Adds review security check and fixes some bugs

Signed-off-by: Cole Gentry <peapod2007@gmail.com>

pages/technical/wheels/review.vue

@@ -2,13 +2,15 @@
   import { VDataIterator } from 'vuetify/components/VDataIterator';
   import { VSheet } from 'vuetify/components/VSheet';
   import { VListItem } from 'vuetify/components/VList';
+  import { VTextField } from 'vuetify/components/VTextField';
   import { VRow, VCol, VContainer } from 'vuetify/components/VGrid';
   import { VTable } from 'vuetify/components/VTable';
   import { VSkeletonLoader } from 'vuetify/components/VSkeletonLoader';
   import { VDivider } from 'vuetify/components/VDivider';
   import { VCarousel, VCarouselItem } from 'vuetify/components/VCarousel';
 
   const wheelsToReview: any = ref([]);
+  const password = ref('');
   const acceptLoading = ref(false);
   const denyLoading = ref(false);
   const { data: wheels, pending, error }: any = await useFetch(() => `/api/wheels/review/list`);
@@ -33,7 +35,7 @@
     acceptLoading.value = true;
     await useFetch(() => `/api/wheels/review/save`, {
       method: 'POST',
-      body: item,
+      body: { wheel: item, auth: password },
     })
       .then(() => (wheelsToReview.value = wheelsToReview.value.filter((wheel: any) => wheel.uuid !== item.uuid)))
       .catch((error) => console.error(error))
@@ -43,7 +45,7 @@
     denyLoading.value = true;
     await useFetch(() => `/api/wheels/review/delete`, {
       method: 'POST',
-      body: { uuid: item.new.uuid },
+      body: { uuid: item.new.uuid, auth: password },
     })
       .then(() => (wheelsToReview.value = wheelsToReview.value.filter((wheel: any) => wheel.uuid !== item.uuid)))
       .catch((error) => console.error(error))
@@ -90,6 +92,18 @@
     </v-container>
   </section>
   <v-container>
+    <v-row>
+      <v-col cols="6">
+        <v-text-field
+          prepend-icon="fad fa-file-signature"
+          variant="solo-filled"
+          v-model="password"
+          type="password"
+          :counter="50"
+          label="Password"
+        ></v-text-field>
+      </v-col>
+    </v-row>
     <v-row>
       <v-col cols="12">
         <v-row v-if="pending" class="align-center justify-center">

server/api/wheels/review/delete.ts

@@ -20,10 +20,17 @@ export default defineEventHandler(async (event) => {
     },
   });
 
-  try {
-    return Promise.allSettled([await docClient.send(dynamoCommand), await deleteFolder(`wheels/uploads/${body.uuid}`)]);
-  } catch (error) {
-    throw new Error(`Error when deleting items - ${error}`);
+  if (body.auth !== config.app.validation_key) {
+    throw new Error('User is not authorized to review');
+  } else {
+    try {
+      return Promise.allSettled([
+        await docClient.send(dynamoCommand),
+        await deleteFolder(`wheels/uploads/${body.uuid}`),
+      ]);
+    } catch (error) {
+      throw new Error(`Error when deleting items - ${error}`);
+    }
   }
 
   // This function came from here https://www.codemzy.com/blog/delete-s3-folder-nodejs

server/api/wheels/review/save.ts

@@ -5,7 +5,7 @@ import _ from 'lodash';
 export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig();
   const body = await readBody(event);
-  const uuid = body.new.uuid;
+  const uuid = body.wheel.new.uuid;
 
   const docClient = DynamoDBDocumentClient.from(
     new DynamoDBClient({
@@ -16,17 +16,31 @@ export default defineEventHandler(async (event) => {
       },
     })
   );
-  try {
-    updateImages(body.new, uuid).then(() => {
-      _.forEach(body.new, (value, key) => {
-        if (key !== 'images' && key !== 'inReview' && key !== 'uuid' && value !== '') {
-          updateProperties({ key, value }, uuid);
-        }
-      });
-      return deleteQueueItem();
-    });
-  } catch (error) {
-    throw new Error(`Error saving approved changes - ${error}`);
+
+  if (body.auth !== config.app.validation_key) {
+    throw new Error('User is not authorized to review');
+  } else {
+    try {
+      if (body.wheel.new.images && body.wheel.new.images.length > 0) {
+        updateImages(body.wheel.new, uuid).then(() => {
+          _.forEach(body.wheel.new, (value, key) => {
+            if (key !== 'images' && key !== 'inReview' && key !== 'uuid' && value !== '') {
+              updateProperties({ key, value }, uuid);
+            }
+          });
+          deleteQueueItem();
+        });
+      } else {
+        _.forEach(body.wheel.new, (value, key) => {
+          if (key !== 'images' && key !== 'inReview' && key !== 'uuid' && value !== '') {
+            updateProperties({ key, value }, uuid);
+          }
+        });
+        deleteQueueItem();
+      }
+    } catch (error) {
+      throw new Error(`Error saving approved changes - ${error}`);
+    }
   }
 
   return { response: 'wheel has been updated' };