Add requireResponsibleForGroup

+ Update controllers

src/Controllers/event.controller.ts

@@ -164,7 +164,7 @@ export const updateEvent = async (req: Request<{ pid: string }>, res: Response)
         date: DataType.DATETIME,
         briefDescription: DataType.STRING,
         ["fullDescription?"]: DataType.STRING,
-      })
+      }, result.error)
     );
   }
 

src/Controllers/group.controllers.ts

@@ -3,6 +3,7 @@ import { PrismaClientKnownRequestError, PrismaClientUnknownRequestError } from "
 import { Request, Response } from "express";
 import { z } from "zod";
 import prisma from "../lib/prisma";
+import { requireResponsibleForGroup } from "../Middleware/auth/auth";
 import NotFoundError from "../Middleware/error/NotFoundError";
 import { createInsufficientPermissionsError, DataType, generateError, generateInvalidBodyError, genericError, handleCreateByName } from "./common";
 
@@ -126,9 +127,8 @@ export const createGroup = async (req: Request<{ organisationPid: string }, {},
   );
 };
 
+// requires: auth(STANDARD with GROUP permission)
 export const updateGroup = async (req: Request<{ pid: string }>, res: Response) => {
-  //insert TeamleaderAuth
-
   const result = updateGroupBody.safeParse(req.body);
 
   if(result.success === false){
@@ -147,6 +147,8 @@ export const updateGroup = async (req: Request<{ pid: string }>, res: Response)
   const body = result.data;
   const { pid } = req.params;
 
+  requireResponsibleForGroup(req.auth, pid)
+
   try {
       const group = await prisma.group.update({
           where: { pid },

src/Middleware/auth/auth.ts

@@ -1,10 +1,11 @@
 /// <reference path="../../custom.d.ts" />
 
 import { NextFunction, Request, Response } from "express";
-import { AuthJWTPayload } from "../../Controllers/admin_auth.controller";
+import { authenticateUser, AuthJWTPayload } from "../../Controllers/admin_auth.controller";
 import { authClient } from "../../lib/redis";
 import jwt, { JsonWebTokenError, JwtPayload } from "jsonwebtoken";
 import prisma from "../../lib/prisma";
+import AuthError from "../error/AuthError";
 
 const JWT_SECRET = process.env.JWT_SECRET;
 
@@ -92,3 +93,13 @@ export const requireAuthentication = async (req: Request, res: Response, next: N
 
   next();
 };
+
+export function requireResponsibleForGroup(auth: AuthJWTPayload | undefined, groupPid: string) {
+  if (auth?.permission_level === "ELEVATED") {
+    return;
+  }
+
+  if (!auth?.groups.includes(groupPid)) {
+    throw new AuthError("The provided authorization is not valid for the requested operation!");
+  }
+}

src/Routes/discipline.routes.ts

@@ -17,7 +17,7 @@ router.get("/", getAllDisciplines); // TODO: Optional auth
 
 router.get("/:pid", getDiscipline);
 
-router.put("/:pid", requireAuthentication, updateDiscipline);
+router.patch("/:pid", requireAuthentication, updateDiscipline);
 router.delete<"/:pid", { pid: string }>("/:pid", requireAuthentication, deleteDiscipline);
 
 router.post<"/:disciplinePid/images", { disciplinePid: string }>(

src/Routes/group.routes.ts

@@ -5,6 +5,7 @@ import {
   getAllGroups,
   getAllGroupsWithParam,
   getGroup,
+  updateGroup,
 } from "../Controllers/group.controllers";
 import { requireAuthentication } from "../Middleware/auth/auth";
 import organisationRouter from "./organisation.routes";
@@ -14,6 +15,7 @@ const router = express.Router();
 router.get("/", getAllGroups);
 router.get("/:pid", getGroup);
 router.delete<"/:pid", { pid: string }>("/:pid", requireAuthentication, deleteGroup);
+router.patch("/:pid", requireAuthentication, updateGroup);
 
 organisationRouter.get("/:organisationPid/groups", getAllGroupsWithParam);
 organisationRouter.post("/:organisationPid/groups", requireAuthentication, createGroup);