diff --git a/src/lib/flashMessages.ts b/src/lib/flashMessages.ts index 2276f46..8eaf8d0 100644 --- a/src/lib/flashMessages.ts +++ b/src/lib/flashMessages.ts @@ -1 +1,5 @@ -export const notSignedInMessage = { type: 'error', message: 'You are not signed in' } as const; \ No newline at end of file +export const notSignedInMessage = { type: 'error', message: 'You are not signed in' } as const; +export const forbiddenMessage = { + type: 'error', + message: 'You are not allowed to access this' +} as const; diff --git a/src/routes/(app)/(protected)/admin/+layout.server.ts b/src/routes/(app)/(protected)/admin/+layout.server.ts index 6712c58..791af38 100644 --- a/src/routes/(app)/(protected)/admin/+layout.server.ts +++ b/src/routes/(app)/(protected)/admin/+layout.server.ts @@ -1,7 +1,7 @@ import { redirect } from 'sveltekit-flash-message/server'; import { notSignedInMessage } from '$lib/flashMessages'; -import db from '$lib/drizzle'; import { eq } from 'drizzle-orm'; +import db from '$lib/drizzle'; import { user_roles } from '../../../../schema'; export async function load(event) { diff --git a/src/routes/(app)/(protected)/admin/users/[id]/+page.server.ts b/src/routes/(app)/(protected)/admin/users/[id]/+page.server.ts index 364e73d..c4c813d 100644 --- a/src/routes/(app)/(protected)/admin/users/[id]/+page.server.ts +++ b/src/routes/(app)/(protected)/admin/users/[id]/+page.server.ts @@ -1,13 +1,14 @@ -import { eq, inArray, not } from 'drizzle-orm'; +import { and, eq, inArray, not } from 'drizzle-orm'; import { redirect } from 'sveltekit-flash-message/server'; import type { PageServerLoad } from './$types'; -import { notSignedInMessage } from '$lib/flashMessages'; +import { forbiddenMessage, notSignedInMessage } from '$lib/flashMessages'; import db from '$lib/drizzle'; -import { roles, users } from '../../../../../../schema'; +import { roles, user_roles, users } from '../../../../../../schema'; export const load: PageServerLoad = async (event) => { const { params } = event; const { id } = params; + const { user } = event.locals; // TODO: Ensure admin user if (!event.locals.user) { @@ -30,10 +31,15 @@ export const load: PageServerLoad = async (event) => { } }); + const containsAdminRole = foundUser?.user_roles?.some( + (user_role) => user_role?.role?.name === 'admin' + ); + if (!containsAdminRole) { + console.log('Not an admin'); + redirect(302, '/login', notSignedInMessage, event); + } + const currentRoleIds = foundUser?.user_roles?.map((user_role) => user_role?.role.cuid) || []; - - console.log('currentRoleIds', currentRoleIds); - let availableRoles: { name: string; cuid: string }[] = []; if (currentRoleIds?.length > 0) { availableRoles = await db.query.roles.findMany({ @@ -53,13 +59,83 @@ export const load: PageServerLoad = async (event) => { export const actions = { addRole: async (event) => { - const { params, request } = event; - d; - const data = await request.formData(); - console.log('data', data); + const { request, locals } = event; + const { user } = locals; - const roleCUID = data.get('value'); - const dbRole = await db.query.roles.findFirst({ where: eq(roles.cuid, roleCUID?.toString()) }); + if (!user) { + redirect(302, '/login', notSignedInMessage, event); + } + + const userRoles = await db.query.user_roles.findMany({ + where: eq(users.id, user.id), + with: { + role: { + columns: { + name: true, + cuid: true + } + } + } + }); + + const containsAdminRole = userRoles.some((user_role) => user_role?.role?.name === 'admin'); + if (!containsAdminRole) { + redirect(302, '/login', forbiddenMessage, event); + } + + const data = await request.formData(); + const role = data.get('role'); + const dbRole = await db.query.roles.findFirst({ + where: eq(roles.cuid, role?.toString() ?? '') + }); console.log('dbRole', dbRole); + if (dbRole) { + await db.insert(user_roles).values({ + user_id: user.id, + role_id: dbRole.id + }); + return { + success: true + }; + } + }, + removeRole: async (event) => { + const { request, locals } = event; + const { user } = locals; + if (!user) { + redirect(302, '/login', notSignedInMessage, event); + } + + const userRoles = await db.query.user_roles.findMany({ + where: eq(users.id, user.id), + with: { + role: { + columns: { + name: true, + cuid: true + } + } + } + }); + + const containsAdminRole = userRoles.some((user_role) => user_role?.role?.name === 'admin'); + if (!containsAdminRole) { + redirect(302, '/login', forbiddenMessage, event); + } + + const data = await request.formData(); + const role = data.get('role'); + const dbRole = await db.query.roles.findFirst({ + where: eq(roles.cuid, role?.toString() ?? '') + }); + console.log('dbRole', dbRole); + if (dbRole) { + await db + .delete(user_roles) + .where(and(eq(user_roles.user_id, user.id), eq(user_roles.role_id, dbRole.id))); + return { + success: true + }; + } } }; diff --git a/src/routes/(app)/(protected)/admin/users/[id]/+page.svelte b/src/routes/(app)/(protected)/admin/users/[id]/+page.svelte index c4c09a7..e86e0de 100644 --- a/src/routes/(app)/(protected)/admin/users/[id]/+page.svelte +++ b/src/routes/(app)/(protected)/admin/users/[id]/+page.svelte @@ -5,6 +5,8 @@ // import AddRolesForm from './add-roles-form.svelte'; export let data; + export let form; + const { user, availableRoles } = data; const { user_roles }: { user_roles: { role: { name: string, cuid: string } }[] } = user; @@ -17,15 +19,29 @@

