김명현 / Classroom-Reservation

Go to a project
Toggle navigation Toggle navigation pinning
freckie
11c27c5d 1 parent 38f6a6c1

Update

Inline Side-by-side
Showing 3 changed files with 138 additions and 14 deletions
...@@ -42,22 +42,30 @@ func (e *Endpoints) AllowlistPost(w http.ResponseWriter, r *http.Request, ps htt ...@@ -42,22 +42,30 @@ func (e *Endpoints) AllowlistPost(w http.ResponseWriter, r *http.Request, ps htt
42 } 42 }
43 43
44 row = e.DB.QueryRow(` 44 row = e.DB.QueryRow(`
45 - SELECT count(a.timetable_id), u.is_super 45 + SELECT (
46 + SELECT count(a.timetable_id)
46 FROM allowlist AS a, users AS u 47 FROM allowlist AS a, users AS u
47 WHERE a.user_id=u.id 48 WHERE a.user_id=u.id
48 AND a.timetable_id=? 49 AND a.timetable_id=?
49 - AND u.email=?; 50 + AND u.email=?
50 - `, timetable, email) 51 + ) AS count,
52 + (
53 + SELECT is_super FROM users WHERE email=?
54 + ) AS is_super;
55 + `, timetable, email, email)
51 if err := row.Scan(&_count, &_isSuper); err == nil { 56 if err := row.Scan(&_count, &_isSuper); err == nil {
57 + if _isSuper != 1 {
58 + functions.ResponseError(w, 403, "관리자만 접근할 수 있는 기능입니다.")
59 + return
60 + }
52 if _count <= 0 { 61 if _count <= 0 {
53 functions.ResponseError(w, 403, "timetable에 접근할 권한이 부족합니다.") 62 functions.ResponseError(w, 403, "timetable에 접근할 권한이 부족합니다.")
54 return 63 return
55 } 64 }
56 - if _isSuper != 1 { 65 + } else {
57 - functions.ResponseError(w, 403, "관리자만 접근할 수 있는 기능입니다.") 66 + functions.ResponseError(w, 500, "예기치 못한 에러 : "+err.Error())
58 return 67 return
59 } 68 }
60 - }
61 69
62 // Parse Request Data 70 // Parse Request Data
63 type reqDataStruct struct { 71 type reqDataStruct struct {
...@@ -94,3 +102,94 @@ func (e *Endpoints) AllowlistPost(w http.ResponseWriter, r *http.Request, ps htt ...@@ -94,3 +102,94 @@ func (e *Endpoints) AllowlistPost(w http.ResponseWriter, r *http.Request, ps htt
94 102
95 functions.ResponseOK(w, "success", nil) 103 functions.ResponseOK(w, "success", nil)
96 } 104 }
105 +
106 +// DELETE /timetables/<file_id>/<sheet_id>/allow
107 +func (e *Endpoints) AllowlistDelete(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
108 + // Get user email
109 + var email string
110 + if _email, ok := r.Header["X-User-Email"]; ok {
111 + email = _email[0]
112 + } else {
113 + functions.ResponseError(w, 401, "X-User-Email 헤더를 보내세요.")
114 + return
115 + }
116 +
117 + // Get Path Parameters
118 + fileID := ps.ByName("file_id")
119 + sheetID := ps.ByName("sheet_id")
120 +
121 + // Check Permission
122 + var _count, _isSuper int64
123 + timetable := fmt.Sprintf("%s,%s", fileID, sheetID)
124 + row := e.DB.QueryRow(`
125 + SELECT count(timetable_id)
126 + FROM allowlist
127 + WHERE timetable_id=?;
128 + `, timetable)
129 + if err := row.Scan(&_count); err == nil {
130 + if _count <= 0 {
131 + functions.ResponseError(w, 404, "존재하지 않는 timetable.")
132 + return
133 + }
134 + }
135 +
136 + row = e.DB.QueryRow(`
137 + SELECT (
138 + SELECT count(a.timetable_id)
139 + FROM allowlist AS a, users AS u
140 + WHERE a.user_id=u.id
141 + AND a.timetable_id=?
142 + AND u.email=?
143 + ) AS count,
144 + (
145 + SELECT is_super FROM users WHERE email=?
