@@ -12,9 +14,17 @@
diff --git a/src/routes/+page.server.ts b/src/routes/+page.server.ts
index 6993761..29f3e88 100644
--- a/src/routes/+page.server.ts
+++ b/src/routes/+page.server.ts
@@ -1,6 +1,6 @@
import type { Actions, PageServerLoad } from "./$types"
import { prisma } from "$lib/server/prisma"
-import { fail } from "@sveltejs/kit"
+import { error, fail, redirect } from "@sveltejs/kit"
export const load: PageServerLoad = async () => {
return {
@@ -9,7 +9,12 @@ export const load: PageServerLoad = async () => {
}
export const actions: Actions = {
- createArticle: async ({ request }) => {
+ createArticle: async ({ request, locals }) => {
+ const { user, session } = await locals.validateUser()
+ if (!(user && session)) {
+ throw redirect(302, "/")
+ }
+
const { title, content } = Object.fromEntries(
await request.formData(),
) as Record
@@ -19,6 +24,7 @@ export const actions: Actions = {
data: {
title,
content,
+ userId: user.userId,
},
})
} catch (err) {
@@ -30,13 +36,27 @@ export const actions: Actions = {
status: 201,
}
},
- deleteArticle: async ({ url }) => {
+ deleteArticle: async ({ url, locals }) => {
+ const { user, session } = await locals.validateUser()
+ if (!(user && session)) {
+ throw redirect(302, "/")
+ }
const id = url.searchParams.get("id")
if (!id) {
return fail(400, { message: "Invalid request" })
}
try {
+ const article = await prisma.article.findUniqueOrThrow({
+ where: {
+ id: Number(id),
+ },
+ })
+
+ if (article.userId !== user.userId) {
+ throw error(403, "Not authorized")
+ }
+
await prisma.article.delete({
where: {
id: Number(id),
diff --git a/src/routes/+page.svelte b/src/routes/+page.svelte
index 2746c21..e465d23 100644
--- a/src/routes/+page.svelte
+++ b/src/routes/+page.svelte
@@ -15,21 +15,25 @@
{article.content}
-
- Edit Article
+ {#if article.userId === data.user?.userId}
+
+ Edit Article
+ {/if}
{/each}