yellowadmin/pp-tcms
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check user auth in api request

Browse Source
This commit is contained in:
Takeshi Kimata
2024-05-25 23:34:38 +09:00
parent 4092b14f3c
commit 3984373025
16 changed files with 149 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
backend/routes/projects/delete.js
View File

@@ -4,9 +4,10 @@ const defineProject = require('../../models/projects');
const { DataTypes } = require('sequelize');
module.exports = function (sequelize) {
const { verifySignedIn, verifyProjectOwner } = require('../../middleware/auth')(sequelize);
const Project = defineProject(sequelize, DataTypes);
router.delete('/:projectId', async (req, res) => {
router.delete('/:projectId', verifySignedIn, verifyProjectOwner, async (req, res) => {
const projectId = req.params.projectId;
try {
const project = await Project.findByPk(projectId);

3
backend/routes/projects/edit.js
View File

@@ -4,9 +4,10 @@ const defineProject = require('../../models/projects');
const { DataTypes } = require('sequelize');
module.exports = function (sequelize) {
const { verifySignedIn, verifyProjectOwner } = require('../../middleware/auth')(sequelize);
const Project = defineProject(sequelize, DataTypes);
router.put('/:projectId', async (req, res) => {
router.put('/:projectId', verifySignedIn, verifyProjectOwner, async (req, res) => {
const projectId = req.params.projectId;
const { name, detail, isPublic } = req.body;
try {

12
backend/routes/projects/index.js
View File

@@ -1,15 +1,19 @@
const express = require('express');
const router = express.Router();
const defineProject = require('../../models/projects');
const { DataTypes } = require('sequelize');
const { verifySinedIn } = require('../../middleware/auth');
const { DataTypes, Op } = require('sequelize');
module.exports = function (sequelize) {
const { verifySignedIn } = require('../../middleware/auth')(sequelize);
const Project = defineProject(sequelize, DataTypes);
router.get('/', verifySinedIn, async (req, res) => {
router.get('/', verifySignedIn, async (req, res) => {
try {
const projects = await Project.findAll();
const projects = await Project.findAll({
where: {
[Op.or]: [{ isPublic: true }, { userId: req.userId }],
},
});
res.json(projects);
} catch (error) {
console.error(error);

7
backend/routes/projects/new.js
View File

@@ -4,16 +4,17 @@ const defineProject = require('../../models/projects');
const { DataTypes } = require('sequelize');
module.exports = function (sequelize) {
const { verifySignedIn } = require('../../middleware/auth')(sequelize);
const Project = defineProject(sequelize, DataTypes);
router.post('/', async (req, res) => {
router.post('/', verifySignedIn, async (req, res) => {
try {
const { name, detail, isPublic, userId } = req.body;
const { name, detail, isPublic } = req.body;
const newProject = await Project.create({
name,
detail,
isPublic,
userId,
userId: req.userId,
});
res.json(newProject);
} catch (error) {

10
backend/routes/projects/show.js
View File

@@ -3,25 +3,19 @@ const router = express.Router();
const defineProject = require('../../models/projects');
const defineFolder = require('../../models/folders');
const { DataTypes } = require('sequelize');
const { verifySinedIn } = require('../../middleware/auth');
module.exports = function (sequelize) {
const { verifySignedIn, verifyProjectVisible } = require('../../middleware/auth')(sequelize);
const Project = defineProject(sequelize, DataTypes);
const Folder = defineFolder(sequelize, DataTypes);
Project.hasMany(Folder, { foreignKey: 'projectId' });
router.get('/:projectId', verifySinedIn, async (req, res) => {
router.get('/:projectId', verifySignedIn, verifyProjectVisible, async (req, res) => {
const projectId = req.params.projectId;
if (!projectId) {
return res.status(400).json({ error: 'projectId is required' });
}
// if project is private, only project owner can access
if (!project.isPublic && project.userId !== req.userId) {
return res.status(403).json({ error: 'Forbidden' });
}
try {
const project = await Project.findByPk(projectId, {
include: [