Allow for groups to be specified when POSTing /api/admins

+ Add the admin router to the global app
This commit is contained in:
Stephan
2021-12-29 15:19:22 +01:00
parent 3363039f79
commit 97fee47c6e
2 changed files with 28 additions and 4 deletions
+25 -4
View File
@@ -50,7 +50,7 @@ interface CreateAdminBody {
name?: string;
password: string;
permission_level: string;
// TODO: Add groups or events
groups?: string[];
}
const PERMISSION_LEVELS: readonly AdminLevel[] = ["ELEVATED", "STANDARD"]; // TODO: Enforce completeness
@@ -67,9 +67,13 @@ export const createAdmin = async (req: Request<{}, {}, CreateAdminBody>, res: Re
return res.status(403).json(createInsufficientPermissionsError());
}
const { name, password, permission_level } = req.body || {};
const { name, password, permission_level, groups } = req.body || {};
if (!(typeof name === "string" && typeof password == "string" && isPermissionLevel(permission_level))) {
const groupsIsValid = groups ? groups.filter((e) => typeof e !== "string").length === 0 : true;
if (
!(typeof name === "string" && typeof password == "string" && isPermissionLevel(permission_level) && groupsIsValid)
) {
return res.status(400).json({
type: "error",
payload: {
@@ -87,9 +91,26 @@ export const createAdmin = async (req: Request<{}, {}, CreateAdminBody>, res: Re
const password_hash = await argon2.hash(password, { type: argon2.argon2id });
// Check if all gropus exist
for (const groupId of groups || []) {
if (!(await prisma.group.findUnique({ where: { pid: groupId } }))) {
return res.status(404).json({
type: "error",
payload: {
message: `The group with ID '${groupId}' could not be found!`,
},
});
}
}
// TODO: Check for uniqueness of the name
const user = await prisma.admin.create({
data: { name, password: password_hash, permission_level },
data: {
name,
password: password_hash,
permission_level,
groups: { connect: groups?.map((group) => ({ pid: group })) },
},
select: { pid: true, name: true, permission_level: true },
});