From 0ab20e57e9931c12a2763ee255023477070b302b Mon Sep 17 00:00:00 2001
From: nek0 <nek0@nek0.eu>
Date: Thu, 16 May 2019 04:07:20 +0200
Subject: [PATCH] tinker tinker

---
 src/API.hs        |  7 ++++---
 src/Main.hs       | 23 ++++++++++++++++-------
 src/Model/Auth.hs | 10 +++++++---
 3 files changed, 27 insertions(+), 13 deletions(-)

diff --git a/src/API.hs b/src/API.hs
index 6650b1f..796f0d3 100644
--- a/src/API.hs
+++ b/src/API.hs
@@ -23,10 +23,11 @@ import Types
 
 type UserAPI =
   "user" :>
-    ( "list" :> QueryParam "refine" Refine
-      :> AuthProtect "header-auth" :> Get '[JSON] [User]
+    ( "list" :> AuthProtect "header-auth"
+      :> QueryParam "refine" Refine :> Get '[JSON] [User]
     :<|> "new" :> ReqBody '[JSON] UserSubmit :> Post '[JSON] Int
-    :<|> "update" :> ReqBody '[JSON] (Int, UserSubmit) :> Post '[JSON] ()
+    :<|> "update" :> AuthProtect "header-auth"
+      :> ReqBody '[JSON] (Int, UserSubmit) :> Post '[JSON] ()
     )
   :<|> "auth" :> 
     ( "get" :> ReqBody '[JSON] Int :> Post '[JSON] AuthInfo
diff --git a/src/Main.hs b/src/Main.hs
index 94facab..a1cc819 100644
--- a/src/Main.hs
+++ b/src/Main.hs
@@ -98,8 +98,8 @@ users =
   userNew :<|>
   userUpdate
   where
-    userList :: Maybe Refine -> Maybe Int -> MateHandler [User]
-    userList ref muid = do
+    userList :: Maybe Int -> Maybe Refine -> MateHandler [User]
+    userList muid ref = do
       conn <- rsConnection <$> ask
       userSelect conn ref (isJust muid)
 
@@ -110,11 +110,20 @@ users =
       conn <- rsConnection <$> ask
       head <$> (liftIO $ runInsert_ conn (insertUser us (utctDay now) randSalt))
 
-    userUpdate :: (Int, UserSubmit) -> MateHandler ()
-    userUpdate (id, us) = do
-      now <- liftIO $ getCurrentTime
-      conn <- rsConnection <$> ask
-      void $ liftIO $ runUpdate_ conn (updateUser id us (utctDay now))
+    userUpdate :: Maybe Int -> (Int, UserSubmit) -> MateHandler ()
+    userUpdate Nothing _ =
+      throwError $ err403
+        { errBody = "No Authorization present"
+        }
+    userUpdate (Just aid) (id, us) = if aid == id
+      then do
+        now <- liftIO $ getCurrentTime
+        conn <- rsConnection <$> ask
+        void $ liftIO $ runUpdate_ conn (updateUser id us (utctDay now))
+      else
+      throwError $ err401
+        { errBody = "Wrong Authorization present"
+        }
 
 auth =
   authGet :<|>
diff --git a/src/Model/Auth.hs b/src/Model/Auth.hs
index 8a480ff..34a26da 100644
--- a/src/Model/Auth.hs
+++ b/src/Model/Auth.hs
@@ -2,7 +2,7 @@
 {-# LANGUAGE OverloadedStrings #-}
 module Model.Auth where
 
-import Servant (Handler)
+import Servant
 
 import GHC.Generics
 
@@ -106,9 +106,13 @@ validateToken conn header = do
       now <- liftIO $ getCurrentTime
       if diffUTCTime stamp now > 0
       then return $ Just uid
-      else return $ Nothing
+      else throwError $ err401
+        { errBody = "Your token expired!"
+        }
     _ ->
-      return Nothing
+      throwError $ err401
+        { errBody = "No valid token found!"
+        }
 
 generateToken
   :: Ticket