OAuth2 Bearer:
-                    - admin:write
+                    - admin:write:custom_emojis
             summary: Upload and create a new instance emoji.
             tags:
                 - admin
@@ -5638,7 +5640,7 @@ paths:
                     description: internal server error
             security:
                 - OAuth2 Bearer:
-                    - admin:write
+                    - admin:write:custom_emojis
             summary: Delete a **local** emoji with the given ID from the instance.
             tags:
                 - admin
@@ -5671,7 +5673,7 @@ paths:
                     description: internal server error
             security:
                 - OAuth2 Bearer:
-                    - admin:read
+                    - admin:read:custom_emojis
             summary: Get the admin view of a single emoji.
             tags:
                 - admin
@@ -5743,7 +5745,7 @@ paths:
                     description: internal server error
             security:
                 - OAuth2 Bearer:
-                    - admin:write
+                    - admin:write:custom_emojis
             summary: Perform admin action on a local or remote emoji known to this instance.
             tags:
                 - admin
@@ -5773,7 +5775,7 @@ paths:
                     description: internal server error
             security:
                 - OAuth2 Bearer:
-                    - admin:read
+                    - admin:read:custom_emojis
             summary: Get a list of existing emoji categories.
             tags:
                 - admin
@@ -13933,13 +13935,15 @@ securityDefinitions:
             admin: grants admin access to everything
             admin:read: grants admin read access to everything
             admin:read:accounts: grants admin read access to accounts
-            admin:read:domain_allows: grants admin read access to domain_allows
-            admin:read:domain_blocks: grants admin read access to domain_blocks
+            admin:read:custom_emojis: grants admin read access to custom emojis
+            admin:read:domain_allows: grants admin read access to domain allows
+            admin:read:domain_blocks: grants admin read access to domain blocks
             admin:read:reports: grants admin read access to reports
             admin:write: grants admin write access to everything
             admin:write:accounts: grants write read access to accounts
-            admin:write:domain_allows: grants admin write access to domain_allows
-            admin:write:domain_blocks: grants write read access to domain_blocks
+            admin:write:custom_emojis: grants admin write access to custom emojis
+            admin:write:domain_allows: grants admin write access to domain allows
+            admin:write:domain_blocks: grants write read access to domain blocks
             admin:write:reports: grants admin write access to reports
             profile: grants read access to verify_credentials
             push: grants read/write access to push
diff --git a/docs/swagger.go b/docs/swagger.go
index c549a3de3..3f0ed2249 100644
--- a/docs/swagger.go
+++ b/docs/swagger.go
@@ -26,11 +26,13 @@
 //   - admin: grants admin access to everything
 //   - admin:read: grants admin read access to everything
 //   - admin:read:accounts: grants admin read access to accounts
+//   - admin:read:custom_emojis: grants admin read access to custom emojis
 //   - admin:read:domain_allows: grants admin read access to domain_allows
 //   - admin:read:domain_blocks: grants admin read access to domain_blocks
 //   - admin:read:reports: grants admin read access to reports
 //   - admin:write: grants admin write access to everything
