added access variable to exams soo we can distinguish private, public and confidential exams and also bugfixes and improvements

src/pages/api/exam/index.ts

@@ -1,11 +1,13 @@
 // Next.js API route support: https://nextjs.org/docs/api-routes/introduction
-import type {NextApiRequest, NextApiResponse} from "next";
+import type { NextApiRequest, NextApiResponse } from "next";
 import client from "@/lib/mongodb";
-import {withIronSessionApiRoute} from "iron-session/next";
-import {sessionOptions} from "@/lib/session";
-import {flatten} from "lodash";
-import {Exam} from "@/interfaces/exam";
-import {MODULE_ARRAY} from "@/utils/moduleUtils";
+import { withIronSessionApiRoute } from "iron-session/next";
+import { sessionOptions } from "@/lib/session";
+import { flatten, map } from "lodash";
+import { AccessType, Exam } from "@/interfaces/exam";
+import { MODULE_ARRAY } from "@/utils/moduleUtils";
+import { requestUser } from "../../../utils/api";
+import { mapBy } from "../../../utils";
 
 const db = client.db(process.env.MONGODB_DB);
 
@@ -14,17 +16,37 @@ export default withIronSessionApiRoute(handler, sessionOptions);
 async function handler(req: NextApiRequest, res: NextApiResponse) {
 	if (req.method === "GET") return await GET(req, res);
 
-	res.status(404).json({ok: false});
+	res.status(404).json({ ok: false });
 }
 
 async function GET(req: NextApiRequest, res: NextApiResponse) {
 	if (!req.session.user) {
-		res.status(401).json({ok: false});
+		res.status(401).json({ ok: false });
 		return;
 	}
+	const user = await requestUser(req, res)
+	if (!user)
+		return res.status(401).json({ ok: false, reason: "You must be logged in!" })
+	const isAdmin = ["admin", "developer"].includes(user.type)
+	const { entities = [] } = req.query as { access?: AccessType, entities?: string[] | string };
+	let entitiesToFetch = Array.isArray(entities) ? entities : entities ? [entities] : []
+
+	if (!isAdmin) {
+		const userEntitiesIDs = mapBy(user.entities || [], 'id')
+		entitiesToFetch = entities ? entitiesToFetch.filter((entity): entity is string => entity ? userEntitiesIDs.includes(entity) : false) : userEntitiesIDs
+		if ((entitiesToFetch.length ?? 0) === 0) {
+			res.status(200).json([])
+			return
+		}
+	}
 
 	const moduleExamsPromises = MODULE_ARRAY.map(async (module) => {
-		const snapshot = await db.collection(module).find<Exam>({ isDiagnostic: false }).toArray();
+		const snapshot = await db.collection(module).find<Exam>({
+			isDiagnostic: false, ...(isAdmin && (entitiesToFetch.length ?? 0) === 0 ? {
+			} : {
+				entity: { $in: entitiesToFetch }
+			})
+		}).toArray();
 
 		return snapshot.map((doc) => ({
 			...doc,