Add methods for requiring more specific levels of teamleader auth

+ Add AuthError

src/Controllers/admin_auth.controller.ts

@@ -6,7 +6,7 @@ import argon2 from "argon2";
 import jwt from "jsonwebtoken";
 import { DataType, generateInvalidBodyError } from "./common";
 
-const JWT_SECRET = process.env.JWT_SECRET || "secret";
+const JWT_SECRET = process.env.JWT_SECRET;
 const TOKEN_EXPIRY = "4 days";
 
 export interface AuthJWTPayload {
@@ -18,6 +18,10 @@ export interface AuthJWTPayload {
 }
 
 function createAdminJWT(admin: Admin & { groups: Group[] }) {
+  if (!JWT_SECRET) {
+    throw new Error("JWT_SECRET not set");
+  }
+
   const payload: AuthJWTPayload = {
     pid: admin.pid,
     name: admin.name,

src/Controllers/role.controller.ts

@@ -2,9 +2,12 @@ import { Role } from "@prisma/client";
 import { Request, Response } from "express";
 import { z } from "zod";
 import prisma from "../lib/prisma";
+import { requireLeaderOfTeam, requireResponsibleForParticipant } from "../Middleware/auth/teamleaderAuth";
 import NotFoundError from "../Middleware/error/NotFoundError";
 import { DataType, generateInvalidBodyError } from "./common";
 
+require("express-async-errors");
+
 /**
  *
  * @param teamPid: Pid of the team to add the roles to
@@ -29,7 +32,8 @@ export async function createRolesForTeam(teamPid: string) {
 export async function getRolesForTeam(req: Request<{ teamPid: string }>, res: Response) {
   const teamPid = req.params.teamPid;
 
-  // TODO: Check if leader of team
+  requireLeaderOfTeam(req.teamleader, teamPid);
+
   const roles = await prisma.role.findMany({
     where: { team: { pid: teamPid } },
     select: {
@@ -63,6 +67,8 @@ export async function assignParticipantToRole(req: Request<{ pid: string }>, res
   const { participantPid } = zBody.data;
   const rolePid = req.params.pid;
 
+  requireResponsibleForParticipant(req.teamleader, participantPid);
+
   const schema = await prisma.role.findFirst({
     where: { pid: rolePid, team: { participants: { some: { pid: participantPid } } } },
     select: { participant: { select: { pid: true, firstName: true, lastName: true } } },