diff --git a/apps/api/src/controllers/auth.ts b/apps/api/src/controllers/auth.ts index 3a5875017..f9bdd639b 100644 --- a/apps/api/src/controllers/auth.ts +++ b/apps/api/src/controllers/auth.ts @@ -5,6 +5,7 @@ import jwt from "jsonwebtoken"; import { track } from "../lib/hog"; import { checkToken } from "../lib/jwt"; import { forgotPassword } from "../lib/nodemailer/auth/forgot-password"; +import { checkSession } from "../lib/session"; import { prisma } from "../prisma"; export function authRoutes(fastify: FastifyInstance) { @@ -26,6 +27,8 @@ export function authRoutes(fastify: FastifyInstance) { }, }, async (request: FastifyRequest, reply: FastifyReply) => { + const bearer = request.headers.authorization!.split(" ")[1]; + let { email, password, admin, name } = request.body as { email: string; password: string; @@ -33,37 +36,50 @@ export function authRoutes(fastify: FastifyInstance) { name: string; }; - // Checks if email already exists - let record = await prisma.user.findUnique({ - where: { email }, - }); + if (bearer) { + const token = checkToken(bearer); + if (token) { + const requester = await checkSession(token); - // if exists, return 400 - if (record) { - reply.code(400).send({ - message: "Email already exists", - }); - } + if (!requester?.isAdmin) { + reply.code(401).send({ + message: "Unauthorized", + }); + } - const user = await prisma.user.create({ - data: { - email, - password: await bcrypt.hash(password, 10), - name, - isAdmin: admin, - }, - }); + // Checks if email already exists + let record = await prisma.user.findUnique({ + where: { email }, + }); - const hog = track(); + // if exists, return 400 + if (record) { + reply.code(400).send({ + message: "Email already exists", + }); + } + + const user = await prisma.user.create({ + data: { + email, + password: await bcrypt.hash(password, 10), + name, + isAdmin: admin, + }, + }); - hog.capture({ - event: "user_registered", - distinctId: user.id, - }); + const hog = track(); - reply.send({ - success: true, - }); + hog.capture({ + event: "user_registered", + distinctId: user.id, + }); + + reply.send({ + success: true, + }); + } + } } ); diff --git a/apps/client/pages/ticket/[id].tsx b/apps/client/pages/ticket/[id].tsx index 7647bad54..610f1b171 100644 --- a/apps/client/pages/ticket/[id].tsx +++ b/apps/client/pages/ticket/[id].tsx @@ -373,6 +373,7 @@ export default function Ticket() { > save + )} {user.isAdmin && ( - ) : ( - - )}