iritmaximus/oodikone
1
0
Fork 0
mirror of https://github.com/UniversityOfHelsinkiCS/oodikone.git synced 2026-10-12 19:03:39 +03:00
Code Issues Packages Projects Releases Wiki Activity

Hotfix user right check when user has rights for programme and studyguidancegroups

Browse Source
This commit is contained in:
Otto Ahoniemi
2021-12-09 01:00:30 +02:00
parent 66c14883c0
commit 214d91fcba
1 changed files with 8 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/backend/src/routes/students.js
+8 -12
View File
@@ -53,18 +53,7 @@ router.get('/students/:id', async (req, res) => {
const { id: studentId } = req.params
const { roles, decodedToken } = req
if (roles && roles.includes('admin')) {
const results = await Student.withId(studentId)
return results.error
? res.status(400).json({ error: 'error finding student' }).end()
: res.status(200).json(filterStudentTags(results, decodedToken.id)).end()
}
if (roles && roles.includes('studyGuidanceGroups')) {
const studentsUserCanAccess = await getAllStudentsUserHasInGroups(decodedToken.sisPersonId)
if (!studentsUserCanAccess.has(studentId)) {
return res.status(400).json({ error: 'error finding student' }).end()
}
if (roles?.includes('admin')) {
const results = await Student.withId(studentId)
return results.error
? res.status(400).json({ error: 'error finding student' }).end()
@@ -85,6 +74,13 @@ router.get('/students/:id', async (req, res) => {
})
)
if (roles?.includes('studyGuidanceGroups')) {
const studentsUserCanAccess = await getAllStudentsUserHasInGroups(decodedToken.sisPersonId)
if (studentsUserCanAccess.has(studentId)) {
return res.status(200).json(filterStudentTags(student, decodedToken.id)).end()
}
}
if (rights.some(right => right !== null)) {
res.status(200).json(filterStudentTags(student, decodedToken.id)).end()
} else {