From a8be97985ae9a5fc8ef62259ccfa7b3ee98ca4a1 Mon Sep 17 00:00:00 2001
From: andrusyakka <andrusyakka@dopcore.com>
Date: Wed, 5 Jul 2023 18:37:24 +0300
Subject: [PATCH] add check roles

---
 main.go                |   9 +++++----
 model/organization.go  |   2 +-
 model/position.go      |   2 +-
 mw/check_admin_role.go |  17 +++++++++++++++++
 test.db                | Bin 69632 -> 69632 bytes
 5 files changed, 24 insertions(+), 6 deletions(-)
 create mode 100644 mw/check_admin_role.go

diff --git a/main.go b/main.go
index 0c778cd..1ac03e2 100644
--- a/main.go
+++ b/main.go
@@ -4,6 +4,7 @@ import (
 	"astra-users/config"
 	"astra-users/handler"
 	"astra-users/model"
+	"astra-users/mw"
 	"github.com/labstack/echo/v4"
 	"github.com/labstack/echo/v4/middleware"
 	"gorm.io/driver/sqlite"
@@ -49,11 +50,11 @@ func main() {
 	e.DELETE("/:id", h.DeleteUser)
 	e.GET("/health", h.Health)
 
-	e.GET("/positions/:id", h.GetPositionHandler)
-	e.POST("/positions", h.CreatePosition)
+	e.GET("/positions/:id", h.GetPositionHandler, mw.CheckAdminRole)
+	e.POST("/positions", h.CreatePosition, mw.CheckAdminRole)
 
-	e.GET("/organizations", h.GetOrganizations)
-	e.POST("/organizations", h.CreateOrganization)
+	e.GET("/organizations", h.GetOrganizations, mw.CheckAdminRole)
+	e.POST("/organizations", h.CreateOrganization, mw.CheckAdminRole)
 
 	e.Logger.Fatal(e.Start(":" + config.Env.Server.Port))
 }
diff --git a/model/organization.go b/model/organization.go
index 74e9fdf..61c4231 100644
--- a/model/organization.go
+++ b/model/organization.go
@@ -4,7 +4,7 @@ import "gorm.io/gorm"
 
 type Organization struct {
 	gorm.Model
-	Name      string     `gorm:"unique;index"`
+	Name      string     `json:"name" gorm:"unique;index"`
 	ParentID  uint       `json:"parent_id"`
 	Positions []Position `json:"positions,omitempty"`
 }
diff --git a/model/position.go b/model/position.go
index 368e746..bc79ca0 100644
--- a/model/position.go
+++ b/model/position.go
@@ -4,7 +4,7 @@ import "gorm.io/gorm"
 
 type Position struct {
 	gorm.Model
-	Name           string `gorm:"unique;index"`
+	Name           string `json:"name" gorm:"unique;index"`
 	RightMask      int    `json:"right_mask"`
 	OrganizationID uint   `json:"organization_id" gorm:"index;not null"`
 	Users          []User `json:"users,omitempty"`
diff --git a/mw/check_admin_role.go b/mw/check_admin_role.go
new file mode 100644
index 0000000..a505fc0
--- /dev/null
+++ b/mw/check_admin_role.go
@@ -0,0 +1,17 @@
+package mw
+
+import (
+	"github.com/labstack/echo/v4"
+	"net/http"
+)
+
+func CheckAdminRole(next echo.HandlerFunc) echo.HandlerFunc {
+	return func(c echo.Context) error {
+		role := c.Request().Header.Get("UserRole")
+		if role != "admin" {
+			return c.NoContent(http.StatusUnauthorized)
+		}
+
+		return next(c)
+	}
+}
diff --git a/test.db b/test.db
index 5ba84c9fc1fdb4817d420294b0f28da87a32071a..7cd6d27bb2e657891e26a425c8dfeab6e5bf6052 100644
GIT binary patch
delta 548
zcmZuu&ubG=5Pom-vU$7ver&qd6;n)9P(wqkm4ForsS+qsi%JnZNlF7vrQ6hah>DPX
z<R%n#@T5o)q(?RD#f#Ki>#6^M(u0Tu^d$5Wi*I{S3La({X6F0mo0;}1X|Iw;hX-&5
zA(Ym}wIvY3*B=)~i#l6e*y8jD;<S};J~=B+#(pX$`DM02Tl|}qr@wh9pV2Zc%S%z(
zEhXV&a??>&<)-}MVcfY3*gP)8#cP#`nM!VELfun?(OdIAHq=2V(vp2!c`1K9i^D-!
zW*)3?52wHtL-2v0^4N3a`r|%E^<b{nYA)wBXp-lNn%68nI*&<cC<&W(2|D&s$T|hP
zp+w3bJBdRMTec5PI}N+K^vcd9#uSHX=UkG7(~7}E=LEK(>#W&&<H9}(l7v_dzyce^
z=AM@K?5v^E@RN-YIjel=&{^xII$-)|viL!)TLjg`T4SkMzf)fdnpA_%8_I<#am4$#
z`-Q1W?pWLe8_q5GF5VgH5WJ8<#I}D)7RxYX56K<b)0g}r;qz$@JFj^}%6-`#A#Oz8
z^ySNKx7&{6D}Bl0XCW6MSrd`QtZBb{71O=ce`%hqXRsL!t$&r>2FX!FMEkHe@ZZT6
MP54%IZm}Nx0dxeN3;+NC

delta 959
zcmc(d&rcIU6vt<Fw{+Xx+1YxaA{2`x2q{0NyW7(3MUgZy{(=w=)?cODZlwtnq?mvg
z7&P%J%*mJ_=|S%-e*hjhm>4kLd+<k4@n9lRV?vDEs)>mwPbTmCGV}6Y-n`Ge#Wi7Z
zO}KaD5ZDI*1Y99kJOHq9xm)XXqrEwZ<TOAc<)ypQS^t)QL^&;gkPB!R-4J(CN~HLK
z7!f1*j1y2}9`?lZ^mrySYfn!52S-u^qp9%dz^QYorFlB!4Mvu3(NS-(y&bxTEGsp%
zIIkKqkfRnG6k}~}quaq)5K>REl(*-K`MJ!^vOQDI<n0N2)}lFf2U)_>IL$gezH!J;
z)61+?>SNpfHdd0t0_Er>cHbXk=cP9G(cjIRG|iT!gvU!S(2Hza>VOUGv-CKCjsg@+
z>k!oXP)M(_XR-!mrYbG08R;Co%7zi~_*@tr4Em1oUDR6fbqO<c%*)o~PET>FRL1r6
zEwPi&&<uNzI-uf4k{rFl&MB=;;-BM($EK&s#o1cf7z@ZYd#7x0G|yIXiNl|q0C|g>
zJiNdI$niYz`SBj$a24RMxQeST*d5IF`cPx-gR=R_VoBFEUgU$m`eps3pgICMz?DU{
zLe%x=Lf8*f0I;oWDA29mM+=njGB_~=LKL+}LVyqw?WtRskYwE=b*~Xk?;-IXO%H1%
zX~dIyyqB2Kgw}6Fi0)?oZg1-r$r*-bCJMP|E^3(Bf>khb3Db-hEK@VI{;X|8Z6j`&
zmZ=XKxvXKvOfzcrCt{kFh{dj#^W}WO^?%9Tor$S=+orvo42J4&4uwL1y<Tl|MVbBZ
z5nsi7Ke1GITG+Qf$q|MR@XBU0RGpU1H@GsbR#a7~Z8N7hH4;vp#22*S{6`Ef1@f;L
W9Oru)a`kavV2Ieuox|Q=AO8c3R1Z-A