feat: edit view

Author: RustyDev24

internal/middleware/check_user.go

@@ -11,6 +11,7 @@ import (
 	"github.com/redis/go-redis/v9"
 
 	"github.com/CodeChefVIT/devsoc-backend-24/internal/database"
+	"github.com/CodeChefVIT/devsoc-backend-24/internal/models"
 	services "github.com/CodeChefVIT/devsoc-backend-24/internal/services/user"
 )
 
@@ -124,7 +125,7 @@ func CheckAdmin(next echo.HandlerFunc) echo.HandlerFunc {
 
 		email := claims["sub"].(string)
 
-		if claims["role"].(string) != "admin" {
+		if claims["role"].(string) == "user" {
 			return c.JSON(http.StatusForbidden, map[string]string{
 				"message": "not an admin",
 				"status":  "fail",
@@ -183,3 +184,18 @@ func CheckAdmin(next echo.HandlerFunc) echo.HandlerFunc {
 		return next(c)
 	}
 }
+
+func EditOnly(next echo.HandlerFunc) echo.HandlerFunc {
+	return func(c echo.Context) error {
+		user := c.Get("user").(*models.User)
+
+		if user.Role == "view" {
+			return c.JSON(http.StatusForbidden, map[string]string{
+				"message": "not allowed to edit",
+				"status":  "fail",
+			})
+		}
+
+		return next(c)
+	}
+}

internal/routes/admin_routes.go

@@ -2,19 +2,19 @@ package routes
 
 import (
 	"github.com/CodeChefVIT/devsoc-backend-24/internal/controllers"
+	"github.com/CodeChefVIT/devsoc-backend-24/internal/middleware"
 	"github.com/labstack/echo/v4"
 )
 
 func AdminRoutes(incomingRoutes *echo.Echo) {
 	admin := incomingRoutes.Group("/admin")
-	// admin.Use(middleware.Protected())
-	// admin.Use(middleware.AuthUser)
-	// admin.Use(middleware.CheckAdmin)
+	admin.Use(middleware.Protected())
+	admin.Use(middleware.CheckAdmin)
 
 	admin.GET("/users", controllers.GetAllUsers)
 	admin.GET("/user/:email", controllers.GetUserByEmail)
-	admin.POST("/user/ban", controllers.BanUser)
-	admin.POST("/user/unban", controllers.UnbanUser)
+	admin.POST("/user/ban", controllers.BanUser, middleware.EditOnly)
+	admin.POST("/user/unban", controllers.UnbanUser, middleware.EditOnly)
 	admin.GET("/vitians", controllers.GetAllVitians)
 	admin.GET("/females", controllers.GetAllFemales)
 
@@ -23,8 +23,8 @@ func AdminRoutes(incomingRoutes *echo.Echo) {
 	admin.GET("/team/project/:id", controllers.GetProjectByTeamID)
 	admin.GET("/team/leader/:id", controllers.GetTeamLeader)
 	admin.GET("/team/idea/:id", controllers.GetIdeaByTeamID)
-	admin.GET("/team/ban/:id", controllers.BanTeam)
-	admin.GET("/team/unban/:id", controllers.UnbanTeam)
+	admin.GET("/team/ban/:id", controllers.BanTeam, middleware.EditOnly)
+	admin.GET("/team/unban/:id", controllers.UnbanTeam, middleware.EditOnly)
 
 	admin.GET("/projects/all", controllers.GetAllProject)
 	admin.GET("/ideas/all", controllers.GetAllIdeas)