diff --git a/config/config.go b/config/config.go index ecadfa3..785554a 100644 --- a/config/config.go +++ b/config/config.go @@ -158,9 +158,6 @@ func LoadConfig() *Config { panic(err) } fmt.Printf("--ConfigLoad name : %s ", config.Name) - panic(config.OAuth2Config.ClientID) - - // bind all the environment variables to the config: configEnvironmentOverrides(&config) return &config diff --git a/internal/chore/handler.go b/internal/chore/handler.go index e6d5532..5c39aa8 100644 --- a/internal/chore/handler.go +++ b/internal/chore/handler.go @@ -427,7 +427,7 @@ func (h *Handler) editChore(c *gin.Context) { }) return } - if currentUser.ID != oldChore.CreatedBy { + if !oldChore.CanEdit(currentUser.ID, circleUsers) { c.JSON(403, gin.H{ "error": "You are not allowed to edit this chore", }) diff --git a/internal/chore/model/model.go b/internal/chore/model/model.go index 2fa652b..0cff79b 100644 --- a/internal/chore/model/model.go +++ b/internal/chore/model/model.go @@ -3,6 +3,7 @@ package model import ( "time" + cModel "donetick.com/core/internal/circle/model" lModel "donetick.com/core/internal/label/model" tModel "donetick.com/core/internal/thing/model" thingModel "donetick.com/core/internal/thing/model" @@ -169,3 +170,15 @@ type ChoreReq struct { CompletionWindow *int `json:"completionWindow"` Description *string `json:"description"` } + +func (c *Chore) CanEdit(userID int, circleUsers []*cModel.UserCircleDetail) bool { + if c.CreatedBy == userID { + return true + } + for _, cu := range circleUsers { + if cu.UserID == userID && cu.Role == "admin" { + return true + } + } + return false +} diff --git a/internal/resource/handler.go b/internal/resource/handler.go index 34744e9..c9eda6b 100644 --- a/internal/resource/handler.go +++ b/internal/resource/handler.go @@ -4,6 +4,7 @@ import ( "donetick.com/core/config" jwt "github.com/appleboy/gin-jwt/v2" "github.com/gin-gonic/gin" + "github.com/ulule/limiter/v3" ) type Resource struct { @@ -35,7 +36,7 @@ func (h *Handler) getResource(c *gin.Context) { }) } -func (h *Handler) Routes(r *gin.RouterGroup, authMiddleware *jwt.GinJWTMiddleware) { +func Routes(r *gin.Engine, h *Handler, auth *jwt.GinJWTMiddleware, limiter *limiter.Limiter) { resourceRoutes := r.Group("api/v1/resource") // skip resource endpoint for donetick.com