mirror/fosrl.pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2025-08-02 09:05:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

access token endpoints and other backend support

Browse source
This commit is contained in:
Milo Schwartz 2024-12-18 23:14:26 -05:00
parent 283fb3990c
commit 72dc02ff2e
No known key found for this signature in database
22 changed files with 905 additions and 107 deletions
Download patch file Download diff file Expand all files Collapse all files

19
server/middlewares/verifyTargetAccess.ts
View file

@ -4,6 +4,7 @@ import { resources, targets, userOrgs } from "@server/db/schema";
import { and, eq } from "drizzle-orm";
import createHttpError from "http-errors";
import HttpCode from "@server/types/HttpCode";
import { canUserAccessResource } from "./helpers/canUserAccessResource";
export async function verifyTargetAccess(
req: Request,
@ -99,8 +100,24 @@ export async function verifyTargetAccess(
} else {
req.userOrgRoleId = req.userOrg.roleId;
req.userOrgId = resource[0].orgId!;
next();
}
const resourceAllowed = await canUserAccessResource({
userId,
resourceId,
roleId: req.userOrgRoleId!
});
if (!resourceAllowed) {
return next(
createHttpError(
HttpCode.FORBIDDEN,
"User does not have access to this resource"
)
);
}
next();
} catch (e) {
return next(
createHttpError(