diff --git a/server/src/api/context.go b/server/src/api/context.go index ee2d43f657..43ee7809f5 100644 --- a/server/src/api/context.go +++ b/server/src/api/context.go @@ -1,14 +1,15 @@ package api import ( - "context" - "errors" - "github.com/go-chi/chi/v5" - "github.com/google/uuid" - "net/http" - "scrumlr.io/server/common" - "scrumlr.io/server/identifiers" - "scrumlr.io/server/logger" + "context" + "errors" + "github.com/go-chi/chi/v5" + "github.com/google/uuid" + "net/http" + "scrumlr.io/server/common" + "scrumlr.io/server/database/types" + "scrumlr.io/server/identifiers" + "scrumlr.io/server/logger" ) func (s *Server) BoardCandidateContext(next http.Handler) http.Handler { @@ -140,6 +141,37 @@ func (s *Server) BoardEditableContext(next http.Handler) http.Handler { }) } +func (s *Server) BoardAuthenticatedContext(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + log := logger.FromRequest(r) + + boardParam := chi.URLParam(r, "id") + board, err := uuid.Parse(boardParam) + if err != nil { + common.Throw(w, r, common.BadRequestError(errors.New("invalid board id"))) + return + } + userID := r.Context().Value(identifiers.UserIdentifier).(uuid.UUID) + + user, err := s.users.Get(r.Context(), userID) + + if err != nil { + log.Errorw("Could not fetch user", "error", err) + common.Throw(w, r, errors.New("could not fetch user")) + return + } + + if user.AccountType == types.AccountTypeAnonymous { + log.Errorw("Not authorized to perform this action", "accountType", user.AccountType) + common.Throw(w, r, common.ForbiddenError(errors.New("not authorized"))) + return + } + + boardContext := context.WithValue(r.Context(), identifiers.BoardIdentifier, board) + next.ServeHTTP(w, r.WithContext(boardContext)) + }) +} + func (s *Server) ColumnContext(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { columnParam := chi.URLParam(r, "column") diff --git a/server/src/common/dto/users.go b/server/src/common/dto/users.go index 94544502ec..a313daef19 100644 --- a/server/src/common/dto/users.go +++ b/server/src/common/dto/users.go @@ -18,12 +18,16 @@ type User struct { // The user's avatar configuration Avatar *types.Avatar `json:"avatar,omitempty"` + + // The user's account type configuration + AccountType types.AccountType `json:"accountType"` } func (u *User) From(user database.User) *User { u.ID = user.ID u.Name = user.Name u.Avatar = user.Avatar + u.AccountType = user.AccountType return u }