User Roles

{#each user_roles as user_role} -

{capitalize(user_role?.role?.name)}

+ {#if user_role?.role?.name !== 'user'} +
+
+ + +

{capitalize(user_role?.role?.name)}

+
+
+ {:else} +

{capitalize(user_role?.role?.name)}

+ {/if} {/each} +{#if form?.success} +

Sucessfully added role

+{/if} +

Roles Available to Assign

{#each availableRoles as role} -
+
- +

{capitalize(role?.name)}

diff --git a/src/routes/(app)/(protected)/admin/users/[id]/add-roles-form.svelte b/src/routes/(app)/(protected)/admin/users/[id]/add-roles-form.svelte index 12528e0..5e8f10e 100644 --- a/src/routes/(app)/(protected)/admin/users/[id]/add-roles-form.svelte +++ b/src/routes/(app)/(protected)/admin/users/[id]/add-roles-form.svelte @@ -1,20 +1,20 @@ - - - - - - Actions - navigator.clipboard.writeText(cuid)}> - Copy User ID - - - + + + + + + Actions + navigator.clipboard.writeText(cuid)}> + Copy User ID + + + View user - + \ No newline at end of file diff --git a/src/routes/(app)/(protected)/admin/users/user-table-checkbox.svelte b/src/routes/(app)/(protected)/admin/users/user-table-checkbox.svelte index 746b5c2..c34a979 100644 --- a/src/routes/(app)/(protected)/admin/users/user-table-checkbox.svelte +++ b/src/routes/(app)/(protected)/admin/users/user-table-checkbox.svelte @@ -1,8 +1,8 @@ \ No newline at end of file diff --git a/src/routes/(auth)/sign-up/+page.server.ts b/src/routes/(auth)/sign-up/+page.server.ts index d1dbfb8..a8ccece 100644 --- a/src/routes/(auth)/sign-up/+page.server.ts +++ b/src/routes/(auth)/sign-up/+page.server.ts @@ -29,12 +29,12 @@ const signUpDefaults = { }; export const load: PageServerLoad = async (event) => { - redirect( - 302, - '/waitlist', - { type: 'error', message: 'Sign-up not yet available. Please add your email to the waitlist!' }, - event - ); + // redirect( + // 302, + // '/waitlist', + // { type: 'error', message: 'Sign-up not yet available. Please add your email to the waitlist!' }, + // event + // ); if (event.locals.user) { const message = { type: 'success', message: 'You are already signed in' } as const;