 //   - admin:write:accounts: grants write read access to accounts
+//   - admin:write:custom_emojis: grants admin write access to custom emojis
 //   - admin:write:domain_allows: grants admin write access to domain_allows
 //   - admin:write:domain_blocks: grants write read access to domain_blocks
 //   - admin:write:reports: grants admin write access to reports
@@ -85,13 +87,15 @@
 //	      admin: grants admin access to everything
 //	      admin:read: grants admin read access to everything
 //	      admin:read:accounts: grants admin read access to accounts
-//	      admin:read:domain_allows: grants admin read access to domain_allows
-//	      admin:read:domain_blocks: grants admin read access to domain_blocks
+//	      admin:read:custom_emojis: grants admin read access to custom emojis
+//	      admin:read:domain_allows: grants admin read access to domain allows
+//	      admin:read:domain_blocks: grants admin read access to domain blocks
 //	      admin:read:reports: grants admin read access to reports
 //	      admin:write: grants admin write access to everything
 //	      admin:write:accounts: grants write read access to accounts
-//	      admin:write:domain_allows: grants admin write access to domain_allows
-//	      admin:write:domain_blocks: grants write read access to domain_blocks
+//	      admin:write:custom_emojis: grants admin write access to custom emojis
+//	      admin:write:domain_allows: grants admin write access to domain allows
+//	      admin:write:domain_blocks: grants write read access to domain blocks
 //	      admin:write:reports: grants admin write access to reports
 //	      profile: grants read access to verify_credentials
 //	      push: grants read/write access to push
diff --git a/internal/api/client/admin/emojicategoriesget.go b/internal/api/client/admin/emojicategoriesget.go
index 37d6f12f3..c2a8cbabb 100644
--- a/internal/api/client/admin/emojicategoriesget.go
+++ b/internal/api/client/admin/emojicategoriesget.go
@@ -39,7 +39,7 @@ import (
 //
 //	security:
 //	- OAuth2 Bearer:
-//		- admin:read
+//		- admin:read:custom_emojis
 //
 //	responses:
 //		'200':
@@ -63,7 +63,7 @@ import (
 func (m *Module) EmojiCategoriesGETHandler(c *gin.Context) {
 	authed, errWithCode := apiutil.TokenAuth(c,
 		true, true, true, true,
-		apiutil.ScopeAdminRead,
+		apiutil.ScopeAdminReadCustomEmojis,
 	)
 	if errWithCode != nil {
 		apiutil.ErrorHandler(c, errWithCode, m.processor.InstanceGetV1)
diff --git a/internal/api/client/admin/emojicreate.go b/internal/api/client/admin/emojicreate.go
index c2723042a..04f0602c0 100644
--- a/internal/api/client/admin/emojicreate.go
+++ b/internal/api/client/admin/emojicreate.go
@@ -75,7 +75,7 @@ import (
 //
 //	security:
 //	- OAuth2 Bearer:
-//		- admin:write
+//		- admin:write:custom_emojis
 //
 //	responses:
 //		'200':
@@ -99,7 +99,7 @@ import (
 func (m *Module) EmojiCreatePOSTHandler(c *gin.Context) {
 	authed, errWithCode := apiutil.TokenAuth(c,
 		true, true, true, true,
-		apiutil.ScopeAdminWrite,
+		apiutil.ScopeAdminWriteCustomEmojis,
 	)
 	if errWithCode != nil {
 		apiutil.ErrorHandler(c, errWithCode, m.processor.InstanceGetV1)
diff --git a/internal/api/client/admin/emojidelete.go b/internal/api/client/admin/emojidelete.go
index 7809608e3..83c49a92a 100644
--- a/internal/api/client/admin/emojidelete.go
+++ b/internal/api/client/admin/emojidelete.go
@@ -53,7 +53,7 @@ import (
 //
 //	security:
 //	- OAuth2 Bearer:
-//		- admin:write
+//		- admin:write:custom_emojis
 //
 //	responses:
 //		'200':
@@ -75,7 +75,7 @@ import (
 func (m *Module) EmojiDELETEHandler(c *gin.Context) {
 	authed, errWithCode := apiutil.TokenAuth(c,
