2024-11-03 13:57:51 -05:00
|
|
|
import { Request, Response, NextFunction } from "express";
|
|
|
|
import { z } from "zod";
|
|
|
|
import { db } from "@server/db";
|
|
|
|
import { userActions } from "@server/db/schema";
|
|
|
|
import { and, eq } from "drizzle-orm";
|
2024-10-12 22:31:24 -04:00
|
|
|
import response from "@server/utils/response";
|
2024-11-03 13:57:51 -05:00
|
|
|
import HttpCode from "@server/types/HttpCode";
|
|
|
|
import createHttpError from "http-errors";
|
|
|
|
import { ActionsEnum, checkUserActionPermission } from "@server/auth/actions";
|
|
|
|
import logger from "@server/logger";
|
|
|
|
import { fromError } from "zod-validation-error";
|
2024-10-12 22:31:24 -04:00
|
|
|
|
|
|
|
const removeUserActionParamsSchema = z.object({
|
|
|
|
userId: z.string(),
|
|
|
|
});
|
|
|
|
|
|
|
|
const removeUserActionSchema = z.object({
|
|
|
|
actionId: z.string(),
|
2024-11-03 13:57:51 -05:00
|
|
|
orgId: z.string(),
|
2024-10-12 22:31:24 -04:00
|
|
|
});
|
|
|
|
|
2024-11-03 13:57:51 -05:00
|
|
|
export async function removeUserAction(
|
|
|
|
req: Request,
|
|
|
|
res: Response,
|
|
|
|
next: NextFunction
|
|
|
|
): Promise<any> {
|
2024-10-12 22:31:24 -04:00
|
|
|
try {
|
|
|
|
const parsedParams = removeUserActionParamsSchema.safeParse(req.params);
|
|
|
|
if (!parsedParams.success) {
|
|
|
|
return next(
|
|
|
|
createHttpError(
|
|
|
|
HttpCode.BAD_REQUEST,
|
2024-11-03 13:57:51 -05:00
|
|
|
fromError(parsedParams.error).toString()
|
2024-10-12 22:31:24 -04:00
|
|
|
)
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
|
|
|
const { userId } = parsedParams.data;
|
|
|
|
|
|
|
|
const parsedBody = removeUserActionSchema.safeParse(req.body);
|
|
|
|
if (!parsedBody.success) {
|
|
|
|
return next(
|
|
|
|
createHttpError(
|
|
|
|
HttpCode.BAD_REQUEST,
|
2024-11-03 13:57:51 -05:00
|
|
|
fromError(parsedBody.error).toString()
|
2024-10-12 22:31:24 -04:00
|
|
|
)
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
|
|
|
const { actionId, orgId } = parsedBody.data;
|
|
|
|
|
|
|
|
// Check if the user has permission to remove user actions
|
2024-11-03 13:57:51 -05:00
|
|
|
const hasPermission = await checkUserActionPermission(
|
|
|
|
ActionsEnum.removeUserAction,
|
|
|
|
req
|
|
|
|
);
|
2024-10-12 22:31:24 -04:00
|
|
|
if (!hasPermission) {
|
2024-11-03 13:57:51 -05:00
|
|
|
return next(
|
|
|
|
createHttpError(
|
|
|
|
HttpCode.FORBIDDEN,
|
|
|
|
"User does not have permission to perform this action"
|
|
|
|
)
|
|
|
|
);
|
2024-10-12 22:31:24 -04:00
|
|
|
}
|
|
|
|
|
2024-11-03 13:57:51 -05:00
|
|
|
const deletedUserAction = await db
|
|
|
|
.delete(userActions)
|
|
|
|
.where(
|
|
|
|
and(
|
|
|
|
eq(userActions.userId, userId),
|
|
|
|
eq(userActions.actionId, actionId),
|
|
|
|
eq(userActions.orgId, orgId)
|
|
|
|
)
|
|
|
|
)
|
2024-10-12 22:31:24 -04:00
|
|
|
.returning();
|
|
|
|
|
|
|
|
if (deletedUserAction.length === 0) {
|
|
|
|
return next(
|
|
|
|
createHttpError(
|
|
|
|
HttpCode.NOT_FOUND,
|
|
|
|
`Action with ID ${actionId} not found for user with ID ${userId} in organization ${orgId}`
|
|
|
|
)
|
|
|
|
);
|
|
|
|
}
|
|
|
|
|
|
|
|
return response(res, {
|
|
|
|
data: null,
|
|
|
|
success: true,
|
|
|
|
error: false,
|
|
|
|
message: "Action removed from user successfully",
|
|
|
|
status: HttpCode.OK,
|
|
|
|
});
|
|
|
|
} catch (error) {
|
|
|
|
logger.error(error);
|
2024-11-03 13:57:51 -05:00
|
|
|
return next(
|
|
|
|
createHttpError(
|
|
|
|
HttpCode.INTERNAL_SERVER_ERROR,
|
|
|
|
"An error occurred..."
|
|
|
|
)
|
|
|
|
);
|
2024-10-12 22:31:24 -04:00
|
|
|
}
|
2024-11-03 13:57:51 -05:00
|
|
|
}
|