146 + ) AS is_super;
147 + `, timetable, email, email)
148 + if err := row.Scan(&_count, &_isSuper); err == nil {
149 + if _isSuper != 1 {
150 + functions.ResponseError(w, 403, "관리자만 접근할 수 있는 기능입니다.")
151 + return
152 + }
153 + if _count <= 0 {
154 + functions.ResponseError(w, 403, "timetable에 접근할 권한이 부족합니다.")
155 + return
156 + }
157 + } else {
158 + functions.ResponseError(w, 500, "예기치 못한 에러 : "+err.Error())
159 + return
160 + }
161 +
162 + // Parse Request Data
163 + type reqDataStruct struct {
164 + Email *string `json:"email"`
165 + }
166 + var reqData reqDataStruct
167 + if strings.Contains(r.Header.Get("Content-Type"), "application/json") {
168 + body, err := ioutil.ReadAll(r.Body)
169 + if err != nil {
170 + functions.ResponseError(w, 500, "예기치 못한 에러 : "+err.Error())
171 + return
172 + }
173 + json.Unmarshal(body, &reqData)
174 + } else {
175 + functions.ResponseError(w, 400, "JSON 형식만 가능합니다.")
176 + return
177 + }
178 + if reqData.Email == nil {
179 + functions.ResponseError(w, 400, "파라미터를 전부 보내주세요.")
180 + return
181 + }
182 +
183 + // Querying
184 + _, err := e.DB.Exec(`
185 + DELETE FROM allowlist
186 + WHERE timetable_id=?
187 + AND user_id=(SELECT id FROM users WHERE email=?);
188 + `, timetable, *(reqData.Email))
189 + if err != nil {
190 + functions.ResponseError(w, 500, "예기치 못한 에러 : "+err.Error())
191 + return
192 + }
193 +
194 + functions.ResponseOK(w, "success", nil)
195 +}
......
...@@ -29,7 +29,7 @@ func (e *Endpoints) ReservationPost(w http.ResponseWriter, r *http.Request, ps h ...@@ -29,7 +29,7 @@ func (e *Endpoints) ReservationPost(w http.ResponseWriter, r *http.Request, ps h
29 sheetID := ps.ByName("sheet_id") 29 sheetID := ps.ByName("sheet_id")
30 30
31 // Check Permission 31 // Check Permission
32 - var _count int64 32 + var _count, _isSuper int64
33 timetable := fmt.Sprintf("%s,%s", fileID, sheetID) 33 timetable := fmt.Sprintf("%s,%s", fileID, sheetID)
34 row := e.DB.QueryRow(` 34 row := e.DB.QueryRow(`
35 SELECT count(timetable_id) 35 SELECT count(timetable_id)
...@@ -44,17 +44,29 @@ func (e *Endpoints) ReservationPost(w http.ResponseWriter, r *http.Request, ps h ...@@ -44,17 +44,29 @@ func (e *Endpoints) ReservationPost(w http.ResponseWriter, r *http.Request, ps h
44 } 44 }
45 45
46 row = e.DB.QueryRow(` 46 row = e.DB.QueryRow(`
47 + SELECT (
47 SELECT count(a.timetable_id) 48 SELECT count(a.timetable_id)
48 FROM allowlist AS a, users AS u 49 FROM allowlist AS a, users AS u
49 WHERE a.user_id=u.id 50 WHERE a.user_id=u.id
50 AND a.timetable_id=? 51 AND a.timetable_id=?
51 - AND u.email=?; 52 + AND u.email=?
52 - `, timetable, email) 53 + ) AS count,
53 - if err := row.Scan(&_count); err == nil { 54 + (
55 + SELECT is_super FROM users WHERE email=?
56 + ) AS is_super;
57 + `, timetable, email, email)
58 + if err := row.Scan(&_count, &_isSuper); err == nil {
59 + if _isSuper != 1 {
60 + functions.ResponseError(w, 403, "관리자만 접근할 수 있는 기능입니다.")
61 + return
62 + }
54 if _count <= 0 { 63 if _count <= 0 {
55 functions.ResponseError(w, 403, "timetable에 접근할 권한이 부족합니다.") 64 functions.ResponseError(w, 403, "timetable에 접근할 권한이 부족합니다.")
