From 1bef5d119dd0772f5ac48d6c930f91615062f287 Mon Sep 17 00:00:00 2001
From: Irevoire <tamo@meilisearch.com>
Date: Sat, 22 Oct 2022 12:52:36 +0200
Subject: [PATCH] fix the api keys for the tasks route

---
 meilisearch-auth/src/store.rs                | 3 ++-
 meilisearch-http/src/routes/indexes_swap.rs  | 2 +-
 meilisearch-http/tests/auth/authorization.rs | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/meilisearch-auth/src/store.rs b/meilisearch-auth/src/store.rs
index 6e5f6514c..b3f9ed672 100644
--- a/meilisearch-auth/src/store.rs
+++ b/meilisearch-auth/src/store.rs
@@ -99,6 +99,7 @@ impl HeedAuthStore {
                             Action::IndexesDelete,
                             Action::IndexesGet,
                             Action::IndexesUpdate,
+                            Action::IndexesSwap,
                         ]
                         .iter(),
                     );
@@ -110,7 +111,7 @@ impl HeedAuthStore {
                     actions.insert(Action::DumpsCreate);
                 }
                 Action::TasksAll => {
-                    actions.insert(Action::TasksGet);
+                    actions.extend([Action::TasksGet, Action::TasksDelete, Action::TasksCancel]);
                 }
                 Action::StatsAll => {
                     actions.insert(Action::StatsGet);
diff --git a/meilisearch-http/src/routes/indexes_swap.rs b/meilisearch-http/src/routes/indexes_swap.rs
index acbde1189..f55949619 100644
--- a/meilisearch-http/src/routes/indexes_swap.rs
+++ b/meilisearch-http/src/routes/indexes_swap.rs
@@ -36,7 +36,7 @@ pub async fn indexes_swap(
     let mut swaps = vec![];
     let mut indexes_set = HashSet::<String>::default();
     for IndexesSwapPayload { indexes: (lhs, rhs) } in params.into_inner().into_iter() {
-        if !search_rules.is_index_authorized(&lhs) || !search_rules.is_index_authorized(&lhs) {
+        if !search_rules.is_index_authorized(&lhs) || !search_rules.is_index_authorized(&rhs) {
             return Err(ResponseError::from_msg(
                 "TODO: error message when we swap with an index were not allowed to access"
                     .to_owned(),
diff --git a/meilisearch-http/tests/auth/authorization.rs b/meilisearch-http/tests/auth/authorization.rs
index 77d76559d..23a126409 100644
--- a/meilisearch-http/tests/auth/authorization.rs
+++ b/meilisearch-http/tests/auth/authorization.rs
@@ -24,9 +24,9 @@ pub static AUTHORIZATIONS: Lazy<HashMap<(&'static str, &'static str), HashSet<&'
             ("PATCH",   "/indexes/products/") =>                               hashset!{"indexes.update", "indexes.*", "*"},
             ("GET",     "/indexes/products/") =>                               hashset!{"indexes.get", "indexes.*", "*"},
             ("DELETE",  "/indexes/products/") =>                               hashset!{"indexes.delete", "indexes.*", "*"},
-            ("POST",    "/indexes-swap") =>                                    hashset!{"indexes.swap", "indexes.*", "*"},
             ("POST",    "/indexes") =>                                         hashset!{"indexes.create", "indexes.*", "*"},
             ("GET",     "/indexes") =>                                         hashset!{"indexes.get", "indexes.*", "*"},
+            ("POST",    "/indexes-swap") =>                                    hashset!{"indexes.swap", "indexes.*", "*"},
             ("GET",     "/indexes/products/settings") =>                       hashset!{"settings.get", "settings.*", "*"},
             ("GET",     "/indexes/products/settings/displayed-attributes") =>  hashset!{"settings.get", "settings.*", "*"},
             ("GET",     "/indexes/products/settings/distinct-attribute") =>    hashset!{"settings.get", "settings.*", "*"},