mirror/fosrl.pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2025-08-03 09:34:48 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

move action permission check to middleware

Browse source
This commit is contained in:
Milo Schwartz 2024-11-05 23:55:46 -05:00
parent 03051878ef
commit 372e51c0a5
No known key found for this signature in database
48 changed files with 266 additions and 936 deletions
Download patch file Download diff file Expand all files Collapse all files

18
server/routers/resource/createResource.ts
View file

@ -11,8 +11,6 @@ import {
import response from "@server/utils/response";
import HttpCode from "@server/types/HttpCode";
import createHttpError from "http-errors";
import { ActionsEnum, checkUserActionPermission } from "@server/auth/actions";
import logger from "@server/logger";
import { eq, and } from "drizzle-orm";
import stoi from "@server/utils/stoi";
import { fromError } from "zod-validation-error";
@ -26,7 +24,6 @@ const createResourceParamsSchema = z.object({
orgId: z.string(),
});
// Define Zod schema for request body validation
const createResourceSchema = z.object({
name: z.string().min(1).max(255),
subdomain: z.string().min(1).max(255).optional(),
@ -38,7 +35,6 @@ export async function createResource(
next: NextFunction
): Promise<any> {
try {
// Validate request body
const parsedBody = createResourceSchema.safeParse(req.body);
if (!parsedBody.success) {
return next(
@ -64,20 +60,6 @@ export async function createResource(
const { siteId, orgId } = parsedParams.data;
// Check if the user has permission to list sites
const hasPermission = await checkUserActionPermission(
ActionsEnum.createResource,
req
);
if (!hasPermission) {
return next(
createHttpError(
HttpCode.FORBIDDEN,
"User does not have permission to perform this action"
)
);
}
if (!req.userOrgRoleId) {
return next(
createHttpError(HttpCode.FORBIDDEN, "User does not have a role")