From 9a43fa05ade031c91d515d1254e05fd33cc7a482 Mon Sep 17 00:00:00 2001 From: physcik Date: Mon, 27 Apr 2026 16:52:45 +0500 Subject: Auth middleware + origin check --- backend/src/API/WeaponsAPI.zig | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) (limited to 'backend/src/API/WeaponsAPI.zig') diff --git a/backend/src/API/WeaponsAPI.zig b/backend/src/API/WeaponsAPI.zig index 7c8d72a..101c436 100644 --- a/backend/src/API/WeaponsAPI.zig +++ b/backend/src/API/WeaponsAPI.zig @@ -42,7 +42,9 @@ fn getRangedWeaponById(_: *Handler.RequestData, req: *httpz.Request, res: *httpz try res.json(found, .{}); } -fn newRangedWeapon(_: *Handler.RequestData, req: *httpz.Request, res: *httpz.Response) !void { +fn newRangedWeapon(data: *Handler.RequestData, req: *httpz.Request, res: *httpz.Response) !void { + try data.CheckAccess(.editor); + var body = try req.json(model.RequestBody) orelse { res.setStatus(.bad_request); return; @@ -63,7 +65,9 @@ fn newRangedWeapon(_: *Handler.RequestData, req: *httpz.Request, res: *httpz.Res res.setStatus(.created); } -fn updateRangedWeapon(_: *Handler.RequestData, req: *httpz.Request, res: *httpz.Response) !void { +fn updateRangedWeapon(data: *Handler.RequestData, req: *httpz.Request, res: *httpz.Response) !void { + try data.CheckAccess(.editor); + const id = req.param("id") orelse { res.setStatus(.bad_request); return; @@ -85,7 +89,9 @@ fn updateRangedWeapon(_: *Handler.RequestData, req: *httpz.Request, res: *httpz. }; } -fn deleteRangedWeapon(_: *Handler.RequestData, req: *httpz.Request, res: *httpz.Response) !void { +fn deleteRangedWeapon(data: *Handler.RequestData, req: *httpz.Request, res: *httpz.Response) !void { + try data.CheckAccess(.editor); + const id = req.param("id") orelse { res.setStatus(.bad_request); return; @@ -118,7 +124,9 @@ fn getRangedWeaponDescription(_: *Handler.RequestData, req: *httpz.Request, res: try res.json(desc, .{}); } -fn setRangedWeaponDescription(_: *Handler.RequestData, req: *httpz.Request, res: *httpz.Response) !void { +fn setRangedWeaponDescription(data: *Handler.RequestData, req: *httpz.Request, res: *httpz.Response) !void { + try data.CheckAccess(.editor); + const id = req.param("id") orelse { res.setStatus(.bad_request); return; -- cgit v1.3