fraport/fradrive
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(course-user): authorisation checks

Browse Source
This commit is contained in:
Gregor Kleen 2020-04-17 11:05:20 +02:00
parent ced6ef2874
commit d15792cd7d
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/Handler/Course/User.hs
View File

@ -186,7 +186,9 @@ courseUserProfileSection (Entity cid Course{..}) (Entity uid User{ userShowSex =
courseUserNoteSection :: Entity Course -> Entity User -> MaybeT Handler Widget courseUserNoteSection :: Entity Course -> Entity User -> MaybeT Handler Widget
courseUserNoteSection (Entity cid _) (Entity uid _) = do courseUserNoteSection (Entity cid Course{..}) (Entity uid _) = do
guardM . hasWriteAccessTo $ CourseR courseTerm courseSchool courseShorthand CUsersR
currentRoute <- MaybeT getCurrentRoute currentRoute <- MaybeT getCurrentRoute
(thisUniqueNote, noteText, noteEdits) <- lift . runDB $ do (thisUniqueNote, noteText, noteEdits) <- lift . runDB $ do
@ -243,7 +245,9 @@ courseUserNoteSection (Entity cid _) (Entity uid _) = do
courseUserSubmissionsSection :: Entity Course -> Entity User -> MaybeT Handler Widget courseUserSubmissionsSection :: Entity Course -> Entity User -> MaybeT Handler Widget
courseUserSubmissionsSection (Entity cid _) (Entity uid _) = do courseUserSubmissionsSection (Entity cid Course{..}) (Entity uid _) = do
guardM . hasWriteAccessTo $ CourseR courseTerm courseSchool courseShorthand CCorrectionsR
let whereClause = (E.&&.) <$> courseIs cid <*> userIs uid let whereClause = (E.&&.) <$> courseIs cid <*> userIs uid
colonnade = mconcat -- should match getSSubsR for consistent UX colonnade = mconcat -- should match getSSubsR for consistent UX
[ colSelect [ colSelect
@ -281,6 +285,8 @@ courseUserSubmissionsSection (Entity cid _) (Entity uid _) = do
courseUserExamsSection :: Entity Course -> Entity User -> MaybeT Handler Widget courseUserExamsSection :: Entity Course -> Entity User -> MaybeT Handler Widget
courseUserExamsSection (Entity cid Course{..}) (Entity uid _) = do courseUserExamsSection (Entity cid Course{..}) (Entity uid _) = do
guardM . hasWriteAccessTo $ CourseR courseTerm courseSchool courseShorthand CExamNewR
uCID <- encrypt uid uCID <- encrypt uid
let let