From c2f938f3a2df5c2aaa37113cd9efa573ff715bc0 Mon Sep 17 00:00:00 2001
From: Arthur DANJOU <arthurdanjou@outlook.fr>
Date: Tue, 12 Dec 2023 16:41:27 +0100
Subject: [PATCH] add admin mode to delete message

---
 src/auth.d.ts                        |  5 ++--
 src/pages/guestbook.vue              | 39 +++++++++++++++++++++++++---
 src/server/api/message.delete.ts     | 18 +++++++++++++
 src/server/routes/auth/github.get.ts |  2 ++
 src/server/routes/auth/google.get.ts |  2 ++
 5 files changed, 61 insertions(+), 5 deletions(-)
 create mode 100644 src/server/api/message.delete.ts

diff --git a/src/auth.d.ts b/src/auth.d.ts
index d329da5..e7435ac 100644
--- a/src/auth.d.ts
+++ b/src/auth.d.ts
@@ -1,9 +1,10 @@
 declare module '#auth-utils' {
   interface UserSession {
     user: {
-      email: string,
-      username: string,
+      email: string
+      username: string
       picture: string
+      admin: boolean
     }
   }
 }
diff --git a/src/pages/guestbook.vue b/src/pages/guestbook.vue
index 1df664c..a3e7b21 100644
--- a/src/pages/guestbook.vue
+++ b/src/pages/guestbook.vue
@@ -6,8 +6,7 @@ useHead({
   title: 'Sign my guestbook • Arthur Danjou',
 })
 
-const { loggedIn, clear } = useUserSession()
-
+const { loggedIn, clear, user } = useUserSession()
 const { data: messages, refresh } = useFetch<Array<GuestbookMessage>>('/api/messages', { method: 'get' })
 
 const toast = useToast()
@@ -37,6 +36,30 @@ async function sign() {
   })
   messageContent.value = ''
 }
+async function deleteMessage(id: number) {
+  if (!user.value.admin)
+    return
+
+  await $fetch('/api/message', {
+    method: 'delete',
+    body: {
+      id,
+    },
+  }).then(async () => {
+    toast.add({
+      title: `Message successfully deleted`,
+      icon: 'i-material-symbols-check-circle-outline-rounded',
+      color: 'green',
+      timeout: 4000,
+    })
+    await refresh()
+  }).catch(() => {
+    toast.add({
+      title: 'An error occured when deleting a message!',
+      color: 'red',
+    })
+  })
+}
 </script>
 
 <template>
@@ -104,7 +127,7 @@ async function sign() {
       <div
         v-for="message in messages"
         :key="message.id"
-        class="overflow-hidden sm:p-6 px-4 py-5 border border-zinc-100 p-6 dark:border-zinc-700/40 rounded-lg"
+        class="relative overflow-hidden sm:p-6 px-4 py-5 border border-zinc-100 p-6 dark:border-zinc-700/40 rounded-lg"
       >
         <p class="text-sm text-subtitle">
           “{{ message.message }}”
@@ -117,6 +140,16 @@ async function sign() {
             {{ message.username }}
           </p>
         </div>
+        <UButton
+          v-if="user && user.admin"
+          class="absolute top-1 right-1"
+          icon="i-material-symbols-delete-forever-outline-rounded"
+          color="red"
+          variant="ghost"
+          :ui="{ rounded: 'rounded-full' }"
+          size="xs"
+          @click.prevent="deleteMessage(message.id)"
+        />
       </div>
     </div>
     <div v-else class="my-4 text-subtitle">
diff --git a/src/server/api/message.delete.ts b/src/server/api/message.delete.ts
new file mode 100644
index 0000000..f2c65bf
--- /dev/null
+++ b/src/server/api/message.delete.ts
@@ -0,0 +1,18 @@
+import { z } from 'zod'
+
+const MessageValidator = z.object({
+  id: z.number(),
+}).parse
+
+export default defineEventHandler(async (event) => {
+  const { id } = await readValidatedBody(event, MessageValidator)
+  const { user } = await requireUserSession(event)
+  if (!user.admin)
+    throw createError({ statusCode: 400, message: 'You need the permission to delete a message!' })
+
+  return await usePrisma().guestbookMessage.delete({
+    where: {
+      id,
+    },
+  })
+})
diff --git a/src/server/routes/auth/github.get.ts b/src/server/routes/auth/github.get.ts
index 1ad7cf6..369f329 100644
--- a/src/server/routes/auth/github.get.ts
+++ b/src/server/routes/auth/github.get.ts
@@ -8,6 +8,8 @@ export default oauth.githubEventHandler({
         email: user.email,
         picture: user.avatar_url,
         username: String(user.name).trim(),
+        // eslint-disable-next-line node/prefer-global/process
+        admin: user.email === process.env.NUXT_AUTH_ADMIN_EMAIL,
       },
     })
     return sendRedirect(event, getCookie(event, 'last-route') || '/')
diff --git a/src/server/routes/auth/google.get.ts b/src/server/routes/auth/google.get.ts
index e4c8c85..d1a9fd6 100644
--- a/src/server/routes/auth/google.get.ts
+++ b/src/server/routes/auth/google.get.ts
@@ -5,6 +5,8 @@ export default oauth.googleEventHandler({
         email: user.email,
         picture: user.picture,
         username: String(user.name).trim(),
+        // eslint-disable-next-line node/prefer-global/process
+        admin: user.email === process.env.NUXT_AUTH_ADMIN_EMAIL,
       },
     })
     return sendRedirect(event, getCookie(event, 'last-route') || '/')