 		true, true, true, true,
-		apiutil.ScopeAdminWrite,
+		apiutil.ScopeAdminWriteCustomEmojis,
 	)
 	if errWithCode != nil {
 		apiutil.ErrorHandler(c, errWithCode, m.processor.InstanceGetV1)
diff --git a/internal/api/client/admin/emojiget.go b/internal/api/client/admin/emojiget.go
index 5abed2aaa..1ae7eb9e9 100644
--- a/internal/api/client/admin/emojiget.go
+++ b/internal/api/client/admin/emojiget.go
@@ -47,7 +47,7 @@ import (
 //
 //	security:
 //	- OAuth2 Bearer:
-//		- admin:read
+//		- admin:read:custom_emojis
 //
 //	responses:
 //		'200':
@@ -69,7 +69,7 @@ import (
 func (m *Module) EmojiGETHandler(c *gin.Context) {
 	authed, errWithCode := apiutil.TokenAuth(c,
 		true, true, true, true,
-		apiutil.ScopeAdminRead,
+		apiutil.ScopeAdminReadCustomEmojis,
 	)
 	if errWithCode != nil {
 		apiutil.ErrorHandler(c, errWithCode, m.processor.InstanceGetV1)
diff --git a/internal/api/client/admin/emojisget.go b/internal/api/client/admin/emojisget.go
index d9cf508ce..4dbbd7f53 100644
--- a/internal/api/client/admin/emojisget.go
+++ b/internal/api/client/admin/emojisget.go
@@ -100,7 +100,7 @@ import (
 //
 //	security:
 //	- OAuth2 Bearer:
-//		- admin:read
+//		- admin:read:custom_emojis
 //
 //	responses:
 //		'200':
@@ -128,7 +128,7 @@ import (
 func (m *Module) EmojisGETHandler(c *gin.Context) {
 	authed, errWithCode := apiutil.TokenAuth(c,
 		true, true, true, true,
-		apiutil.ScopeAdminRead,
+		apiutil.ScopeAdminReadCustomEmojis,
 	)
 	if errWithCode != nil {
 		apiutil.ErrorHandler(c, errWithCode, m.processor.InstanceGetV1)
diff --git a/internal/api/client/admin/emojiupdate.go b/internal/api/client/admin/emojiupdate.go
index 807f24844..d1576a15d 100644
--- a/internal/api/client/admin/emojiupdate.go
+++ b/internal/api/client/admin/emojiupdate.go
@@ -104,7 +104,7 @@ import (
 //
 //	security:
 //	- OAuth2 Bearer:
-//		- admin:write
+//		- admin:write:custom_emojis
 //
 //	responses:
 //		'200':
@@ -126,7 +126,7 @@ import (
 func (m *Module) EmojiPATCHHandler(c *gin.Context) {
 	authed, errWithCode := apiutil.TokenAuth(c,
 		true, true, true, true,
-		apiutil.ScopeAdminWrite,
+		apiutil.ScopeAdminWriteCustomEmojis,
 	)
 	if errWithCode != nil {
 		apiutil.ErrorHandler(c, errWithCode, m.processor.InstanceGetV1)
diff --git a/internal/api/util/scopes.go b/internal/api/util/scopes.go
index 492fa9dad..13e547286 100644
--- a/internal/api/util/scopes.go
+++ b/internal/api/util/scopes.go
@@ -86,12 +86,14 @@ const (
 	ScopeWriteStatuses          Scope = ScopeWrite + ":" + scopeStatuses
 	ScopeAdminReadAccounts      Scope = ScopeAdminRead + ":" + scopeAccounts
 	ScopeAdminWriteAccounts     Scope = ScopeAdminWrite + ":" + scopeAccounts
-	ScopeAdminReadReports       Scope = ScopeAdminRead + ":" + scopeReports
-	ScopeAdminWriteReports      Scope = ScopeAdminWrite + ":" + scopeReports
+	ScopeAdminReadCustomEmojis  Scope = ScopeAdminRead + ":" + scopeCustomEmojis
+	ScopeAdminWriteCustomEmojis Scope = ScopeAdminWrite + ":" + scopeCustomEmojis
 	ScopeAdminReadDomainAllows  Scope = ScopeAdminRead + ":" + scopeDomainAllows
 	ScopeAdminWriteDomainAllows Scope = ScopeAdminWrite + ":" + scopeDomainAllows
 	ScopeAdminReadDomainBlocks  Scope = ScopeAdminRead + ":" + scopeDomainBlocks
 	ScopeAdminWriteDomainBlocks Scope = ScopeAdminWrite + ":" + scopeDomainBlocks
+	ScopeAdminReadReports       Scope = ScopeAdminRead + ":" + scopeReports
+	ScopeAdminWriteReports      Scope = ScopeAdminWrite + ":" + scopeReports
 )
 
 // Permits returns true if the
diff --git a/test/swagger.sh b/test/swagger.sh
index c7644c1af..81962913d 100755
--- a/test/swagger.sh
+++ b/test/swagger.sh
@@ -22,7 +22,7 @@ trap cleanup INT TERM EXIT
