fix: hide Unflag package from non-maintainers

Closes: #364
Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

aurweb/pkgbase/actions.py

@@ -38,8 +38,8 @@ def pkgbase_unnotify_instance(request: Request, pkgbase: PackageBase) -> None:
 
 
 def pkgbase_unflag_instance(request: Request, pkgbase: PackageBase) -> None:
-    has_cred = request.user.has_credential(
+    has_cred = request.user.has_credential(creds.PKGBASE_UNFLAG, approved=[
-        creds.PKGBASE_UNFLAG, approved=[pkgbase.Flagger, pkgbase.Maintainer])
+                                           pkgbase.Flagger, pkgbase.Maintainer] + [c.User for c in pkgbase.comaintainers])
     if has_cred:
         with db.begin():
             pkgbase.OutOfDateTS = None

aurweb/pkgbase/util.py

@@ -39,6 +39,9 @@ def make_context(request: Request, pkgbase: PackageBase,
             PackageComaintainer.Priority.asc()
         ).all()
     ]
+    context["unflaggers"] = context["comaintainers"].copy()
+    context["unflaggers"].append(pkgbase.Maintainer)
+
     context["packages_count"] = pkgbase.packages.count()
     context["keywords"] = pkgbase.keywords
     context["comments"] = pkgbase.comments.order_by(

templates/partials/packages/actions.html

@@ -41,6 +41,7 @@
                         </a>
                     </span>
                 </li>
+                {% if request.user.has_credential(creds.PKGBASE_UNFLAG, approved=unflaggers) %}
                 <li>
                     <form action="/pkgbase/{{ pkgbase.Name }}/unflag" method="post">
                         <input class="button text-button"
@@ -51,6 +52,7 @@
                     </form>
                 </li>
                 {% endif %}
+            {% endif %}
             <li>
                 {% if not voted %}
                 <form action="/pkgbase/{{ pkgbase.Name }}/vote" method="post">