feat:added authorization requirements for posting and deleting reports

icssc · Feb 1, 2024 · e11523b · e11523b
1 parent a337e23
commit e11523b
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/api/src/controllers/reports.ts b/api/src/controllers/reports.ts
@@ -1,3 +1,4 @@
+import { use } from 'sst/constructs';
 /**
  @module ReportsRoute
 */
@@ -13,6 +14,8 @@ const router = express.Router();
  * Get all reports
  */
 router.get('/', async (req, res) => {
+  if (!req.session.passport) return res.status(401).send('Unathenticated');
+  if (!req.session.passport.admin) return res.status(403).send('Unauthorized');
   const reports = await getDocuments(COLLECTION_NAMES.REPORTS, {}); // get all reports in collection
 
   res.json(reports);
@@ -34,6 +37,8 @@ router.post('/', async (req, res) => {
  */
 router.delete('/', async (req, res) => {
   let status;
+  if (!req.session.passport) return res.status(401).send('Unathenticated');
+  if (!req.session.passport.admin) return res.status(403).send('Unauthorized');
   if (req.body.id) {
     console.log(`Deleting report ${req.body.id}`);
     status = await deleteDocument(COLLECTION_NAMES.REPORTS, {