 swagger_cmd generate spec --scan-models --exclude-deps --output "${regenerated_swagger_spec}"
 if ! diff -u "${swagger_spec}" "${regenerated_swagger_spec}" > /dev/null; then
   echo "${swagger_spec} is out of date. Please run the following command to update it:" >&2
-  echo "  go run github.com/go-swagger/go-swagger/cmd/swagger generate spec --scan-models --exclude-deps --output ${swagger_spec}" >&2
+  echo "  go run ./vendor/github.com/go-swagger/go-swagger/cmd/swagger generate spec --scan-models --exclude-deps --output ${swagger_spec}" >&2
   exit 1
 fi
 
diff --git a/web/source/settings/lib/types/scopes.ts b/web/source/settings/lib/types/scopes.ts
index 2bf5c21b4..c307bff21 100644
--- a/web/source/settings/lib/types/scopes.ts
+++ b/web/source/settings/lib/types/scopes.ts
@@ -24,6 +24,7 @@ const scopeApplications  = "applications";
 const scopeBlocks        = "blocks";
 const scopeBookmarks     = "bookmarks";
 const scopeConversations = "conversations";
+const scopeCustomEmojis  = "custom_emojis";
 const scopeDomainAllows  = "domain_allows";
 const scopeDomainBlocks  = "domain_blocks";
 const scopeFavourites    = "favourites";
@@ -58,6 +59,7 @@ export const ScopeWriteBlocks            = ScopeWrite + ":" + scopeBlocks;
 export const ScopeReadBookmarks          = ScopeRead + ":" + scopeBookmarks;
 export const ScopeWriteBookmarks         = ScopeWrite + ":" + scopeBookmarks;
 export const ScopeWriteConversations     = ScopeWrite + ":" + scopeConversations;
+export const ScopeReadCustomEmojis       = ScopeRead + ":" + scopeCustomEmojis;
 export const ScopeReadFavourites         = ScopeRead + ":" + scopeFavourites;
 export const ScopeWriteFavourites        = ScopeWrite + ":" + scopeFavourites;
 export const ScopeReadFilters            = ScopeRead + ":" + scopeFilters;
@@ -77,12 +79,14 @@ export const ScopeReadStatuses           = ScopeRead + ":" + scopeStatuses;
 export const ScopeWriteStatuses          = ScopeWrite + ":" + scopeStatuses;
 export const ScopeAdminReadAccounts      = ScopeAdminRead + ":" + scopeAccounts;
 export const ScopeAdminWriteAccounts     = ScopeAdminWrite + ":" + scopeAccounts;
-export const ScopeAdminReadReports       = ScopeAdminRead + ":" + scopeReports;
-export const ScopeAdminWriteReports      = ScopeAdminWrite + ":" + scopeReports;
+export const ScopeAdminReadCustomEmojis  = ScopeAdminRead + ":" + scopeCustomEmojis;
+export const ScopeAdminWriteCustomEmojis = ScopeAdminWrite + ":" + scopeCustomEmojis;
 export const ScopeAdminReadDomainAllows  = ScopeAdminRead + ":" + scopeDomainAllows;
 export const ScopeAdminWriteDomainAllows = ScopeAdminWrite + ":" + scopeDomainAllows;
 export const ScopeAdminReadDomainBlocks  = ScopeAdminRead + ":" + scopeDomainBlocks;
 export const ScopeAdminWriteDomainBlocks = ScopeAdminWrite + ":" + scopeDomainBlocks;
+export const ScopeAdminReadReports       = ScopeAdminRead + ":" + scopeReports;
+export const ScopeAdminWriteReports      = ScopeAdminWrite + ":" + scopeReports;
 
 export const ValidScopes = [
 	ScopeProfile,
@@ -101,6 +105,7 @@ export const ValidScopes = [
 	ScopeReadBookmarks,
 	ScopeWriteBookmarks,
 	ScopeWriteConversations,
+	ScopeReadCustomEmojis,
 	ScopeReadFavourites,
 	ScopeWriteFavourites,
 	ScopeReadFilters,
@@ -120,12 +125,14 @@ export const ValidScopes = [
 	ScopeWriteStatuses,
 	ScopeAdminReadAccounts,
 	ScopeAdminWriteAccounts,
-	ScopeAdminReadReports,
-	ScopeAdminWriteReports,
+	ScopeAdminReadCustomEmojis,
+	ScopeAdminWriteCustomEmojis,
 	ScopeAdminReadDomainAllows,
 	ScopeAdminWriteDomainAllows,
 	ScopeAdminReadDomainBlocks,
 	ScopeAdminWriteDomainBlocks,
+	ScopeAdminReadReports,
+	ScopeAdminWriteReports,
 ];
 
 export const ValidTopLevelScopes = [