Adding defense against self-cursing and self-blessing

config/secrets.toml.template

@@ -11,3 +11,6 @@ your_chat = "BOT-TOKEN"
 
 [teamspeak]
 pass = "your-teamspeak-serveradmin-password"
+
+[curse]
+banlist = {}

src/app.py

@@ -97,11 +97,11 @@ def execute():
         bot_id = BOTS_LOOKUP[msg.group_id]
         if response.is_success:
             if response.txt is not None:
-                post_message(response.txt, bot_id=bot_id)
+                post_message(response.txt, bot_id)
             if response.img is not None:
-                post_message(response.img, bot_id=bot_id)
+                post_message(response.img, bot_id)
         else:
-            post_message(response.failure_msg, bot_id=bot_id)
+            post_message(response.failure_msg, bot_id)
             app.logger.warning(f"Failed command response: {response}")
 
         t = time.time() - t

src/plugins/curse.py

@@ -2,6 +2,8 @@
 from sqlalchemy import Column, Integer, String
 
 from command_system import RollbotResponse, RollbotFailure, as_plugin, ModelBase, pop_arg
+from config import get_secret, BOTS_LOOKUP
+from util import post_message
 
 
 class CurseBlessScore(ModelBase):
@@ -12,8 +14,7 @@ class CurseBlessScore(ModelBase):
     blessings = Column(Integer)
 
 
-def get_score(db, group_id, name):
-    person_id = name.strip().lower()
+def get_score(db, group_id, person_id):
     score = db.query(CurseBlessScore).get((group_id, person_id))
     if not score:
         score = CurseBlessScore(group_id=group_id, person_id=person_id, curses=0, blessings=0)
@@ -21,6 +22,10 @@ def get_score(db, group_id, name):
     return score
 
 
+def is_banned(msg, person_id):
+    return msg.sender_id in BAN_LIST and person_id in BAN_LIST[msg.sender_id]
+
+
 def fmt_times(n):
     return str(n) + (" time" if n == 1 else " times")
 
@@ -96,6 +101,7 @@ SUBC_MAP = {
     "clearall": curse_clearall,
     "top": curse_top,
 }
+BAN_LIST = get_secret("curse.banlist")
 
 
 @as_plugin
@@ -103,7 +109,10 @@ def curse(db, msg):
     # TODO might be nice to add subcommands to this later
     name, args = pop_arg(msg.raw_args)
     if not name.startswith("!"):
-        score = get_score(db, msg.group_id, name)
+        person_id = name.strip().lower()
+        if is_banned(msg, person_id):
+            return RollbotResponse(msg, txt="Hey! You aren't allowed to affect that person's score!")
+        score = get_score(db, msg.group_id, person_id)
         # Note we do this instead of += b/c that can create race conditions in sqlalchemy
         score.curses = score.curses + 1
         return get_response(msg, name, score)
@@ -121,6 +130,12 @@ def curse(db, msg):
 @as_plugin
 def bless(db, msg):
     name, _ = pop_arg(msg.raw_args)
-    score = get_score(db, msg.group_id, name)
+    if name.startswith("!"):
+        return RollbotResponse(msg, txt=f"Sorry! Subcommands have to go on !curse for now - this will be fixed in the future!")
+    person_id = name.strip().lower()
+    if is_banned(msg, person_id):
+        post_message("Hey! You aren't allowed to affect that person's score! And cheaters never propser!", BOTS_LOOKUP[msg.group_id])
+        return RollbotResponse(msg, txt=f"!curse {BAN_LIST[msg.sender_id][0]} for trying to bless someone they can't!")
+    score = get_score(db, msg.group_id, person_id)
     score.blessings = score.blessings + 1
     return get_response(msg, name, score)