63 lines
1.5 KiB
TypeScript
63 lines
1.5 KiB
TypeScript
import { requireAuth } from '~/server/utils/auth'
|
|
import { canvases, userGroups } from '~/server/utils/db'
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
const id = getRouterParam(event, 'id')
|
|
|
|
if (!id) {
|
|
throw createError({ statusCode: 400, message: 'Canvas ID is required' })
|
|
}
|
|
|
|
const canvas = canvases.get(id)
|
|
if (!canvas) {
|
|
throw createError({ statusCode: 404, message: 'Canvas not found' })
|
|
}
|
|
|
|
// Check if canvas is public
|
|
if (canvas.isPublic) {
|
|
return {
|
|
id: canvas.id,
|
|
name: canvas.name,
|
|
nodes: canvas.nodes,
|
|
edges: canvas.edges,
|
|
isPublic: true,
|
|
ownerId: canvas.ownerId
|
|
}
|
|
}
|
|
|
|
// For private canvases, require authentication and check permissions
|
|
const user = requireAuth(event)
|
|
|
|
// Check if user owns the canvas
|
|
if (canvas.ownerId === user.id) {
|
|
return {
|
|
id: canvas.id,
|
|
name: canvas.name,
|
|
nodes: canvas.nodes,
|
|
edges: canvas.edges,
|
|
isPublic: false,
|
|
ownerId: canvas.ownerId
|
|
}
|
|
}
|
|
|
|
// Check if user has access through group membership
|
|
if (canvas.groupId) {
|
|
const membership = Array.from(userGroups.values()).find(
|
|
m => m.userId === user.id && m.groupId === canvas.groupId
|
|
)
|
|
if (membership) {
|
|
return {
|
|
id: canvas.id,
|
|
name: canvas.name,
|
|
nodes: canvas.nodes,
|
|
edges: canvas.edges,
|
|
isPublic: false,
|
|
ownerId: canvas.ownerId,
|
|
groupId: canvas.groupId
|
|
}
|
|
}
|
|
}
|
|
|
|
throw createError({ statusCode: 403, message: 'Access denied' })
|
|
})
|