4nk/lecoffre-back
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refacto/securize vote deletion

Browse Source
This commit is contained in:
OxSaitama 2023-08-14 14:34:41 +02:00
parent dfdc09845c
commit e7438ae41b
2 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/app/api/idnot/UserController.ts
View File

@ -42,7 +42,7 @@ export default class UserController extends ApiController {
const id = req.params["idnot"]; const id = req.params["idnot"];
if (!id) throw new Error("idnot is required"); if (!id) throw new Error("idnot is required");
const payload = await this.authService.getUserJwtPayload(id!); const payload = await this.authService.getUserJwtPayload(id);
const accessToken = this.authService.generateAccessToken(payload); const accessToken = this.authService.generateAccessToken(payload);
const refreshToken = this.authService.generateRefreshToken(payload); const refreshToken = this.authService.generateRefreshToken(payload);
@ -50,7 +50,7 @@ export default class UserController extends ApiController {
this.httpSuccess(response, { accessToken, refreshToken }); this.httpSuccess(response, { accessToken, refreshToken });
} catch (error) { } catch (error) {
console.log(error); console.log(error);
this.httpInternalError(response); this.httpInternalError(response, error);
return; return;
} }
} }

7
src/app/api/super-admin/VotesController.ts
View File

@ -76,7 +76,7 @@ export default class VotesController extends ApiController {
} }
/** /**
* @description Delete a specific folder * @description Delete a specific vote
*/ */
@Delete("/api/v1/super-admin/votes/:uid", [authHandler]) @Delete("/api/v1/super-admin/votes/:uid", [authHandler])
protected async delete(req: Request, response: Response) { protected async delete(req: Request, response: Response) {
@ -94,6 +94,11 @@ export default class VotesController extends ApiController {
return; return;
} }
if (voteFound.voter_uid !== req.body.user.userId) {
this.httpUnauthorized(response, "Can't delete a vote that's not yours");
return;
}
//call service to get prisma entity //call service to get prisma entity
const votetEntity: Votes = await this.votesService.delete(uid); const votetEntity: Votes = await this.votesService.delete(uid);