41 lines
1.6 KiB
TypeScript
41 lines
1.6 KiB
TypeScript
// Next.js API route support: https://nextjs.org/docs/api-routes/introduction
|
|
import type {NextApiRequest, NextApiResponse} from "next";
|
|
import {withIronSessionApiRoute} from "iron-session/next";
|
|
import {sessionOptions} from "@/lib/session";
|
|
import {getEntityWithRoles} from "@/utils/entities.be";
|
|
import client from "@/lib/mongodb";
|
|
import {Entity} from "@/interfaces/entity";
|
|
import { assignRoleToUsers, deleteRole, getRole, transferRole } from "@/utils/roles.be";
|
|
import { doesEntityAllow } from "@/utils/permissions";
|
|
import { findBy } from "@/utils";
|
|
import { getUser } from "@/utils/users.be";
|
|
|
|
const db = client.db(process.env.MONGODB_DB);
|
|
|
|
export default withIronSessionApiRoute(handler, sessionOptions);
|
|
|
|
async function handler(req: NextApiRequest, res: NextApiResponse) {
|
|
if (req.method === "POST") return await post(req, res);
|
|
}
|
|
|
|
async function post(req: NextApiRequest, res: NextApiResponse) {
|
|
if (!req.session.user) return res.status(401).json({ ok: false })
|
|
|
|
const user = await getUser(req.session.user.id);
|
|
if (!user) return res.status(401).json({ ok: false })
|
|
|
|
const { id } = req.query as { id: string };
|
|
const {users} = req.body as {users: string[]}
|
|
|
|
const role = await getRole(id)
|
|
if (!role) return res.status(404).json({ok: false})
|
|
|
|
const entity = await getEntityWithRoles(role.entityID)
|
|
if (!entity) return res.status(404).json({ok: false})
|
|
|
|
if (!doesEntityAllow(user, entity, "assign_to_role")) return res.status(403).json({ok: false})
|
|
|
|
const result = await assignRoleToUsers(users, entity.id, role.id)
|
|
return res.status(200).json({ok: result.acknowledged});
|
|
}
|