mods cant approve their own request

brandonnorsworthy · Sep 21, 2024 · 2beab8b · 2beab8b
1 parent 931bb86
commit 2beab8b
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/controllers/suggestion.controller .ts b/controllers/suggestion.controller .ts
@@ -51,7 +51,7 @@ export default {
 
   convertSuggestionIntoQuest: async (request: Request, response: Response) => {
     try {
-      const { userId } = (request as AuthenticatedRequest).tokenData;
+      const { userId, role } = (request as AuthenticatedRequest).tokenData;
       const { suggestionId } = request.params;
       let { title, description, objectives, categoryId, image_url } = request.body;
 
@@ -62,6 +62,10 @@ export default {
         return response.status(404).send('Suggestion not found');
       }
 
+      if (role !== "admin" || suggestion.user_id !== userId) {
+        return response.status(403).send('You are not allowed to convert this suggestion into a quest');
+      }
+
       const newQuest = await questService.createQuest(title, description, objectives, categoryId, suggestion.user_id, image_url);
       await suggestionService.deleteSuggestion(Number(suggestionId), userId);
 

diff --git a/routes/suggestion.router.ts b/routes/suggestion.router.ts
@@ -30,11 +30,9 @@ suggestionRouter.delete(
   validateParams(suggestionSchema.suggestionId),
   suggestionController.deleteSuggestion
 );
-
-// admin routes
 suggestionRouter.post(
   '/:suggestionId/quest',
-  isAdmin,
+  isModerator,
   validateParams(suggestionSchema.suggestionId),
   validateBody(suggestionSchema.convertSuggestionIntoQuestBody),
   suggestionController.convertSuggestionIntoQuest