add perm filter

bcc-code · Feb 27, 2024 · 5223d5e · 5223d5e
1 parent 9243648
commit 5223d5e
Show file tree

Hide file tree

Showing 3 changed files with 38 additions and 2 deletions.
diff --git a/server/api/files/upload/[destination].post.ts b/server/api/files/upload/[destination].post.ts
@@ -1,6 +1,18 @@
 import { IncomingForm } from "formidable";
 
-export default defineEventHandler((event) => {
+export default defineEventHandler(async (event) => {
+    const email = getHeader(event, "x-token-user-email");
+    if (!email) {
+        setResponseStatus(event, 401);
+        return;
+    }
+
+    const perms = await getPermissions(email);
+    if (!perms?.admin) {
+        setResponseStatus(event, 403);
+        return;
+    }
+
     const destination = getRouterParam(event, "destination");
     if (!destination) {
         return;
@@ -20,7 +32,7 @@ export default defineEventHandler((event) => {
         createDirsFromUploads: true,
     });
 
-    return new Promise((resolve, reject) => {
+    await new Promise((resolve, reject) => {
         form.parse(event.node.req, (err, fields, files) => {
             if (err) {
                 reject(err);

diff --git a/server/api/vx/[id]/preview.get.ts b/server/api/vx/[id]/preview.get.ts
@@ -1,4 +1,16 @@
 export default defineEventHandler(async (event) => {
+    const email = getHeader(event, "x-token-user-email");
+    if (!email) {
+        setResponseStatus(event, 401);
+        return;
+    }
+
+    const perms = await getPermissions(email);
+    if (!perms?.admin) {
+        setResponseStatus(event, 403);
+        return;
+    }
+
     const id = getRouterParam(event, "id");
 
     const config = useRuntimeConfig().api.cantemo;

diff --git a/server/api/vx/[id]/transcription.get.ts b/server/api/vx/[id]/transcription.get.ts
@@ -1,4 +1,16 @@
 export default defineEventHandler(async (event) => {
+    const email = getHeader(event, "x-token-user-email");
+    if (!email) {
+        setResponseStatus(event, 401);
+        return;
+    }
+
+    const perms = await getPermissions(email);
+    if (!perms?.admin) {
+        setResponseStatus(event, 403);
+        return;
+    }
+
     const id = getRouterParam(event, "id");
 
     const config = useRuntimeConfig().api.cantemo;