swadhin / opencodehub public

chore: update src/pages/api/projects/[id]/index.ts

swadhinbiswas committed 8 months ago
9585f13
1 parent 486d465
commit 9585f13
1 file changed
+5 -6
Showing 1 changed file+5-6
src/pages/api/projects/[id]/index.ts
▼src/pages/api/projects/[id]/index.ts
+5-6
@@ -2,6 +2,7 @@
2
2
import type { APIRoute } from "astro";
3
3
import { getDatabase, schema } from "@/db";
4
4
import { getUserFromRequest } from "@/lib/auth";
5
+import { canReadRepo } from "@/lib/permissions";
5
6
import { success, badRequest, notFound, unauthorized, serverError } from "@/lib/api";
6
7
import { eq, asc, desc } from "drizzle-orm";
7
8
import { projects, projectColumns, projectCards } from "@/db/schema/projects";
@@ -11,9 +12,8 @@ import { withErrorHandler } from "@/lib/errors";
11
12
export const GET: APIRoute = withErrorHandler(async ({ request, params }) => {
12
13
const { id } = params;
13
14
if (!id) return badRequest("Project ID required");
15
+ const user = await getUserFromRequest(request);
14
16
15
- // We need to check permissions, but project fetch doesn't have repo context in URL.
16
- // We fetch project first to get repo ID.
17
17
const db = getDatabase();
18
18
const project = await db.query.projects.findFirst({
19
19
where: eq(projects.id, id),
@@ -24,10 +24,9 @@ export const GET: APIRoute = withErrorHandler(async ({ request, params }) => {
24
24
25
25
if (!project) return notFound("Project not found");
26
26
27
- // Check permissions
28
- // For now, let's assume if you can see the repo, you can see the project.
29
- // We should implement proper permission check using `canReadRepo` from `lib/permissions` but we need to import it.
30
- // Or just simple check: public or user has access.
27
+ if (!(await canReadRepo(user?.userId, project.repository, { isAdmin: user?.isAdmin }))) {
28
+ return notFound("Project not found");
29
+ }
31
30
32
31
// Fetch columns and cards
33
32
const columns = await db.query.projectColumns.findMany({
34
33