From 3c7da624040169b7597ebc2691cf51943106a2a4 Mon Sep 17 00:00:00 2001
From: Syndamia <kamen.d.mladenov@protonmail.com>
Date: Thu, 28 Jan 2021 21:18:39 +0200
Subject: Users with only the role User can now create comments and posts
 (while admins can't create them from other people's accounts)

---
 src/DevHive.Services/Interfaces/IPostService.cs |  1 +
 src/DevHive.Services/Services/PostService.cs    |  7 +++++++
 src/DevHive.Web/Controllers/PostController.cs   | 11 ++++++++---
 3 files changed, 16 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/DevHive.Services/Interfaces/IPostService.cs b/src/DevHive.Services/Interfaces/IPostService.cs
index 37c3354..71b558c 100644
--- a/src/DevHive.Services/Interfaces/IPostService.cs
+++ b/src/DevHive.Services/Interfaces/IPostService.cs
@@ -19,6 +19,7 @@ namespace DevHive.Services.Interfaces
 		Task<bool> DeletePost(Guid id);
 		Task<bool> DeleteComment(Guid id);
 
+		Task<bool> ValidateJwtForCreating(Guid userId, string rawTokenData);
 		Task<bool> ValidateJwtForPost(Guid postId, string rawTokenData);
 		Task<bool> ValidateJwtForComment(Guid commentId, string rawTokenData);
 	}
diff --git a/src/DevHive.Services/Services/PostService.cs b/src/DevHive.Services/Services/PostService.cs
index c3dc82f..d80d815 100644
--- a/src/DevHive.Services/Services/PostService.cs
+++ b/src/DevHive.Services/Services/PostService.cs
@@ -169,6 +169,13 @@ namespace DevHive.Services.Services
 		#endregion
 
 		#region Validations
+		public async Task<bool> ValidateJwtForCreating(Guid userId, string rawTokenData)
+		{
+			User user = await this.GetUserForValidation(rawTokenData);
+
+			return user.Id == userId;
+		}
+
 		public async Task<bool> ValidateJwtForPost(Guid postId, string rawTokenData)
 		{
 			Post post = await this._postRepository.GetByIdAsync(postId) ??
diff --git a/src/DevHive.Web/Controllers/PostController.cs b/src/DevHive.Web/Controllers/PostController.cs
index 8bb1d66..0ca041f 100644
--- a/src/DevHive.Web/Controllers/PostController.cs
+++ b/src/DevHive.Web/Controllers/PostController.cs
@@ -27,9 +27,11 @@ namespace DevHive.Web.Controllers
 
 		#region Create
 		[HttpPost]
-		[Authorize(Roles = "Admin")]
-		public async Task<IActionResult> Create(Guid userId, [FromBody] CreatePostWebModel createPostWebModel)
+		public async Task<IActionResult> Create(Guid userId, [FromBody] CreatePostWebModel createPostWebModel, [FromHeader] string authorization)
 		{
+			if (await this._postService.ValidateJwtForCreating(userId, authorization))
+				return new UnauthorizedResult();
+
 			CreatePostServiceModel createPostServiceModel =
 				this._postMapper.Map<CreatePostServiceModel>(createPostWebModel);
 			createPostServiceModel.CreatorId = userId;
@@ -43,8 +45,11 @@ namespace DevHive.Web.Controllers
 
 		[HttpPost]
 		[Route("Comment")]
-		public async Task<IActionResult> AddComment(Guid userId, [FromBody] CreateCommentWebModel createCommentWebModel)
+		public async Task<IActionResult> AddComment(Guid userId, [FromBody] CreateCommentWebModel createCommentWebModel, [FromHeader] string authorization)
 		{
+			if (await this._postService.ValidateJwtForCreating(userId, authorization))
+				return new UnauthorizedResult();
+
 			CreateCommentServiceModel createCommentServiceModel =
 				this._postMapper.Map<CreateCommentServiceModel>(createCommentWebModel);
 			createCommentServiceModel.CreatorId = userId;
-- 
cgit v1.2.3