From cd0cb001065aa25fba9b29bdcc292366920bab91 Mon Sep 17 00:00:00 2001
From: Stephan <57194608+stephan418@users.noreply.github.com>
Date: Sun, 29 May 2022 14:47:32 +0200
Subject: [PATCH] Add requireResponsibleForGroup

+ Update controllers
---
 src/Controllers/event.controller.ts  |  2 +-
 src/Controllers/group.controllers.ts |  6 ++++--
 src/Middleware/auth/auth.ts          | 13 ++++++++++++-
 src/Routes/discipline.routes.ts      |  2 +-
 src/Routes/group.routes.ts           |  2 ++
 5 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/src/Controllers/event.controller.ts b/src/Controllers/event.controller.ts
index 42706f3..e996351 100644
--- a/src/Controllers/event.controller.ts
+++ b/src/Controllers/event.controller.ts
@@ -164,7 +164,7 @@ export const updateEvent = async (req: Request<{ pid: string }>, res: Response)
         date: DataType.DATETIME,
         briefDescription: DataType.STRING,
         ["fullDescription?"]: DataType.STRING,
-      })
+      }, result.error)
     );
   }
 
diff --git a/src/Controllers/group.controllers.ts b/src/Controllers/group.controllers.ts
index eaea779..b902e95 100644
--- a/src/Controllers/group.controllers.ts
+++ b/src/Controllers/group.controllers.ts
@@ -3,6 +3,7 @@ import { PrismaClientKnownRequestError, PrismaClientUnknownRequestError } from "
 import { Request, Response } from "express";
 import { z } from "zod";
 import prisma from "../lib/prisma";
+import { requireResponsibleForGroup } from "../Middleware/auth/auth";
 import NotFoundError from "../Middleware/error/NotFoundError";
 import { createInsufficientPermissionsError, DataType, generateError, generateInvalidBodyError, genericError, handleCreateByName } from "./common";
 
@@ -126,9 +127,8 @@ export const createGroup = async (req: Request<{ organisationPid: string }, {},
   );
 };
 
+// requires: auth(STANDARD with GROUP permission)
 export const updateGroup = async (req: Request<{ pid: string }>, res: Response) => {
-  //insert TeamleaderAuth
-
   const result = updateGroupBody.safeParse(req.body);
 
   if(result.success === false){
@@ -147,6 +147,8 @@ export const updateGroup = async (req: Request<{ pid: string }>, res: Response)
   const body = result.data;
   const { pid } = req.params;
 
+  requireResponsibleForGroup(req.auth, pid)
+
   try {
       const group = await prisma.group.update({
           where: { pid },
diff --git a/src/Middleware/auth/auth.ts b/src/Middleware/auth/auth.ts
index 981c116..339b600 100644
--- a/src/Middleware/auth/auth.ts
+++ b/src/Middleware/auth/auth.ts
@@ -1,10 +1,11 @@
 /// <reference path="../../custom.d.ts" />
 
 import { NextFunction, Request, Response } from "express";
-import { AuthJWTPayload } from "../../Controllers/admin_auth.controller";
+import { authenticateUser, AuthJWTPayload } from "../../Controllers/admin_auth.controller";
 import { authClient } from "../../lib/redis";
 import jwt, { JsonWebTokenError, JwtPayload } from "jsonwebtoken";
 import prisma from "../../lib/prisma";
+import AuthError from "../error/AuthError";
 
 const JWT_SECRET = process.env.JWT_SECRET;
 
@@ -92,3 +93,13 @@ export const requireAuthentication = async (req: Request, res: Response, next: N
 
   next();
 };
+
+export function requireResponsibleForGroup(auth: AuthJWTPayload | undefined, groupPid: string) {
+  if (auth?.permission_level === "ELEVATED") {
+    return;
+  }
+
+  if (!auth?.groups.includes(groupPid)) {
+    throw new AuthError("The provided authorization is not valid for the requested operation!");
+  }
+}
diff --git a/src/Routes/discipline.routes.ts b/src/Routes/discipline.routes.ts
index 7aa0289..50a2de9 100644
--- a/src/Routes/discipline.routes.ts
+++ b/src/Routes/discipline.routes.ts
@@ -17,7 +17,7 @@ router.get("/", getAllDisciplines); // TODO: Optional auth
 
 router.get("/:pid", getDiscipline);
 
-router.put("/:pid", requireAuthentication, updateDiscipline);
+router.patch("/:pid", requireAuthentication, updateDiscipline);
 router.delete<"/:pid", { pid: string }>("/:pid", requireAuthentication, deleteDiscipline);
 
 router.post<"/:disciplinePid/images", { disciplinePid: string }>(
diff --git a/src/Routes/group.routes.ts b/src/Routes/group.routes.ts
index 4ab9387..ae7e470 100644
--- a/src/Routes/group.routes.ts
+++ b/src/Routes/group.routes.ts
@@ -5,6 +5,7 @@ import {
   getAllGroups,
   getAllGroupsWithParam,
   getGroup,
+  updateGroup,
 } from "../Controllers/group.controllers";
 import { requireAuthentication } from "../Middleware/auth/auth";
 import organisationRouter from "./organisation.routes";
@@ -14,6 +15,7 @@ const router = express.Router();
 router.get("/", getAllGroups);
 router.get("/:pid", getGroup);
 router.delete<"/:pid", { pid: string }>("/:pid", requireAuthentication, deleteGroup);
+router.patch("/:pid", requireAuthentication, updateGroup);
 
 organisationRouter.get("/:organisationPid/groups", getAllGroupsWithParam);
 organisationRouter.post("/:organisationPid/groups", requireAuthentication, createGroup);