From 4a65dd4665db23ab151cd423388c6800cfb6b241 Mon Sep 17 00:00:00 2001
From: Stephan <57194608+stephan418@users.noreply.github.com>
Date: Thu, 28 Apr 2022 12:46:26 +0200
Subject: [PATCH] Add authorization

---
 src/Controllers/event.controller.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/Controllers/event.controller.ts b/src/Controllers/event.controller.ts
index 31a799f..4789a1f 100644
--- a/src/Controllers/event.controller.ts
+++ b/src/Controllers/event.controller.ts
@@ -79,20 +79,24 @@ export const getEvent = async (req: Request, res: Response) => {
   }
 };
 
+// requires: auth(ELEVATED)
 export const addEvent = async (req: Request, res: Response) => {
+  if (req.auth?.permission_level !== "ELEVATED") {
+    res.status(403).json(createInsufficientPermissionsError());
+  }
+
   if (
     typeof req.body.name !== "string" ||
     typeof req.body.date !== "string" ||
     typeof req.body.description !== "string"
   ) {
-    res.status(400).json(
+    return res.status(400).json(
       generateInvalidBodyError({
         name: DataType.STRING,
         date: DataType.DATETIME,
         description: DataType.STRING,
       })
     );
-    return;
   }
 
   //TODO: Check if date is valid