user must be authenticated before updating a todo item or task item

bhaidar · Apr 13, 2019 · 04d1d2e · 04d1d2e
1 parent 715e63a
commit 04d1d2e
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 6 deletions.
diff --git a/server/src/todo/task/task.controller.ts b/server/src/todo/task/task.controller.ts
@@ -41,6 +41,7 @@ export class TaskController {
   }
 
   @Delete(':id')
+  @UseGuards(AuthGuard())
   async destory(@Param('id') id: string): Promise<TaskDto> {
     return await this.taskService.destoryTask(id);
   }

diff --git a/server/src/todo/todo.controller.ts b/server/src/todo/todo.controller.ts
@@ -47,14 +47,16 @@ export class TodoController {
 
   @Put(':id')
   @UsePipes(new ValidationPipe())
+  @UseGuards(AuthGuard())
   async update(
     @Param('id') id: string,
     @Body() todoDto: TodoDto,
   ): Promise<TodoDto> {
-    return await this.todoService.updateTodo(todoDto);
+    return await this.todoService.updateTodo(id, todoDto);
   }
 
   @Delete(':id')
+  @UseGuards(AuthGuard())
   async destory(@Param('id') id: string): Promise<TodoDto> {
     return await this.todoService.destoryTodo(id);
   }

diff --git a/server/src/todo/todo.service.ts b/server/src/todo/todo.service.ts
@@ -59,8 +59,8 @@ export class TodoService {
     return toTodoDto(todo);
   }
 
-  async updateTodo(todoDto: TodoDto): Promise<TodoDto> {
-    const { id, name, description } = todoDto;
+  async updateTodo(id: string, todoDto: TodoDto): Promise<TodoDto> {
+    const { name, description } = todoDto;
 
     let todo: TodoEntity = await this.todoRepo.findOne({ where: { id } });
 
@@ -72,22 +72,25 @@ export class TodoService {
     }
 
     todo = {
-      id: todo.id,
+      id,
       name,
       description,
     };
 
     await this.todoRepo.update({ id }, todo); // update
 
-    todo = await this.todoRepo.findOne({ where: { id }, relations: ['tasks'] }); // re-query
+    todo = await this.todoRepo.findOne({
+      where: { id },
+      relations: ['tasks', 'owner'],
+    }); // re-query
 
     return toTodoDto(todo);
   }
 
   async destoryTodo(id: string): Promise<TodoDto> {
     const todo: TodoEntity = await this.todoRepo.findOne({
       where: { id },
-      relations: ['tasks'],
+      relations: ['tasks', 'owner'],
     });
 
     if (!todo) {