block viewers from convicting (#746)

app/controllers/api/admin/v1/admin_controller.rb

@@ -2,6 +2,8 @@ module Api
   module Admin
     module V1
       class AdminController < Api::Admin::V1::ApplicationController
+        before_action :can_write!, only: [ :user_convict ]
+
         def check
           api_key = current_admin_api_key
           creator = User.find(api_key.user_id)
@@ -367,6 +369,13 @@ module Api
 
         private
 
+        def can_write!
+          # blocks viewers
+          unless current_user.admin_level.in?([ "admin", "superadmin" ])
+            render json: { error: "no perms lmaooo" }, status: :forbidden
+          end
+        end
+
         def find_user_by_id
           user_id = params[:id]