swadhin / opencodehub public

chore: update src/pages/api/projects/[id]/cards/[cardId].ts

swadhinbiswas committed 8 months ago
486d465
1 parent 1333f3c
commit 486d465
1 file changed
+37 -4
Showing 1 changed file+37-4
src/pages/api/projects/[id]/cards/[cardId].ts
▼src/pages/api/projects/[id]/cards/[cardId].ts
+37-4
@@ -2,9 +2,10 @@
2
2
import type { APIRoute } from "astro";
3
3
import { getDatabase, schema } from "@/db";
4
4
import { getUserFromRequest } from "@/lib/auth";
5
+import { canWriteRepo } from "@/lib/permissions";
5
6
import { success, badRequest, notFound, unauthorized, serverError } from "@/lib/api";
6
-import { eq, and } from "drizzle-orm";
7
-import { projectCards } from "@/db/schema/projects";
7
+import { eq } from "drizzle-orm";
8
+import { projects, projectCards } from "@/db/schema/projects";
8
9
import { withErrorHandler } from "@/lib/errors";
9
10
10
11
export const DELETE: APIRoute = withErrorHandler(async ({ request, params }) => {
@@ -16,8 +17,23 @@ export const DELETE: APIRoute = withErrorHandler(async ({ request, params }) =>
16
17
17
18
const db = getDatabase();
18
19
19
- // Verify ownership or permission (simplified for now)
20
- // In production, check if user has write access to project
20
+ const project = await db.query.projects.findFirst({
21
+ where: eq(projects.id, id),
22
+ with: { repository: true },
23
+ });
24
+ if (!project) return notFound("Project not found");
25
+
26
+ if (!(await canWriteRepo(user.userId, project.repository, { isAdmin: user.isAdmin }))) {
27
+ return unauthorized("Write access required");
28
+ }
29
+
30
+ const existingCard = await db.query.projectCards.findFirst({
31
+ where: eq(projectCards.id, cardId),
32
+ with: { column: true },
33
+ });
34
+ if (!existingCard || existingCard.column.projectId !== id) {
35
+ return notFound("Card not found");
36
+ }
21
37
22
38
await (db as any).delete(projectCards)
23
39
.where(eq(projectCards.id, cardId));
@@ -36,6 +52,15 @@ export const PATCH: APIRoute = withErrorHandler(async ({ request, params }) => {
36
52
const { note, contentId, contentType } = body;
37
53
38
54
const db = getDatabase();
55
+ const project = await db.query.projects.findFirst({
56
+ where: eq(projects.id, id),
57
+ with: { repository: true },
58
+ });
59
+ if (!project) return notFound("Project not found");
60
+
61
+ if (!(await canWriteRepo(user.userId, project.repository, { isAdmin: user.isAdmin }))) {
62
+ return unauthorized("Write access required");
63
+ }
39
64
40
65
const updates: any = {};
41
66
if (note !== undefined) updates.note = note;
@@ -44,6 +69,14 @@ export const PATCH: APIRoute = withErrorHandler(async ({ request, params }) => {
44
69
45
70
if (Object.keys(updates).length === 0) return badRequest("No updates provided");
46
71
72
+ const existingCard = await db.query.projectCards.findFirst({
73
+ where: eq(projectCards.id, cardId),
74
+ with: { column: true },
75
+ });
76
+ if (!existingCard || existingCard.column.projectId !== id) {
77
+ return notFound("Card not found");
78
+ }
79
+
47
80
const [updatedCard] = await (db as any).update(projectCards)
48
81
.set(updates)
49
82
.where(eq(projectCards.id, cardId))
50
83