From c4fd9c93a63bce7c322aec1fc304b4dc5ac5a9cd Mon Sep 17 00:00:00 2001
From: Rory& <root@rory.gay>
Date: Mon, 2 Jun 2025 10:12:34 +0200
Subject: Split authentication and authorization

---
 src/api/routes/budgetRoutes.js | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

(limited to 'src/api/routes/budgetRoutes.js')

diff --git a/src/api/routes/budgetRoutes.js b/src/api/routes/budgetRoutes.js
index d7ebde4..4ad4897 100644
--- a/src/api/routes/budgetRoutes.js
+++ b/src/api/routes/budgetRoutes.js
@@ -1,7 +1,7 @@
 import {
     requireMonitor,
     requireUser,
-    validateAuth
+    requireRole
 } from '#api/middlewares/index.js';
 import { UserType } from '#db/schemas/index.js';
 import {
@@ -10,25 +10,30 @@ import {
     RouteMethodList
 } from '#api/RouteDescription.js';
 import { getUserById } from '#db/dbAccess/index.js';
+import { SafeNSoundError } from '#util/error.js';
 
 /**
  * @type {RouteDescription}
  */
 export const getBudgetByUserRoute = {
     path: '/budget/:id',
-    methods: new RouteMethodList({
+    methods: {
         get: new RouteMethod({
             middlewares: [requireMonitor],
             async method(req, res) {
                 if (req.user.type !== UserType.ADMIN) {
                     if (!req.user.monitoredUsers.includes(req.params.id))
-                        throw new Error('meow');
+                        throw new SafeNSoundError({
+                            errCode: 'UNAUTHORIZED',
+                            message:
+                                "You do not have permission to access this user's budget."
+                        });
                 }
-                //if (!req.)
-                //                const user = await getUserById(req.);
+                const user = await getUserById(req.params.id);
+                res.send({ balance: user.balance });
             }
         })
-    })
+    }
 };
 
 /**
-- 
cgit 1.5.1