1 files changed, 34 insertions, 14 deletions
diff --git a/backend/src/resolvers/Query.js b/backend/src/resolvers/Query.js
index 22dcd2a..276f7fa 100644
--- a/backend/src/resolvers/Query.js
+++ b/backend/src/resolvers/Query.js
@@ -1,26 +1,52 @@
-const { getUserId, Context, checkForUserId } = require('../utils');
+const { hasPermission } = require('../utils');
+
 const { forwardTo } = require('prisma-binding');
 
 const Query = {
   items(parent, args, ctx, info) {
-    console.log('ITEMS!');
-    // check auth
     return ctx.db.query.items({ ...args }, info);
   },
 
   itemsConnection: forwardTo('db'),
 
   // TODO: Make sure they own this order before looking it up
-  order: forwardTo('db'),
+  // order: forwardTo('db'),
+  async order(parent, args, ctx, info) {
+    // 1. make sure they are signed in
+    if (!ctx.request.userId) {
+      throw new Error('You Must be signed in to view an order');
+    }
+
+    // 2. Create the query
+    const where = {
+      id: args.id,
+      user: {
+        id: ctx.request.userId,
+      },
+    };
+    // 3. Fire off the query
+    const [order] = await ctx.db.query.orders({ where }, info);
+
+    // 4. Check that they are allowed to view the order
+    if (order.user.id !== ctx.request.userId || hasPermission(ctx.request.user, ['ADMIN'])) {
+      throw new Error("You don't have permission");
+    }
+    // 5. If everything checks out, return the order
+    return order;
+  },
 
   me(parent, args, ctx, info) {
     const Authorization = ctx.request.get('Authorization');
     if (!Authorization || Authorization === 'null') {
-      console.log('Authorization is null');
-      return null;
+      return null; // don't error out, just return nothing
     }
-    const id = getUserId(ctx);
-    return ctx.db.query.user({ where: { id } }, info);
+
+    return ctx.db.query.user(
+      {
+        where: { id: ctx.request.userId },
+      },
+      info
+    );
   },
 
   async orders(parent, args, ctx, info) {
@@ -37,12 +63,6 @@ const Query = {
       info
     );
   },
-
-  async users(parent, args, ctx, info) {
-    // TODO Permissions
-    const userId = getUserId(ctx);
-    return ctx.db.query.users({}, info);
-  },
 };
 
 module.exports = Query;