feat: view customize on member's role

backend/middleware/auth.js

@@ -56,23 +56,47 @@ function authMiddleware(sequelize) {
    */
   async function verifyProjectVisible(req, res, next) {
     const Project = defineProject(sequelize, DataTypes);
+    const Member = defineMember(sequelize, DataTypes);
+    Project.hasMany(Member, { foreignKey: 'projectId' });
 
     const projectId = req.params.projectId || req.query.projectId;
     if (!projectId) {
       return res.status(400).json({ error: 'projectId is required' });
     }
 
-    const project = await Project.findByPk(projectId);
+    const project = await Project.findOne({
+      where: { id: projectId },
+      include: [
+        {
+          model: Member,
+          where: { userId: req.userId },
+          required: false,
+        },
+      ],
+    });
     if (!project) {
       return res.status(404).send('Project not found');
     }
 
-    // if project is private, only project owner can access
-    if (!project.isPublic && project.userId !== req.userId) {
-      return res.status(403).json({ error: 'Forbidden' });
+    // if project is public, everyone can see
+    if (project.isPublic) {
+      next();
+      return;
     }
 
-    next();
+    // if project is private, owner and project member can see
+    if (project.userId === req.userId) {
+      next();
+      return;
+    }
+
+    const member = project.Members && project.Members[0];
+    if (member) {
+      next();
+      return;
+    }
+
+    return res.status(403).json({ error: 'Forbidden' });
   }
 
   /**

backend/routes/members/index.js

@@ -1,17 +1,16 @@
 const express = require('express');
 const router = express.Router();
-const defineMember = require('../../models/members');
 const defineUser = require('../../models/users');
+const defineMember = require('../../models/members');
 const { DataTypes } = require('sequelize');
 
 module.exports = function (sequelize) {
-  const { verifySignedIn, verifyProjectManager } = require('../../middleware/auth')(sequelize);
-  const Member = defineMember(sequelize, DataTypes);
+  const { verifySignedIn, verifyProjectVisible } = require('../../middleware/auth')(sequelize);
   const User = defineUser(sequelize, DataTypes);
-
+  const Member = defineMember(sequelize, DataTypes);
   Member.belongsTo(User, { foreignKey: 'userId' });
 
-  router.get('/', verifySignedIn, verifyProjectManager, async (req, res) => {
+  router.get('/', verifySignedIn, verifyProjectVisible, async (req, res) => {
     const { projectId } = req.query;
 
     if (!projectId) {