Merge branch 'master' into randyridge/our

1 files changed, 36 insertions, 29 deletions

diff --git a/finished-application/backend/src/resolvers/Query.js b/finished-application/backend/src/resolvers/Query.js
index 51c2c42..22a6414 100644
--- a/finished-application/backend/src/resolvers/Query.js
+++ b/finished-application/backend/src/resolvers/Query.js
@@ -1,52 +1,59 @@
-const { hasPermission } = require('../utils');
-
 const { forwardTo } = require('prisma-binding');
+const { hasPermission } = require('../utils');
 
 const Query = {
   items: forwardTo('db'),
+  item: forwardTo('db'),
   itemsConnection: forwardTo('db'),
-
-  async order(parent, args, ctx, info) {
-    // 1. make sure they are signed in
+  me(parent, args, ctx, info) {
+    // check if there is a current user ID
     if (!ctx.request.userId) {
-      throw new Error('You Must be signed in to view an order');
+      return null;
     }
-
-    // 2. Create the query
-    const where = {
-      id: args.id,
-      user: {
-        id: ctx.request.userId,
+    return ctx.db.query.user(
+      {
+        where: { id: ctx.request.userId },
       },
-    };
-    // 3. Fire off the query
-    const [order] = await ctx.db.query.orders({ where }, info);
-
-    // 4. Check that they are allowed to view the order
-    if (order.user.id !== ctx.request.userId || hasPermission(ctx.request.user, ['ADMIN'])) {
-      throw new Error("You don't have permission");
-    }
-    // 5. If everything checks out, return the order
-    return order;
+      info
+    );
   },
-
-  me(parent, args, ctx, info) {
+  async users(parent, args, ctx, info) {
+    // 1. Check if they are logged in
     if (!ctx.request.userId) {
-      return null; // don't error out, just return nothing
+      throw new Error('You must be logged in!');
     }
+    console.log(ctx.request.userId);
+    // 2. Check if the user has the permissions to query all the users
+    hasPermission(ctx.request.user, ['ADMIN', 'PERMISSIONUPDATE']);
 
-    return ctx.db.query.user(
+    // 2. if they do, query all the users!
+    return ctx.db.query.users({}, info);
+  },
+  async order(parent, args, ctx, info) {
+    // 1. Make sure they are logged in
+    if (!ctx.request.userId) {
+      throw new Error('You arent logged in!');
+    }
+    // 2. Query the current order
+    const order = await ctx.db.query.order(
       {
-        where: { id: ctx.request.userId },
+        where: { id: args.id },
       },
       info
     );
+    // 3. Check if the have the permissions to see this order
+    const ownsOrder = order.user.id === ctx.request.userId;
+    const hasPermissionToSeeOrder = ctx.request.user.permissions.includes('ADMIN');
+    if (!ownsOrder || !hasPermission) {
+      throw new Error('You cant see this buddd');
+    }
+    // 4. Return the order
+    return order;
   },
-
   async orders(parent, args, ctx, info) {
     const { userId } = ctx.request;
     if (!userId) {
-      throw new Error('You must be signed in to see your orders');
+      throw new Error('you must be signed in!');
     }
     return ctx.db.query.orders(
       {