56 return 65 return
57 } 66 }
67 + } else {
68 + functions.ResponseError(w, 500, "예기치 못한 에러 : "+err.Error())
69 + return
58 } 70 }
59 71
60 // Parse Request Data 72 // Parse Request Data
...@@ -180,7 +192,7 @@ func (e *Endpoints) ReservationDelete(w http.ResponseWriter, r *http.Request, ps ...@@ -180,7 +192,7 @@ func (e *Endpoints) ReservationDelete(w http.ResponseWriter, r *http.Request, ps
180 reservationID := ps.ByName("reservation_id") 192 reservationID := ps.ByName("reservation_id")
181 193
182 // Check Permission 194 // Check Permission
183 - var _count int64 195 + var _count, _isSuper int64
184 timetable := fmt.Sprintf("%s,%s", fileID, sheetID) 196 timetable := fmt.Sprintf("%s,%s", fileID, sheetID)
185 row := e.DB.QueryRow(` 197 row := e.DB.QueryRow(`
186 SELECT count(timetable_id) 198 SELECT count(timetable_id)
...@@ -195,17 +207,29 @@ func (e *Endpoints) ReservationDelete(w http.ResponseWriter, r *http.Request, ps ...@@ -195,17 +207,29 @@ func (e *Endpoints) ReservationDelete(w http.ResponseWriter, r *http.Request, ps
195 } 207 }
196 208
197 row = e.DB.QueryRow(` 209 row = e.DB.QueryRow(`
210 + SELECT (
198 SELECT count(a.timetable_id) 211 SELECT count(a.timetable_id)
199 FROM allowlist AS a, users AS u 212 FROM allowlist AS a, users AS u
200 WHERE a.user_id=u.id 213 WHERE a.user_id=u.id
201 AND a.timetable_id=? 214 AND a.timetable_id=?
202 - AND u.email=?; 215 + AND u.email=?
203 - `, timetable, email) 216 + ) AS count,
204 - if err := row.Scan(&_count); err == nil { 217 + (
218 + SELECT is_super FROM users WHERE email=?
219 + ) AS is_super;
220 + `, timetable, email, email)
221 + if err := row.Scan(&_count, &_isSuper); err == nil {
222 + if _isSuper != 1 {
223 + functions.ResponseError(w, 403, "관리자만 접근할 수 있는 기능입니다.")
224 + return
225 + }
205 if _count <= 0 { 226 if _count <= 0 {
206 functions.ResponseError(w, 403, "timetable에 접근할 권한이 부족합니다.") 227 functions.ResponseError(w, 403, "timetable에 접근할 권한이 부족합니다.")
207 return 228 return
208 } 229 }
230 + } else {
231 + functions.ResponseError(w, 500, "예기치 못한 에러 : "+err.Error())
232 + return
209 } 233 }
210 234
211 // Querying with Transaction 235 // Querying with Transaction
......
...@@ -64,6 +64,7 @@ func main() { ...@@ -64,6 +64,7 @@ func main() {
64 router.POST("/api/users", ep.UsersPost) 64 router.POST("/api/users", ep.UsersPost)
65 router.GET("/api/timetables/:file_id/:sheet_id/cell", ep.CellGet) 65 router.GET("/api/timetables/:file_id/:sheet_id/cell", ep.CellGet)
66 router.POST("/api/timetables/:file_id/:sheet_id/allow", ep.AllowlistPost) 66 router.POST("/api/timetables/:file_id/:sheet_id/allow", ep.AllowlistPost)
67 + router.DELETE("/api/timetables/:file_id/:sheet_id/allow", ep.AllowlistDelete)
67 router.POST("/api/timetables/:file_id/:sheet_id/reservation", ep.ReservationPost) 68 router.POST("/api/timetables/:file_id/:sheet_id/reservation", ep.ReservationPost)
68 router.DELETE("/api/timetables/:file_id/:sheet_id/reservation/:reservation_id", ep.ReservationDelete) 69 router.DELETE("/api/timetables/:file_id/:sheet_id/reservation/:reservation_id", ep.ReservationDelete)
69 70
......