commands: gate admin, trigger, cron and recording behind permissions

4 files changed, 18 insertions, 14 deletions

diff --git a/src/commands/cron.rs b/src/commands/cron.rs
index a645581..47c3d62 100644
--- a/src/commands/cron.rs
+++ b/src/commands/cron.rs
@@ -11,6 +11,8 @@ type Context<'a> = poise::Context<'a, Data, Error>;
 /// Cron job management
 #[poise::command(
     slash_command,
+    guild_only,
+    required_permissions = "MANAGE_GUILD",
     subcommands("dodaj_audio", "dodaj_wiadomość", "pokaż", "usuń", "pauza", "wznów",)
 )]
 pub async fn cron(_ctx: Context<'_>) -> Result<()> {
@@ -18,7 +20,7 @@ pub async fn cron(_ctx: Context<'_>) -> Result<()> {
 }
 
 /// Schedule audio playback
-#[poise::command(slash_command)]
+#[poise::command(slash_command, guild_only, required_permissions = "MANAGE_GUILD")]
 pub async fn dodaj_audio(
     ctx: Context<'_>,
     #[description = "Cron expression (e.g. \"37 21 * * *\" = every day at 21:37)"] cron_expression: String,
@@ -58,7 +60,7 @@ pub async fn dodaj_audio(
 }
 
 /// Schedule a periodic message
-#[poise::command(slash_command)]
+#[poise::command(slash_command, guild_only, required_permissions = "MANAGE_GUILD")]
 pub async fn dodaj_wiadomość(
     ctx: Context<'_>,
     #[description = "Cron expression (e.g. \"37 21 * * *\" = every day at 21:37)"] cron_expression: String,
@@ -85,7 +87,7 @@ pub async fn dodaj_wiadomość(
 }
 
 /// List all cron jobs
-#[poise::command(slash_command)]
+#[poise::command(slash_command, guild_only, required_permissions = "MANAGE_GUILD")]
 pub async fn pokaż(ctx: Context<'_>) -> Result<()> {
     let jobs = database::list_cron_jobs(&ctx.data().db_pool).await?;
     if jobs.is_empty() {
@@ -119,7 +121,7 @@ pub async fn pokaż(ctx: Context<'_>) -> Result<()> {
 }
 
 /// Remove a cron job
-#[poise::command(slash_command)]
+#[poise::command(slash_command, guild_only, required_permissions = "MANAGE_GUILD")]
 pub async fn usuń(
     ctx: Context<'_>,
     #[description = "ID pracy do usunięcia"] job_id: i64,
@@ -133,7 +135,7 @@ pub async fn usuń(
 }
 
 /// Pause a cron job
-#[poise::command(slash_command)]
+#[poise::command(slash_command, guild_only, required_permissions = "MANAGE_GUILD")]
 pub async fn pauza(
     ctx: Context<'_>,
     #[description = "ID pracy do zapauzowania"] job_id: i64,
@@ -147,7 +149,7 @@ pub async fn pauza(
 }
 
 /// Resume a paused cron job
-#[poise::command(slash_command)]
+#[poise::command(slash_command, guild_only, required_permissions = "MANAGE_GUILD")]
 pub async fn wznów(
     ctx: Context<'_>,
     #[description = "ID pracy cron do wznowienia"] job_id: i64,
diff --git a/src/commands/record.rs b/src/commands/record.rs
index 6f2cfcd..48cbc59 100644
--- a/src/commands/record.rs
+++ b/src/commands/record.rs
@@ -12,7 +12,7 @@ type Context<'a> = poise::Context<'a, crate::Data, crate::error::Error>;
 /// connected to a voice channel, if `RECORDING_ENABLED=true`. This command is a
 /// read-only snapshot — the buffer keeps recording afterwards. Only callable by
 /// someone in the same voice channel as the bot.
-#[poise::command(slash_command)]
+#[poise::command(slash_command, guild_only, required_permissions = "MANAGE_GUILD")]
 pub async fn record(ctx: Context<'_>) -> Result<()> {
     ctx.defer().await?;
     let data = ctx.data();
diff --git a/src/commands/trigger.rs b/src/commands/trigger.rs
index 2a33528..3a91edd 100644
--- a/src/commands/trigger.rs
+++ b/src/commands/trigger.rs
@@ -11,6 +11,8 @@ type Context<'a> = poise::Context<'a, Data, Error>;
 /// Trigger keyword management
 #[poise::command(
     slash_command,
+    guild_only,
+    required_permissions = "MANAGE_GUILD",
     subcommands("create", "add", "remove", "delete", "list", "help",)
 )]
 pub async fn trigger(_ctx: Context<'_>) -> Result<()> {
@@ -18,7 +20,7 @@ pub async fn trigger(_ctx: Context<'_>) -> Result<()> {
 }
 
 /// Create a new trigger group
-#[poise::command(slash_command)]
+#[poise::command(slash_command, guild_only, required_permissions = "MANAGE_GUILD")]
 pub async fn create(
     ctx: Context<'_>,
     #[description = "Logical group name"]
@@ -38,7 +40,7 @@ pub async fn create(
 }
 
 /// Add keywords and/or responses to a trigger group
-#[poise::command(slash_command)]
+#[poise::command(slash_command, guild_only, required_permissions = "MANAGE_GUILD")]
 pub async fn add(
     ctx: Context<'_>,
     #[description = "Existing group name"]
@@ -79,7 +81,7 @@ pub async fn add(
 }
 
 /// Remove keyword or response from a group
-#[poise::command(slash_command)]
+#[poise::command(slash_command, guild_only, required_permissions = "MANAGE_GUILD")]
 pub async fn remove(
     ctx: Context<'_>,
     #[description = "Group name"]
@@ -110,7 +112,7 @@ pub async fn remove(
 }
 
 /// Delete an entire trigger group
-#[poise::command(slash_command)]
+#[poise::command(slash_command, guild_only, required_permissions = "MANAGE_GUILD")]
 pub async fn delete(
     ctx: Context<'_>,
     #[description = "Group name"]
@@ -128,7 +130,7 @@ pub async fn delete(
 }
 
 /// List keywords and responses for a group
-#[poise::command(slash_command)]
+#[poise::command(slash_command, guild_only, required_permissions = "MANAGE_GUILD")]
 pub async fn list(
     ctx: Context<'_>,
     #[description = "Group name"]
@@ -178,7 +180,7 @@ pub async fn list(
 }
 
 /// Display trigger command usage info
-#[poise::command(slash_command)]
+#[poise::command(slash_command, guild_only, required_permissions = "MANAGE_GUILD")]
 pub async fn help(ctx: Context<'_>) -> Result<()> {
     let help = [
         "**Trigger Commands**",
diff --git a/src/commands/utilities.rs b/src/commands/utilities.rs
index 2179ce9..bf93491 100644
--- a/src/commands/utilities.rs
+++ b/src/commands/utilities.rs
@@ -1016,7 +1016,7 @@ pub async fn message_download(ctx: Context<'_>, message: serenity::Message) -> R
 }
 
 /// Echo text to channel
-#[poise::command(slash_command)]
+#[poise::command(slash_command, required_permissions = "MANAGE_MESSAGES")]
 pub async fn say(ctx: Context<'_>, #[description = "Message to send"] text: String) -> Result<()> {
     // Acknowledge the interaction with an invisible ephemeral reply, delete it,
     // then post the actual text as a normal channel message (not a reply to the