Started implementing the roles permissions

src/pages/api/entities/[id]/index.ts

@@ -2,9 +2,12 @@
 import type {NextApiRequest, NextApiResponse} from "next";
 import {withIronSessionApiRoute} from "iron-session/next";
 import {sessionOptions} from "@/lib/session";
-import {getEntity, getEntityWithRoles} from "@/utils/entities.be";
+import {deleteEntity, getEntity, getEntityWithRoles} from "@/utils/entities.be";
 import client from "@/lib/mongodb";
 import {Entity} from "@/interfaces/entity";
+import { doesEntityAllow } from "@/utils/permissions";
+import { getUser } from "@/utils/users.be";
+import { requestUser } from "@/utils/api";
 
 const db = client.db(process.env.MONGODB_DB);
 
@@ -16,10 +19,8 @@ async function handler(req: NextApiRequest, res: NextApiResponse) {
 }
 
 async function get(req: NextApiRequest, res: NextApiResponse) {
-	if (!req.session.user) {
-		res.status(401).json({ok: false});
-		return;
-	}
+	const user = await requestUser(req, res)
+	if (!user) return res.status(401).json({ ok: false });
 
 	const {id, showRoles} = req.query as {id: string; showRoles: string};
 
@@ -27,15 +28,27 @@ async function get(req: NextApiRequest, res: NextApiResponse) {
 	res.status(200).json(entity);
 }
 
+async function del(req: NextApiRequest, res: NextApiResponse) {
+	const user = await requestUser(req, res)
+	if (!user) return res.status(401).json({ ok: false });
+
+	const { id } = req.query as { id: string };
+
+	const entity = await getEntityWithRoles(id)
+	if (!entity) return res.status(404).json({ok: false})
+
+	if (!doesEntityAllow(user, entity, "delete_entity_role")) return res.status(403).json({ok: false})
+
+	await deleteEntity(entity)
+	return res.status(200).json({ok: true});
+}
+
 async function patch(req: NextApiRequest, res: NextApiResponse) {
-	if (!req.session.user) {
-		res.status(401).json({ok: false});
-		return;
-	}
+	const user = await requestUser(req, res)
+		if (!user) return res.status(401).json({ ok: false });
 
 	const {id} = req.query as {id: string};
 
-	const user = req.session.user;
 	if (!user.entities.map((x) => x.id).includes(id)) {
 		return res.status(403).json({ok: false});
 	}