Refactored route for create shopping list

Routes.js

@@ -10,8 +10,8 @@ function setup(app, handlers) {
 	app.get('/api/profiles/:username', handlers.account.getAccount);
 	app.put('/api/profiles/:username', handlers.account.updateAccount);
 	app.del('/api/profiles/:username', handlers.account.deleteAccount);
-	app.post('/api/lists', handlers.list.createShoppingList);
-	app.post('/api/lists/:id', handlers.list.createShoppingList);
+	app.post('/api/profiles/:userId/lists', handlers.list.createShoppingList);
+	app.post('/api/profiles/:userId/lists/:templateId', handlers.list.createShoppingList);
 	app.put('/api/lists/:id', handlers.list.updateShoppingList);
 	//app.get('/api/lists/:userId', handlers.list.getShoppingLists);
 	app.get('/api/profiles/:userId/lists/:shoppingListId', handlers.list.getShoppingList);

handlers/ShoppingListHandler.js

@@ -19,23 +19,31 @@ var ShoppingListHandler = function() {
 	this.deleteShoppingList = handleDeleteShoppingListRequest;
 };
 
-// On success should return status code 201 to notify the client the account
-// creation has been successful
-// On error should return status code 500 and the error message
+/// Create an empty shopping list or a list based on a template if the splat parameter templateId is passed
+/// On success should return status code 201 to notify the client the account creation has been successful
+/// On error should return status code 500 and the error message
+/// /api/profiles/:userId/lists/[:templateId]
 function handleCreateShoppingListRequest(req, res) {
-	var createdBy = req.body.userId || null;
+	var createdBy = req.params.userId || null;
 	var opts = {};
 	var title;
 	var shoppingListRepository = new ShoppingListRepository();
-	if (req.params.id) {
+	if (req.params.templateId) {
 		// It means we want to create a list from a template
 		// Find the template list by id
-		shoppingListRepository.findById(req.params.id)
+		shoppingListRepository.findById(req.params.templateId)
 		.then(
 			function(template) {
 				if (template) {
 					// Ok template found. Am I authorised to use this template?
-					// TODO!
+					// How can I see if I'm authorised? I can read the template createdBy filed and if it matches the userId
+					// splat parameter, then I'm authorised
+					if (template.createdBy != createdBy) {
+						logger.log('info', 'User Id ' + createdBy + ' tried to create a new list using template id ' +
+							req.params.templateId + ' but user was not authorised to use it. Request from address ' +
+							req.connection.remoteAddress);
+						res.json(401);
+					}
 					title = template.title;
 					opts = {
 						isShared: template.isShared,

test/Routes.js

@@ -209,7 +209,7 @@
 				title: 'Test list'             
 			};			
 			request(url)
-				.post('/api/lists')
+				.post('/api/profiles/' + userId + '/lists')
 				.send(emptyShoppingList)
 				.expect(201)
 				.end(function(err, res) {
@@ -286,7 +286,7 @@
 				userId: userId
 			};			
 			request(url)
-				.post('/api/lists')
+				.post('/api/profiles/' + userId + '/lists')
 				.send(emptyShoppingList)
 				.expect(400)
 				.end(function(err, res) {					
@@ -391,7 +391,7 @@
 		it('should save a new shopping list using another given list as a template', 
 		function(done) {
 			request(url)
-				.post('/api/lists/5151aa984427051731000006')
+				.post('/api/profiles/' + userId + '/lists/5151aa984427051731000006')
 				.send({ userId: userId })
 				.expect(201)
 				.end(function(err, res) {