@@ -889,24 +889,27 @@ func getUsers(w http.ResponseWriter, db *sql.DB, r *http.Request) {
}
// Updates a user using only specified values in the JSON body
func patchUser(w http.ResponseWriter, db *sql.DB, r *http.Request) {
var user User
err := json.NewDecoder(r.Body).Decode(&user)
_, err = mail.ParseAddress(user.Email)
if err != nil { http.Error(w, "Invalid email.", 422); return }
func setUser(user User, db *sql.DB) error {
_, err := mail.ParseAddress(user.Email)
if err != nil { return err }
if roles[user.Role] == 0 {
http.Error(w, "Invalid role.", 422)
return
return errors.New("Invalid role")
}
err = updateUser(user, db)
if err != nil { http.Error(w, "Bad form values.", 422); return }
if err != nil { return err }
return nil
}
users, err := queryUsers(db, user.Id)
if err != nil { http.Error(w, "Bad form values.", 422); return }
json.NewEncoder(w).Encode(users[0])
func patchUser(w http.ResponseWriter, db *sql.DB, r *http.Request) {
var user User
err := json.NewDecoder(r.Body).Decode(&user)
if err != nil { http.Error(w, "Invalid fields", 422); return }
err = setUser(user, db)
if err != nil { http.Error(w, err.Error(), 422); return }
}
// Update specified fields of the user specified in the claim
@@ -927,7 +930,8 @@ func patchSelf(w http.ResponseWriter, db *sql.DB, r *http.Request) {
return
}
patchUser(w, db, r)
err = setUser(user, db)
if err != nil { http.Error(w, err.Error(), 422); return }
}
func deleteUser(w http.ResponseWriter, db *sql.DB, r *http.Request) {
@@ -1751,7 +1755,7 @@ func api(w http.ResponseWriter, r *http.Request) {
patchUser(w, db, r)
case match(p, "/api/user", &args) &&
r.Method == http.MethodPatch &&
guard(r, 2 ): // For employees to modify own accounts
guard(r, 1 ): // For employees to modify own accounts
patchSelf(w, db, r)
case match(p, "/api/user", &args) &&
r.Method == http.MethodDelete &&