do not ask for user id, it comes from auth anyway

This commit is contained in:
nek0 2019-10-14 17:39:28 +02:00
parent f1518f4100
commit 3a5cb7c5ac
2 changed files with 5 additions and 13 deletions

View File

@ -33,8 +33,7 @@ type MateAPI =
:> ReqBody '[JSON] Int :> Delete '[JSON] ()
:<|> "user" :> ReqBody '[JSON] UserSubmit :> Post '[JSON] Int
:<|> "user" :> AuthProtect "header-auth"
:> Capture "uid'" Int :> Get '[JSON] UserDetails
:<|> "user" :> AuthProtect "header-auth" :> Get '[JSON] UserDetails
:<|> "user" :> AuthProtect "header-auth"
:> ReqBody '[JSON] UserDetailsSubmit :> Patch '[JSON] ()
:<|> "user" :> "list" :> QueryParam "refine" UserRefine :> Get '[JSON] [UserSummary]

View File

@ -32,21 +32,14 @@ userNew (UserSubmit ident email passhash) = do
userGet
:: Maybe (Int, AuthMethod)
-> Int
-> MateHandler UserDetails
userGet Nothing _ =
userGet Nothing =
throwError $ err401
{ errBody = "No Authentication present."
}
userGet (Just (aid, method)) uid =
if aid == uid && any (== method) [PrimaryPass, ChallengeResponse]
then do
conn <- rsConnection <$> ask
userDetailsSelect uid conn
else
throwError $ err401
{ errBody = "Wrong Authentication present."
}
userGet (Just (uid, _)) = do
conn <- rsConnection <$> ask
userDetailsSelect uid conn
userUpdate
:: Maybe (Int, AuthMethod)