diff options
Diffstat (limited to 'backend')
| -rw-r--r-- | backend/package.json | 3 | ||||
| -rw-r--r-- | backend/src/index.js | 1 | ||||
| -rw-r--r-- | backend/src/resolvers/Mutation.js | 14 |
3 files changed, 14 insertions, 4 deletions
diff --git a/backend/package.json b/backend/package.json index 4a1a0ae..1fdbc3a 100644 --- a/backend/package.json +++ b/backend/package.json @@ -14,6 +14,7 @@ "jsonwebtoken": "8.1.1", "nodemailer": "^4.4.2", "prisma-binding": "1.5.7", + "react-debounce-input": "^3.2.0", "stripe": "^5.4.0" }, "devDependencies": { @@ -36,4 +37,4 @@ "env" ] } -}
\ No newline at end of file +} diff --git a/backend/src/index.js b/backend/src/index.js index 4f98c52..8cf48fc 100644 --- a/backend/src/index.js +++ b/backend/src/index.js @@ -24,7 +24,6 @@ server.express.use(async (req, res, next) => { ` ); req.user = user; - console.log(req.user); next(); }); diff --git a/backend/src/resolvers/Mutation.js b/backend/src/resolvers/Mutation.js index 9127b04..daaa7de 100644 --- a/backend/src/resolvers/Mutation.js +++ b/backend/src/resolvers/Mutation.js @@ -46,13 +46,16 @@ const mutations = { // Creation of Post Mutations async createItem(parent, args, ctx, info) { - const userId = getUserId(ctx); + if (!ctx.request.userId) { + throw new Error('You must be logged in to create an item'); + } + const item = await ctx.db.mutation.createItem( { data: { user: { connect: { - id: userId, + id: ctx.request.userId, }, }, ...args, @@ -80,7 +83,14 @@ const mutations = { }, async updateItem(parent, args, ctx, info) { + const user = ctx.request.user; + const item = await ctx.db.query.item({ where: { id: args.id } }, `{ user { id } }`); + if (item.user.id !== user.id || !user.permissions.includes('ADMIN')) { + throw new Error('You are not allowed to update that item!'); + } + const updates = { ...args }; + // remove the ID because you can't update that delete updates.id; return ctx.db.mutation.updateItem({ where: { id: args.id }, |