Mhamdans17 commited on
Commit ·
78649bc
1
Parent(s): ae76db4
fix: members API 401 unauthorized by extracting companyID from user context
Browse files- controllers/member_controller.go +15 -10
controllers/member_controller.go
CHANGED
|
@@ -10,12 +10,13 @@ import (
|
|
| 10 |
|
| 11 |
// ListMembers (GET /api/members)
|
| 12 |
func ListMembers(c *gin.Context) {
|
| 13 |
-
|
| 14 |
if !exists {
|
| 15 |
c.JSON(http.StatusUnauthorized, gin.H{"detail": "Unauthorized"})
|
| 16 |
return
|
| 17 |
}
|
| 18 |
-
|
|
|
|
| 19 |
|
| 20 |
var members []models.Member
|
| 21 |
if err := config.DB.Where("company_id = ?", companyID).Order("created_at desc").Find(&members).Error; err != nil {
|
|
@@ -28,12 +29,13 @@ func ListMembers(c *gin.Context) {
|
|
| 28 |
|
| 29 |
// CreateMember (POST /api/members)
|
| 30 |
func CreateMember(c *gin.Context) {
|
| 31 |
-
|
| 32 |
if !exists {
|
| 33 |
c.JSON(http.StatusUnauthorized, gin.H{"detail": "Unauthorized"})
|
| 34 |
return
|
| 35 |
}
|
| 36 |
-
|
|
|
|
| 37 |
|
| 38 |
var input struct {
|
| 39 |
MemberID string `json:"member_id" binding:"required"`
|
|
@@ -71,12 +73,13 @@ func CreateMember(c *gin.Context) {
|
|
| 71 |
|
| 72 |
// UpdateMember (PUT /api/members/:member_id)
|
| 73 |
func UpdateMember(c *gin.Context) {
|
| 74 |
-
|
| 75 |
if !exists {
|
| 76 |
c.JSON(http.StatusUnauthorized, gin.H{"detail": "Unauthorized"})
|
| 77 |
return
|
| 78 |
}
|
| 79 |
-
|
|
|
|
| 80 |
memberID := c.Param("member_id")
|
| 81 |
|
| 82 |
var member models.Member
|
|
@@ -108,12 +111,13 @@ func UpdateMember(c *gin.Context) {
|
|
| 108 |
|
| 109 |
// SetPoints (PUT /api/members/:member_id/points) - Owner ONLY
|
| 110 |
func SetPoints(c *gin.Context) {
|
| 111 |
-
|
| 112 |
if !exists {
|
| 113 |
c.JSON(http.StatusUnauthorized, gin.H{"detail": "Unauthorized"})
|
| 114 |
return
|
| 115 |
}
|
| 116 |
-
|
|
|
|
| 117 |
memberID := c.Param("member_id")
|
| 118 |
|
| 119 |
var member models.Member
|
|
@@ -143,12 +147,13 @@ func SetPoints(c *gin.Context) {
|
|
| 143 |
|
| 144 |
// DeleteMember (DELETE /api/members/:member_id)
|
| 145 |
func DeleteMember(c *gin.Context) {
|
| 146 |
-
|
| 147 |
if !exists {
|
| 148 |
c.JSON(http.StatusUnauthorized, gin.H{"detail": "Unauthorized"})
|
| 149 |
return
|
| 150 |
}
|
| 151 |
-
|
|
|
|
| 152 |
memberID := c.Param("member_id")
|
| 153 |
|
| 154 |
if err := config.DB.Where("company_id = ? AND id = ?", companyID, memberID).Delete(&models.Member{}).Error; err != nil {
|
|
|
|
| 10 |
|
| 11 |
// ListMembers (GET /api/members)
|
| 12 |
func ListMembers(c *gin.Context) {
|
| 13 |
+
userVal, exists := c.Get("user")
|
| 14 |
if !exists {
|
| 15 |
c.JSON(http.StatusUnauthorized, gin.H{"detail": "Unauthorized"})
|
| 16 |
return
|
| 17 |
}
|
| 18 |
+
user := userVal.(*models.User)
|
| 19 |
+
companyID := *user.CompanyID
|
| 20 |
|
| 21 |
var members []models.Member
|
| 22 |
if err := config.DB.Where("company_id = ?", companyID).Order("created_at desc").Find(&members).Error; err != nil {
|
|
|
|
| 29 |
|
| 30 |
// CreateMember (POST /api/members)
|
| 31 |
func CreateMember(c *gin.Context) {
|
| 32 |
+
userVal, exists := c.Get("user")
|
| 33 |
if !exists {
|
| 34 |
c.JSON(http.StatusUnauthorized, gin.H{"detail": "Unauthorized"})
|
| 35 |
return
|
| 36 |
}
|
| 37 |
+
user := userVal.(*models.User)
|
| 38 |
+
companyID := *user.CompanyID
|
| 39 |
|
| 40 |
var input struct {
|
| 41 |
MemberID string `json:"member_id" binding:"required"`
|
|
|
|
| 73 |
|
| 74 |
// UpdateMember (PUT /api/members/:member_id)
|
| 75 |
func UpdateMember(c *gin.Context) {
|
| 76 |
+
userVal, exists := c.Get("user")
|
| 77 |
if !exists {
|
| 78 |
c.JSON(http.StatusUnauthorized, gin.H{"detail": "Unauthorized"})
|
| 79 |
return
|
| 80 |
}
|
| 81 |
+
user := userVal.(*models.User)
|
| 82 |
+
companyID := *user.CompanyID
|
| 83 |
memberID := c.Param("member_id")
|
| 84 |
|
| 85 |
var member models.Member
|
|
|
|
| 111 |
|
| 112 |
// SetPoints (PUT /api/members/:member_id/points) - Owner ONLY
|
| 113 |
func SetPoints(c *gin.Context) {
|
| 114 |
+
userVal, exists := c.Get("user")
|
| 115 |
if !exists {
|
| 116 |
c.JSON(http.StatusUnauthorized, gin.H{"detail": "Unauthorized"})
|
| 117 |
return
|
| 118 |
}
|
| 119 |
+
user := userVal.(*models.User)
|
| 120 |
+
companyID := *user.CompanyID
|
| 121 |
memberID := c.Param("member_id")
|
| 122 |
|
| 123 |
var member models.Member
|
|
|
|
| 147 |
|
| 148 |
// DeleteMember (DELETE /api/members/:member_id)
|
| 149 |
func DeleteMember(c *gin.Context) {
|
| 150 |
+
userVal, exists := c.Get("user")
|
| 151 |
if !exists {
|
| 152 |
c.JSON(http.StatusUnauthorized, gin.H{"detail": "Unauthorized"})
|
| 153 |
return
|
| 154 |
}
|
| 155 |
+
user := userVal.(*models.User)
|
| 156 |
+
companyID := *user.CompanyID
|
| 157 |
memberID := c.Param("member_id")
|
| 158 |
|
| 159 |
if err := config.DB.Where("company_id = ? AND id = ?", companyID, memberID).Delete(&models.Member{}).Error; err != nil {
|