From 210f03b0d3bd0bc1576e3340cbae311dde160328 Mon Sep 17 00:00:00 2001
From: Marcin Macierzanka <mmacierzanka@grzana.dev>
Date: Sun, 13 Sep 2026 16:14:38 +0200
Subject: [PATCH] feat: validate bot voice channel permissions

---
 frontend/src/components/VoiceChannelPanel.vue |  2 +-
 tests/test_api_surface.py                     | 31 +++++++++++++++++++
 zyrarbot/ui/api/routers/voice_router.py       |  6 ++++
 zyrarbot/ui/api/status_service.py             |  1 +
 zyrarbot/ui/bot/cogs/common.py                | 12 ++++++-
 zyrarbot/ui/bot/cogs/voice_cog.py             | 10 ++++++
 6 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/frontend/src/components/VoiceChannelPanel.vue b/frontend/src/components/VoiceChannelPanel.vue
index d978869..66b9ceb 100644
--- a/frontend/src/components/VoiceChannelPanel.vue
+++ b/frontend/src/components/VoiceChannelPanel.vue
@@ -102,7 +102,7 @@ async function saveDefaultPlays() {
           :key="channel.channel_id"
           :value="channel.channel_id"
         >
-          {{ channel.guild_name }} - {{ channel.channel_name }}
+          {{ channel.channel_name }}
         </option>
       </select>
       <button
diff --git a/tests/test_api_surface.py b/tests/test_api_surface.py
index 806ea7c..37671c7 100644
--- a/tests/test_api_surface.py
+++ b/tests/test_api_surface.py
@@ -86,6 +86,37 @@ class ApiSurfaceTest(unittest.TestCase):
         self.assertEqual(result, {"status": "restarting"})
         mock_restart.assert_called_once()
 
+    def test_voice_channels_payload_filters_unconnectable_channels(self):
+        from unittest.mock import MagicMock
+        from zyrarbot.ui.api.status_service import StatusService
+
+        mock_guild = MagicMock()
+        mock_guild.id = 123
+        mock_guild.name = "Test Guild"
+
+        ch1 = MagicMock()
+        ch1.id = 1
+        ch1.name = "Allowed Voice"
+        ch1.permissions_for.return_value.connect = True
+
+        ch2 = MagicMock()
+        ch2.id = 2
+        ch2.name = "Forbidden Voice"
+        ch2.permissions_for.return_value.connect = False
+
+        mock_guild.voice_channels = [ch1, ch2]
+        mock_guild.me = MagicMock()
+
+        mock_guilds_resolver = MagicMock()
+        mock_guilds_resolver.guilds.return_value = [mock_guild]
+
+        service = StatusService(MagicMock(), mock_guilds_resolver)
+        channels = service._voice_channels_payload(mock_guild)
+
+        self.assertEqual(len(channels), 1)
+        self.assertEqual(channels[0]["channel_id"], "1")
+        self.assertEqual(channels[0]["channel_name"], "Allowed Voice")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/zyrarbot/ui/api/routers/voice_router.py b/zyrarbot/ui/api/routers/voice_router.py
index 22c55dc..14e31f4 100644
--- a/zyrarbot/ui/api/routers/voice_router.py
+++ b/zyrarbot/ui/api/routers/voice_router.py
@@ -63,6 +63,12 @@ async def connect(
     if not isinstance(channel, discord.VoiceChannel):
         raise HTTPException(status_code=404, detail="Voice channel not found")
 
+    if channel.guild.me and not channel.permissions_for(channel.guild.me).connect:
+        raise HTTPException(
+            status_code=403,
+            detail=f"Bot nie ma uprawnień do połączenia z kanałem {channel.name}",
+        )
+
     guild_id = channel.guild.id
     # Rozłączamy wyłącznie na tym samym serwerze - inne serwery grają dalej.
     existing = guilds.voice_client(guild_id)
diff --git a/zyrarbot/ui/api/status_service.py b/zyrarbot/ui/api/status_service.py
index 8e3c6d5..0cd8d21 100644
--- a/zyrarbot/ui/api/status_service.py
+++ b/zyrarbot/ui/api/status_service.py
@@ -138,6 +138,7 @@ class StatusService:
             for guild in self._guilds.guilds()
             if selected_guild is None or guild.id == selected_guild.id
             for channel in guild.voice_channels
+            if guild.me and channel.permissions_for(guild.me).connect
         ]
 
     def _guilds_payload(self) -> list[dict[str, Any]]:
diff --git a/zyrarbot/ui/bot/cogs/common.py b/zyrarbot/ui/bot/cogs/common.py
index 7d55496..b83c742 100644
--- a/zyrarbot/ui/bot/cogs/common.py
+++ b/zyrarbot/ui/bot/cogs/common.py
@@ -24,7 +24,17 @@ class MusicCogBase(commands.Cog):
 
         voice_client = interaction.guild.voice_client
         if voice_client is None:
-            await interaction.user.voice.channel.connect()
+            user_channel = interaction.user.voice.channel
+            if interaction.guild.me and not user_channel.permissions_for(interaction.guild.me).connect:
+                await interaction.response.send_message(
+                    embed=message_embed(
+                        "Brak uprawnień",
+                        f"Bot nie ma uprawnień do połączenia z kanałem **{user_channel.name}**.",
+                    ),
+                    ephemeral=True,
+                )
+                return False
+            await user_channel.connect()
         elif voice_client.channel != interaction.user.voice.channel:
             await interaction.response.send_message(
                 embed=message_embed(
diff --git a/zyrarbot/ui/bot/cogs/voice_cog.py b/zyrarbot/ui/bot/cogs/voice_cog.py
index 8ae6691..312dc87 100644
--- a/zyrarbot/ui/bot/cogs/voice_cog.py
+++ b/zyrarbot/ui/bot/cogs/voice_cog.py
@@ -34,6 +34,16 @@ class VoiceCog(MusicCogBase, name="Voice"):
     async def connect(
         self, interaction: discord.Interaction, channel: discord.VoiceChannel
     ) -> None:
+        if interaction.guild.me and not channel.permissions_for(interaction.guild.me).connect:
+            await interaction.response.send_message(
+                embed=message_embed(
+                    "Brak uprawnień",
+                    f"Bot nie ma uprawnień do połączenia z kanałem **{channel.name}**.",
+                ),
+                ephemeral=True,
+            )
+            return
+
         existing = self.player.voice_client(interaction.guild.id)
         if existing:
             await existing.disconnect()