Add check for userId and admin to top

pages/api/schedules/index.ts

@@ -10,84 +10,87 @@ async function createOrlistAllSchedules(
   { method, body, userId, isAdmin, prisma }: NextApiRequest,
   res: NextApiResponse<SchedulesResponse | ScheduleResponse>
 ) {
-  if (method === "GET") {
+  if (body.userId && !isAdmin) {
-    /**
+    res.status(401).json({ message: "Unauthorized" });
-     * @swagger
+  } else {
-     * /schedules:
+    if (method === "GET") {
-     *   get:
+      /**
-     *     operationId: listSchedules
+       * @swagger
-     *     summary: Find all schedules
+       * /schedules:
-     *     tags:
+       *   get:
-     *     - schedules
+       *     operationId: listSchedules
-     *     responses:
+       *     summary: Find all schedules
-     *       200:
+       *     tags:
-     *         description: OK
+       *     - schedules
-     *       401:
+       *     responses:
-     *        description: Authorization information is missing or invalid.
+       *       200:
-     *       404:
+       *         description: OK
-     *         description: No schedules were found
+       *       401:
-     */
+       *        description: Authorization information is missing or invalid.
-    if (body.userId && !isAdmin) res.status(401).json({ message: "Unauthorized" });
+       *       404:
-    const data = await prisma.schedule.findMany({
+       *         description: No schedules were found
-      where: { userId: body.userId && isAdmin ? body.userId : userId },
+       */
-    });
+      const data = await prisma.schedule.findMany({
-    const schedules = data.map((schedule) => schemaSchedulePublic.parse(schedule));
+        where: { userId: body.userId && isAdmin ? body.userId : userId },
-    if (schedules) res.status(200).json({ schedules });
+      });
-    else
+      const schedules = data.map((schedule) => schemaSchedulePublic.parse(schedule));
-      (error: Error) =>
+      if (schedules) res.status(200).json({ schedules });
-        res.status(404).json({
+      else
-          message: "No Schedules were found",
+        (error: Error) =>
-          error,
+          res.status(404).json({
-        });
+            message: "No Schedules were found",
-  } else if (method === "POST") {
+            error,
-    /**
+          });
-     * @swagger
+    } else if (method === "POST") {
-     * /schedules:
+      /**
-     *   post:
+       * @swagger
-     *     operationId: addSchedule
+       * /schedules:
-     *     summary: Creates a new schedule
+       *   post:
-     *     tags:
+       *     operationId: addSchedule
-     *     - schedules
+       *     summary: Creates a new schedule
-     *     responses:
+       *     tags:
-     *       201:
+       *     - schedules
-     *         description: OK, schedule created
+       *     responses:
-     *       400:
+       *       201:
-     *        description: Bad request. Schedule body is invalid.
+       *         description: OK, schedule created
-     *       401:
+       *       400:
-     *        description: Authorization information is missing or invalid.
+       *        description: Bad request. Schedule body is invalid.
-     */
+       *       401:
-    const safe = schemaScheduleBodyParams.safeParse(body);
+       *        description: Authorization information is missing or invalid.
-    if (body.userId && !isAdmin) res.status(401).json({ message: "Unauthorized" });
+       */
+      const safe = schemaScheduleBodyParams.safeParse(body);
+      if (body.userId && !isAdmin) res.status(401).json({ message: "Unauthorized" });
 
-    if (!safe.success) {
+      if (!safe.success) {
-      res.status(400).json({ message: "Invalid request body" });
+        res.status(400).json({ message: "Invalid request body" });
-      return;
+        return;
-    }
+      }
-    const data = await prisma.schedule.create({
+      const data = await prisma.schedule.create({
-      data: {
+        data: {
-        ...safe.data,
+          ...safe.data,
-        userId: body.userId && isAdmin ? body.userId : userId,
+          userId: body.userId && isAdmin ? body.userId : userId,
-        availability: {
+          availability: {
-          createMany: {
+            createMany: {
-            data: getAvailabilityFromSchedule(DEFAULT_SCHEDULE).map((schedule) => ({
+              data: getAvailabilityFromSchedule(DEFAULT_SCHEDULE).map((schedule) => ({
-              days: schedule.days,
+                days: schedule.days,
-              startTime: schedule.startTime,
+                startTime: schedule.startTime,
-              endTime: schedule.endTime,
+                endTime: schedule.endTime,
-            })),
+              })),
+            },
           },
         },
-      },
+      });
-    });
+      const schedule = schemaSchedulePublic.parse(data);
-    const schedule = schemaSchedulePublic.parse(data);
 
-    if (schedule) res.status(201).json({ schedule, message: "Schedule created successfully" });
+      if (schedule) res.status(201).json({ schedule, message: "Schedule created successfully" });
-    else
+      else
-      (error: Error) =>
+        (error: Error) =>
-        res.status(400).json({
+          res.status(400).json({
-          message: "Could not create new schedule",
+            message: "Could not create new schedule",
-          error,
+            error,
-        });
+          });
-  } else res.status(405).json({ message: `Method ${method} not allowed` });
+    } else res.status(405).json({ message: `Method ${method} not allowed` });
+  }
 }
 
 export default withMiddleware("HTTP_GET_OR_POST")(createOrlistAllSchedules);