Add domain ownership test to PURL save endpoint

fabiante · Sep 24, 2023 · 0f930df · 0f930df
1 parent adc4abf
commit 0f930df
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/api/err.go b/api/err.go
@@ -1,10 +1,17 @@
 package api
 
 import (
+	"errors"
+
 	"github.com/fabiante/persurl/api/res"
 	"github.com/gin-gonic/gin"
 )
 
+var (
+	ErrForbidden = errors.New("you are not allowed to do this")
+)
+
+// respondWithError responds with an error and aborts the request.
 func respondWithError(ctx *gin.Context, status int, err error) {
 	response := res.ErrorList{
 		Errors: []res.Error{

diff --git a/api/server_admin.go b/api/server_admin.go
@@ -30,7 +30,12 @@ func (s *Server) SavePURL(ctx *gin.Context) {
 		return
 	}
 
-	// todo: check user authorization on this url
+	// check authorization
+	user := getAuthenticatedUser(ctx)
+	if domain.OwnerID != user.ID {
+		respondWithError(ctx, http.StatusForbidden, ErrForbidden)
+		return
+	}
 
 	err = s.admin.SavePURL(domain, name, req.Target)
 	switch {