Merge pull request #154 from JJ-8/create-task-access-control

Limit task creation by access control
TFNS · Apr 5, 2022 · b3a9cb2 · b3a9cb2
2 parents ec30302 + efb8156
commit b3a9cb2
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/api/src/plugins/createTask.ts b/api/src/plugins/createTask.ts
@@ -84,6 +84,16 @@ export default makeExtendSchemaPlugin((build) => {
           { pgClient },
           resolveInfo
         ) => {
+          const {
+            rows: [isAllowed],
+          } = await pgClient.query(`SELECT ctfnote_private.can_play_ctf($1)`, [
+            ctfId,
+          ]);
+
+          if (isAllowed.can_play_ctf !== true) {
+            return {};
+          }
+
           const padPathOrUrl = await createPad(title, description, category);
 
           let padPath: string;