fixed review suggestions

src/Controllers/participant.controller.ts

@@ -11,6 +11,7 @@ import { requireConfiguredAuthentication } from "../Middleware/auth/auth";
 import { isTeamleaderJWTPayload, TeamleaderJWTPayload } from "../Middleware/auth/teamleaderAuth";
 import { AuthJWTPayload } from "./admin_auth.controller";
 import AuthError from "../Middleware/error/AuthError";
+import { getGroupsByTeamPid } from "./team.controller";
 
 require("express-async-errors");
 
@@ -45,14 +46,16 @@ const returnedParticipant = {
 
 const _getAllParticipants = async (
   res: Response,
-  authentication: TeamleaderJWTPayload | AuthJWTPayload,
+  req: Request,
   teamPid?: string
 ) => {
-  if (isTeamleaderJWTPayload(authentication)) {
+  if (req.teamleader?.isAuthenticated) {
-    teamPid = authentication.team;
+    await requireLeaderOfTeam(req.teamleader, teamPid);
-  } else {
+  } else if (req.auth?.permission_level == "STANDARD") {
-    if (authentication.permission_level !== "ELEVATED") {
+    if (!teamPid) {
-      throw new AuthError();
+      throw new AuthError("A STANDARD Admin is not allowed to fetch all Participants!");
+    } else {
+      requireResponsibleForGroups(req.auth, await getGroupsByTeamPid(teamPid));
     }
   }
 
@@ -70,48 +73,19 @@ const _getAllParticipants = async (
 };
 
 export const getAllParticipants = async (req: Request<{}, {}, {}, { teamPid?: string }>, res: Response) => {
-  const auth = req.auth || req.teamleader;
+  return _getAllParticipants(res, req, req.query.teamPid);
-
-  if (!auth) {
-    throw new AuthError("No authentication provided");
-  }
-
-  return _getAllParticipants(res, auth, req.query.teamPid);
 };
 
 export const getAllParticipantsParams = async (req: Request<{ teamPid: string }>, res: Response) => {
-  const auth = req.auth || req.teamleader;
+  return _getAllParticipants(res, req, req.params.teamPid);
-
-  if (!auth) {
-    throw new AuthError("Not authentication provided");
-  }
-
-  return _getAllParticipants(res, auth, req.params.teamPid);
 };
 
 export const getParticipantForRole = async (req: Request<{ rolePid: string }>, res: Response) => {
-  let authenticated = false;
-
-  if (req.auth && req.auth.permission_level !== "ELEVATED") {
-    return res.status(403).json(createInsufficientPermissionsError());
-  } else if (req.auth) {
-    authenticated = true;
-  }
-
   const participant = await prisma.participant.findFirst({
     where: { roles: { some: { pid: req.params.rolePid } } },
     select: returnedParticipant,
   });
 
-  if (!authenticated) {
-    requireLeaderOfTeam(req.teamleader, participant?.team.pid);
-    authenticated = true;
-  }
-
-  if (!authenticated) {
-    throw new AuthError(); // REVIEW: Is this check neccesary?
-  }
-
   if (!participant) {
     return res.status(404).json({
       type: "error",
@@ -121,6 +95,12 @@ export const getParticipantForRole = async (req: Request<{ rolePid: string }>, r
     });
   }
 
+  if (req.teamleader?.isAuthenticated) {
+    await requireLeaderOfTeam(req.teamleader, participant?.team.pid);
+  } else if (req.auth?.permission_level == "STANDARD") {
+    requireResponsibleForGroups(req.auth, await getGroupsByTeamPid(participant?.team.pid));
+  }
+
   return res.status(200).json({
     type: "success",
     payload: { participant },

src/Controllers/role.controller.ts

@@ -68,7 +68,7 @@ export async function getRolesForTeam(req: Request<{ pid: string }>, res: Respon
 
   if (req.teamleader?.isAuthenticated) {
     await requireLeaderOfTeam(req.teamleader, pid);
-  } else {
+  } else if (req.auth?.permission_level == "STANDARD") {
     requireResponsibleForGroups(req.auth, await getGroupsByTeamPid(pid));
   }
 
@@ -88,12 +88,18 @@ export async function getRolesForTeam(req: Request<{ pid: string }>, res: Respon
 export async function getRole(req: Request<{ rolePid: string }>, res: Response) {
   const rolePid = req.params.rolePid;
 
-  const role = await prisma.role.findUnique({ where: { pid: rolePid }, select: basicRole });
+  const role = await prisma.role.findUnique({ where: { pid: rolePid }, select: detailedRole });
 
   if (!role) {
     throw new NotFoundError("role", rolePid);
   }
 
+  if (req.teamleader?.isAuthenticated) {
+    await requireLeaderOfTeam(req.teamleader, role.team.pid);
+  } else if (req.auth?.permission_level == "STANDARD" && role.participant?.pid !== undefined) {
+    requireResponsibleForGroups(req.auth, await getGroupByParticipantPid(role.participant?.pid));
+  }
+
   return res.status(200).json({
     type: "success",
     payload: {

src/Controllers/team.controller.ts

@@ -88,13 +88,6 @@ export const updateTeam = async (req: Request, res: Response) => {
 
   const body = result.data;
 
-  try {
-    requireLeaderOfTeam(req.teamleader, pid);
-  } catch {
-    // TODO: DO NOT CATCH THESE ERRORS
-    return res.status(401).json(createInsufficientPermissionsError("STANDARD"));
-  }
-
   try {
     const team = await prisma.team.update({
       where: {

src/Routes/participant.routes.ts

@@ -16,10 +16,7 @@ require("express-async-errors");
 const router = express.Router();
 
 router.get(
-  "/",
+  "/", requireConfiguredAuthentication({ optional: false, type: { admin: true, teamleader: true } }), getAllParticipants);
-  requireConfiguredAuthentication({ type: { admin: true, teamleader: true }, optional: false }),
-  getAllParticipants
-);
 
 teamRouter.get(
   "/:teamPid/particpants",