Commit 1638df67 authored by Diego Iván's avatar Diego Iván
Browse files

agregando validacion de que el admin solo pueda actualizar su town asignado

parent 6cfd65f9

backend/src/auth/admin/authAdmin.guard.ts

+0 −1
Original line number Diff line number Diff line
@@ -21,7 +21,6 @@ export class AuthAdminGuard implements CanActivate { 
    const jwtPayload = await this.authAdminService.validateToken(authorization);

    if (!requiredRole.includes(jwtPayload.role)) throw new UnauthorizedException('Unauthorized access');

    const admin = await this.adminService.findOne(jwtPayload.email);

    console.log({ admin });

    request.admin = { ...admin };

    return true;

  }

backend/src/place/place.controller.ts

+2 −3
Original line number Diff line number Diff line
@@ -14,7 +14,7 @@ import { PlaceService } from './place.service'; 
import { CreatePlaceDateTradDto } from './dto/create-place-date.dto';

import { ApiBearerAuth, ApiBody, ApiConsumes, ApiParam, ApiQuery, ApiTags } from '@nestjs/swagger';

import { Roles } from 'src/auth/role.decorator';

import { ADMIN_ROLES } from 'src/shared/enum/admin-role.enum';

import { ALL_ROLES } from 'src/shared/enum/admin-role.enum';

import { fileInterceptor } from 'src/shared/interceptors/file-save.interceptor';

import { FileValidationPipe } from 'src/shared/pipe/file-validation.pipe';

import { LANGUAGES } from 'src/shared/enum/languages.enum';
@@ -27,7 +27,7 @@ export class PlaceController { 


  @ApiBody({ type: CreatePlaceDateTradDto })

  @ApiConsumes('multipart/form-data')

  @Roles(ADMIN_ROLES)

  @Roles([ALL_ROLES.ADMIN])

  @ApiBearerAuth('jwt')

  @Post()

  @UseInterceptors(fileInterceptor('image', 'static/places/', ['.jpg', '.jpeg', '.png']))
@@ -37,7 +37,6 @@ export class PlaceController { 
    @Req() req: CustomAdminRequest,

  ) {

    try {

      console.log({ idTown: req.admin.idTown, createPlaceDto });

      if (req.admin.idTown.townId != createPlaceDto.idTown) {

        throw new UnauthorizedException('This is not your assigned town');

      }

backend/src/town/town.controller.ts

+21 −4
Original line number Diff line number Diff line 
import { Controller, Get, Post, Param, UseInterceptors, UploadedFile, Body, Query, Patch } from '@nestjs/common';

import {

  Controller,

  Get,

  Post,

  Param,

  UseInterceptors,

  UploadedFile,

  Body,

  Query,

  Patch,

  Req,

  UnauthorizedException,

} from '@nestjs/common';

import { TownService } from './town.service';

import { ApiBearerAuth, ApiBody, ApiConsumes, ApiParam, ApiQuery, ApiTags } from '@nestjs/swagger';

import { FileValidationPipe } from 'src/shared/pipe/file-validation.pipe';

import { fileInterceptor } from 'src/shared/interceptors/file-save.interceptor';

import { CreateTownDto } from './dto/create-town.dto';

import { Roles } from 'src/auth/role.decorator';

import { SUPERADMIN_ROLES } from 'src/shared/enum/admin-role.enum';

import { ALL_ROLES, SUPERADMIN_ROLES } from 'src/shared/enum/admin-role.enum';

import { CreateTownReqDto } from './dto/createTownReq.dto';

import { CustomAdminRequest } from 'src/auth/admin/interface/customAdminReq';

@Controller()

@ApiTags('Pueblos')

export class TownController {
@@ -46,7 +59,7 @@ export class TownController { 
    }

  }



  @Roles(SUPERADMIN_ROLES)

  @Roles([ALL_ROLES.ADMIN])

  @ApiBearerAuth('jwt')

  @ApiBody({ type: CreateTownReqDto })

  @ApiConsumes('multipart/form-data')
@@ -56,8 +69,12 @@ export class TownController { 
    @Param('idTown') idTown: number,

    @UploadedFile(new FileValidationPipe()) file,

    @Body() createTownReqDto: CreateTownReqDto,

    @Req() req: CustomAdminRequest,

  ) {

    try {

      if (req.admin.idTown.townId != idTown) {

        throw new UnauthorizedException('This is not your assigned town');

      }

      const updateTownDto: CreateTownDto = {

        name: createTownReqDto.name,

        imageName: file.filename,
@@ -66,7 +83,7 @@ export class TownController { 
        state: createTownReqDto.state,

      };

      await this.townService.update(idTown, updateTownDto);

      return { message: 'Town created successfully' };

      return { message: 'Town updated successfully' };

    } catch (error) {

      throw error;

    }