feat: add auth middleware

src/pages/api/users/[id].ts

@@ -6,7 +6,12 @@ import nc from 'next-connect'
 import { prisma } from '../../../services/prisma'
 import { ExceptionError } from '../../../utils/error'
 
-const handler = nc<NextApiRequest, NextApiResponse>({
+interface Request extends NextApiRequest {
+  userId: string
+  userRole: string
+}
+
+const handler = nc<Request, NextApiResponse>({
   onNoMatch: (_req, res) => {
     res.status(404).json({ error: 'Not found' })
   },
@@ -51,7 +56,6 @@ const handler = nc<NextApiRequest, NextApiResponse>({
 
     res.status(200).json(response)
   })
-
   .patch(async (req, res) => {
     const { id } = req.query
     const { username, password, newPassword, role } = req.body
@@ -69,6 +73,10 @@ const handler = nc<NextApiRequest, NextApiResponse>({
       throw new ExceptionError('No id provided')
     }
 
+    if (req.userRole !== 'ADMIN' && req.userId !== id) {
+      throw new ExceptionError('Only admins can update other users')
+    }
+
     if (username) {
       const usernameExists = await prisma.user.findUnique({
         where: { username }
@@ -118,7 +126,6 @@ const handler = nc<NextApiRequest, NextApiResponse>({
       throw new ExceptionError(err)
     }
   })
-
   .delete(async (req, res) => {
     const { id } = req.query
 
@@ -130,6 +137,10 @@ const handler = nc<NextApiRequest, NextApiResponse>({
       throw new ExceptionError('Cannot delete admin', 403)
     }
 
+    if (req.userRole !== 'ADMIN' && req.userId !== id) {
+      throw new ExceptionError('Only admins can delete other users')
+    }
+
     try {
       await prisma.data.delete({
         where: { id: +id }

src/pages/api/users/index.ts

@@ -4,9 +4,15 @@ import type { NextApiRequest, NextApiResponse } from 'next'
 import nc from 'next-connect'
 
 import { prisma } from '../../../services/prisma'
+import { authMiddleware } from '../../../utils/authMiddleware'
 import { ExceptionError } from '../../../utils/error'
 
-const handler = nc<NextApiRequest, NextApiResponse>({
+interface Request extends NextApiRequest {
+  userId: string
+  userRole: string
+}
+
+const handler = nc<Request, NextApiResponse>({
   onNoMatch: (_req, res) => {
     res.status(404).json({ error: 'Not found' })
   },
@@ -29,6 +35,7 @@ const handler = nc<NextApiRequest, NextApiResponse>({
     }
   }
 })
+  .use(authMiddleware)
   .get(async (_req, res) => {
     const response = await prisma.user.findMany({
       select: {
@@ -44,7 +51,6 @@ const handler = nc<NextApiRequest, NextApiResponse>({
 
     res.status(200).json(response)
   })
-
   .post(async (req, res) => {
     const { username, password, role } = req.body
 
@@ -56,7 +62,9 @@ const handler = nc<NextApiRequest, NextApiResponse>({
       throw new ExceptionError('Role must be either ADMIN or EDITOR')
     }
 
-    // TODO implement role validation
+    if (req.userRole !== 'ADMIN') {
+      throw new ExceptionError('Only admins can create users')
+    }
 
     const usernameExists = await prisma.user.findUnique({
       where: { username }