47 lines
1.3 KiB
TypeScript
47 lines
1.3 KiB
TypeScript
import { NextFunction, Request, Response } from "express"
|
|
|
|
import { PublishableApiKeyScopes } from "./extend-request-params"
|
|
|
|
/**
|
|
* The middleware will return 400 if sales channel id is passed as an url or body param
|
|
* but that id is not in the scope of the PK from the header.
|
|
*
|
|
* NOTE: must be applied after the `extendRequestParams` middleware
|
|
*
|
|
* @param req - request object
|
|
* @param res - response object
|
|
* @param next - next middleware call
|
|
*/
|
|
async function validateSalesChannelParam(
|
|
req: Request & { publishableApiKeyScopes: PublishableApiKeyScopes },
|
|
res: Response,
|
|
next: NextFunction
|
|
) {
|
|
const pubKey = req.get("x-publishable-api-key")
|
|
|
|
if (pubKey) {
|
|
const scopes = req.publishableApiKeyScopes
|
|
let channelIds = req.body.sales_channel_id || req.query.sales_channel_id
|
|
|
|
if (!channelIds) {
|
|
return next()
|
|
}
|
|
|
|
channelIds = !Array.isArray(channelIds) ? [channelIds] : channelIds
|
|
|
|
if (
|
|
scopes.sales_channel_ids.length &&
|
|
!channelIds.every((sc) => scopes.sales_channel_ids.includes(sc))
|
|
) {
|
|
req.errors = req.errors ?? []
|
|
req.errors.push(
|
|
`Provided sales channel id param: ${channelIds} is not associated with the Publishable API Key passed in the header of the request.`
|
|
)
|
|
}
|
|
}
|
|
|
|
next()
|
|
}
|
|
|
|
export { validateSalesChannelParam }
|