1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
const { forwardTo } = require('prisma-binding');
const { hasPermission } = require('../utils');
const Query = {
items: forwardTo('db'),
item: forwardTo('db'),
itemsConnection: forwardTo('db'),
me(parent, args, ctx, info) {
// check if there is a current user ID
if (!ctx.request.userId) {
return null;
}
return ctx.db.query.user(
{
where: { id: ctx.request.userId },
},
info
);
},
async users(parent, args, ctx, info) {
// 1. Check if they are logged in
if (!ctx.request.userId) {
throw new Error('You must be logged in!');
}
console.log(ctx.request.userId);
// 2. Check if the user has the permissions to query all the users
hasPermission(ctx.request.user, ['ADMIN', 'PERMISSIONUPDATE']);
// 2. if they do, query all the users!
return ctx.db.query.users({}, info);
},
async order(parent, args, ctx, info) {
// 1. Make sure they are logged in
if (!ctx.request.userId) {
throw new Error('You arent logged in!');
}
// 2. Query the current order
const order = await ctx.db.query.order(
{
where: { id: args.id },
},
info
);
// 3. Check if the have the permissions to see this order
const ownsOrder = order.user.id === ctx.request.userId;
const hasPermissionToSeeOrder = ctx.request.user.permissions.includes('ADMIN');
if (!ownsOrder && !hasPermissionToSeeOrder) {
throw new Error('You cant see this buddd');
}
// 4. Return the order
return order;
},
};
module.exports = Query;
|
