Lock sites

app.js

@@ -84,11 +84,6 @@ app.route('/sites')
     makeResponse(res, sites.createSite(req));
   });
 
-app.route('/accounts/:account_id/sites')
-  .get(function(req, res, next) {
-    makeResponse(res, sites.getSitesByAccount(req));
-  });
-
 app.route('/sites/:site_id')
   .get(function(req, res, next) {
     makeResponse(res, sites.getSite(req));

lib/utils.js

@@ -51,9 +51,9 @@ function getAccountID(auth0_id) {
   .then(function(data) {
     if (data.length === 1) {
       return data[0].acct_id;
-    } else {
-      return Promise.reject({status: 403, message: 'Invalid Auth0 ID'});
     }
+
+    return Promise.reject({status: 403, message: 'Invalid Auth0 ID'});
   });
 }
 

routes/sites.js

@@ -4,6 +4,7 @@ const Promise = require('bluebird');
 const utils = require('../lib/utils');
 const query = utils.query;
 const defined = utils.defined;
+const getAccountID = utils.getAccountID;
 
 /**
  * Gets all sites.
@@ -12,17 +13,24 @@ const defined = utils.defined;
  * @return {Promise} The promise
  */
 function getSites(req) {
-  return query('SELECT * FROM Site');
+  if (req.user.authorization === 'Admin' || req.user.authorization === 'Staff') {
+    return query('SELECT * FROM Site');
+  }
+
+  return getAccountID(req.user.auth0_id)
+    .then(function(data) {
+      return getSitesByAccount(data);
+    });
 }
 
 /**
  * Gets all sites for given account.
  *
- * @param {Object} req The given request object
+ * @param {Number} accountID The given account id
  * @return {Promise} The promise
  */
-function getSitesByAccount(req) {
-  return query('SELECT site_id, site_name, site_address FROM Acct NATURAL JOIN AcctToProgram NATURAL JOIN Program NATURAL JOIN Site WHERE acct_id = ?', [req.params.account_id]);
+function getSitesByAccount(accountID) {
+  return query('SELECT site_id, site_name, site_address FROM Acct NATURAL JOIN AcctToProgram NATURAL JOIN Program NATURAL JOIN Site WHERE acct_id = ?', [accountID]);
 }
 
 /**
@@ -32,6 +40,10 @@ function getSitesByAccount(req) {
  * @return {Promise} The promise
  */
 function createSite(req) {
+  if (req.user.authorization == 'Coach' || req.user.authorization == 'Volunteer') {
+    return Promise.reject({status: 403, message: 'Access denied'});
+  }
+
   if (!defined(req.body) || !defined(req.body.site_name) || !defined(req.body.site_address)) {
     return Promise.reject({
       status: 406,
@@ -59,7 +71,21 @@ function createSite(req) {
  * @return {Promise} The promise
  */
 function getSite(req) {
-  return query('SELECT * FROM Site WHERE site_id = ?', [req.params.site_id]);
+  var site_id = req.params.site_id;
+  if (req.user.authorization === 'Admin' || req.user.authorization === 'Staff') {
+    return query('SELECT * FROM Site WHERE site_id = ?', [site_id]);
+  }
+
+  return getAccountID(req.user.auth0_id)
+    .then(function(data) {
+      return query('SELECT site_id, site_name, site_address FROM Acct NATURAL JOIN AcctToProgram NATURAL JOIN Program NATURAL JOIN Site WHERE acct_id = ? AND Site.site_id = ?', [data, site_id]);
+    })
+    .then(function(data) {
+      if (data.length !== 1) {
+        return Promise.reject({status: 403, message: 'Access denied or site not found'});
+      }
+      return data;
+    });
 }
 
 /**
@@ -69,6 +95,10 @@ function getSite(req) {
  * @return {Promise} The promise
  */
 function updateSite(req) {
+  if (req.user.authorization == 'Coach' || req.user.authorization == 'Volunteer') {
+    return Promise.reject({status: 403, message: 'Access denied'});
+  }
+
   if (!defined(req.body) || (!defined(req.body.site_name) && !defined(req.body.site_address))) {
     return Promise.reject({
       status: 406,
@@ -96,6 +126,10 @@ function updateSite(req) {
  * @return {Promise} The promise
  */
 function deleteSite(req) {
+  if (req.user.authorization !== 'Admin') {
+    return Promise.reject({status: 403, message: 'Access denied'});
+  }
+
   return query('DELETE FROM Site WHERE site_id = ?', [req.params.site_id]);
 }
 

routes/students.js

@@ -2,6 +2,7 @@
 
 const Promise = require('bluebird');
 const utils = require('../lib/utils');
+const constants = require('../lib/constants');
 const query = utils.query;
 const defined = utils.defined;
 
@@ -124,14 +125,8 @@ function getStudentsBySite(req) {
   // Check if the id is an integer > 0
   if (isPositiveInteger(id)) {
     // Check if the id is in the related table
-    return sites.getSite({
-     params: {
-       site_id: id
-     },
-     user: {
-       authorization: 'Admin'
-     }
-   })
+    req.user = constants.admin;
+    return sites.getSite(req)
     .then(function(data) {
       if (data.length > 0) {
         return query(queryString, [id]);

test/app.js

@@ -176,7 +176,6 @@ describe('app.js', function() {
 
   describe('sites endpoint', function() {
     var getSitesStub;
-    var getSitesByAccountStub;
     var createSiteStub;
     var getSiteStub;
     var updateSiteStub;
@@ -186,9 +185,6 @@ describe('app.js', function() {
       getSitesStub = sinon.stub(sites, 'getSites', function() {
         return Promise.resolve('got the sites');
       });
-      getSitesByAccountStub = sinon.stub(sites, 'getSitesByAccount', function() {
-        return Promise.resolve('got the students for an account');
-      });
       createSiteStub = sinon.stub(sites, 'createSite', function() {
         return Promise.resolve('create a site');
       });
@@ -205,7 +201,6 @@ describe('app.js', function() {
 
     after(function() {
       sites.getSites.restore();
-      sites.getSitesByAccount.restore();
       sites.createSite.restore();
       sites.getSite.restore();
       sites.updateSite.restore();
@@ -222,16 +217,6 @@ describe('app.js', function() {
         });
     });
 
-    it('GET /accounts/:account_id/sites', function(done) {
-      request(app)
-        .get('/accounts/:account_id/sites')
-        .expect('got the sites for an account', 200)
-        .end(function() {
-          assert.isTrue(getSitesByAccountStub.called);
-          done();
-        });
-    });
-
     it('POST /sites', function(done) {
       request(app)
         .post('/sites')