GKaszewski/movies-diary
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: gate wrapup generate behind admin role

Browse Source
This commit is contained in:
Gabriel Kaszewski
2026-06-02 23:14:06 +02:00
parent 490bd97a40
commit 21c33b169e
2 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
crates/api-types/src/wrapup.rs
View File

@@ -1,10 +1,11 @@
use serde::{Deserialize, Serialize}; use serde::{Deserialize, Serialize};
use uuid::Uuid;
#[derive(Debug, Deserialize, utoipa::ToSchema)] #[derive(Debug, Deserialize, utoipa::ToSchema)]
pub struct GenerateWrapUpRequest { pub struct GenerateWrapUpRequest {
pub start_date: String, pub start_date: String,
pub end_date: String, pub end_date: String,
pub global: Option<bool>, pub user_id: Option<Uuid>,
} }
#[derive(Debug, Serialize, utoipa::ToSchema)] #[derive(Debug, Serialize, utoipa::ToSchema)]

11
crates/presentation/src/handlers/wrapup.rs
View File

@@ -19,7 +19,7 @@ use domain::value_objects::WrapUpId;
use crate::{ use crate::{
csrf::CsrfToken, csrf::CsrfToken,
errors::ApiError, errors::ApiError,
extractors::{AuthenticatedUser, OptionalCookieUser}, extractors::{AdminUser, AuthenticatedUser, OptionalCookieUser},
render::render_page, render::render_page,
state::AppState, state::AppState,
}; };
@@ -47,23 +47,20 @@ fn record_to_dto(r: &WrapUpRecord) -> WrapUpStatusResponse {
(status = 200, body = WrapUpGeneratedResponse), (status = 200, body = WrapUpGeneratedResponse),
(status = 400, description = "Invalid date format"), (status = 400, description = "Invalid date format"),
(status = 401, description = "Unauthorized"), (status = 401, description = "Unauthorized"),
(status = 403, description = "Forbidden — admin only"),
), ),
security(("bearer_auth" = [])) security(("bearer_auth" = []))
)] )]
pub async fn post_generate( pub async fn post_generate(
State(state): State<AppState>, State(state): State<AppState>,
user: AuthenticatedUser, _admin: AdminUser,
Json(req): Json<GenerateWrapUpRequest>, Json(req): Json<GenerateWrapUpRequest>,
) -> Result<Json<WrapUpGeneratedResponse>, ApiError> { ) -> Result<Json<WrapUpGeneratedResponse>, ApiError> {
let start = NaiveDate::parse_from_str(&req.start_date, "%Y-%m-%d") let start = NaiveDate::parse_from_str(&req.start_date, "%Y-%m-%d")
.map_err(|_| DomainError::ValidationError("invalid start_date".into()))?; .map_err(|_| DomainError::ValidationError("invalid start_date".into()))?;
let end = NaiveDate::parse_from_str(&req.end_date, "%Y-%m-%d") let end = NaiveDate::parse_from_str(&req.end_date, "%Y-%m-%d")
.map_err(|_| DomainError::ValidationError("invalid end_date".into()))?; .map_err(|_| DomainError::ValidationError("invalid end_date".into()))?;
let user_id = if req.global.unwrap_or(false) { let user_id = req.user_id;
None
} else {
Some(user.0.value())
};
let cmd = RequestWrapUpCommand { let cmd = RequestWrapUpCommand {
user_id, user_id,
start_date: start, start_date: start,