feat: inplement auth for cases

backend/index.js

@@ -66,13 +66,11 @@ const casesShowRoute = require('./routes/cases/show')(sequelize);
 const casesNewRoute = require('./routes/cases/new')(sequelize);
 const casesEditRoute = require('./routes/cases/edit')(sequelize);
 const casesDeleteRoute = require('./routes/cases/delete')(sequelize);
-const casesBulkDeleteRoute = require('./routes/cases/bulkDelete')(sequelize);
 app.use('/cases', casesIndexRoute);
 app.use('/cases', casesShowRoute);
 app.use('/cases', casesNewRoute);
 app.use('/cases', casesEditRoute);
 app.use('/cases', casesDeleteRoute);
-app.use('/cases', casesBulkDeleteRoute);
 
 // "/steps"
 const stepsNewRoute = require('./routes/steps/new')(sequelize);

backend/routes/cases/bulkDelete.js

@@ -1,25 +0,0 @@
-const express = require('express');
-const router = express.Router();
-const defineCase = require('../../models/cases');
-const { DataTypes } = require('sequelize');
-
-module.exports = function (sequelize) {
-  const Case = defineCase(sequelize, DataTypes);
-
-  router.post('/bulkdelete', async (req, res) => {
-    const { caseIds } = req.body;
-    if (!caseIds || !Array.isArray(caseIds)) {
-      return res.status(400).send('Invalid caseIds array');
-    }
-
-    try {
-      await Case.destroy({ where: { id: caseIds } });
-      res.status(204).send();
-    } catch (error) {
-      console.error(error);
-      res.status(500).send('Internal Server Error');
-    }
-  });
-
-  return router;
-};

backend/routes/cases/delete.js

@@ -4,16 +4,17 @@ const defineCase = require('../../models/cases');
 const { DataTypes } = require('sequelize');
 
 module.exports = function (sequelize) {
+  const { verifySignedIn, verifyProjectDeveloper } = require('../../middleware/auth')(sequelize);
   const Case = defineCase(sequelize, DataTypes);
 
-  router.delete('/:caseId', async (req, res) => {
-    const caseId = req.params.caseId;
+  router.post('/bulkdelete', verifySignedIn, verifyProjectDeveloper, async (req, res) => {
+    const { caseIds } = req.body;
+    if (!caseIds || !Array.isArray(caseIds)) {
+      return res.status(400).send('Invalid caseIds array');
+    }
+
     try {
-      const testcase = await Case.findByPk(caseId);
-      if (!testcase) {
-        return res.status(404).send('Case not found');
-      }
-      await testcase.destroy();
+      await Case.destroy({ where: { id: caseIds } });
       res.status(204).send();
     } catch (error) {
       console.error(error);

backend/routes/cases/edit.js

@@ -5,10 +5,11 @@ const defineStep = require('../../models/steps');
 const { DataTypes } = require('sequelize');
 
 module.exports = function (sequelize) {
+  const { verifySignedIn, verifyProjectDeveloper } = require('../../middleware/auth')(sequelize);
   const Case = defineCase(sequelize, DataTypes);
   const Step = defineStep(sequelize, DataTypes);
 
-  router.put('/:caseId', async (req, res) => {
+  router.put('/:caseId', verifySignedIn, verifyProjectDeveloper, async (req, res) => {
     const caseId = req.params.caseId;
     const updateCase = req.body;
     try {

backend/routes/cases/index.js

@@ -5,8 +5,9 @@ const { DataTypes } = require('sequelize');
 
 module.exports = function (sequelize) {
   const Case = defineCase(sequelize, DataTypes);
+  const { verifySignedIn, verifyProjectVisible } = require('../../middleware/auth')(sequelize);
 
-  router.get('/', async (req, res) => {
+  router.get('/', verifySignedIn, verifyProjectVisible, async (req, res) => {
     const { folderId } = req.query;
 
     if (!folderId) {

backend/routes/cases/new.js

@@ -14,9 +14,10 @@ function isEmpty(value) {
 }
 
 module.exports = function (sequelize) {
+  const { verifySignedIn, verifyProjectDeveloper } = require('../../middleware/auth')(sequelize);
   const Case = defineCase(sequelize, DataTypes);
 
-  router.post('/', async (req, res) => {
+  router.post('/', verifySignedIn, verifyProjectDeveloper, async (req, res) => {
     try {
       if (
         requiredFields.some((field) => {

backend/routes/cases/show.js

@@ -13,8 +13,9 @@ module.exports = function (sequelize) {
   Step.belongsToMany(Case, { through: 'caseSteps' });
   Case.belongsToMany(Attachment, { through: 'caseAttachments' });
   Attachment.belongsToMany(Case, { through: 'caseAttachments' });
+  const { verifySignedIn, verifyProjectVisible } = require('../../middleware/auth')(sequelize);
 
-  router.get('/:caseId', async (req, res) => {
+  router.get('/:caseId', verifySignedIn, verifyProjectVisible, async (req, res) => {
     const caseId = req.params.caseId;
 
     if (!caseId) {