rip out all old auth data

pages/api/bookings/[uuid]/bill.ts

@@ -1,12 +1,7 @@
 import { Bill } from '../../../../db/bill'
 import { createBill, patchBill } from '../../../../db/index'
-import withSession, { isAdminSession } from '../../../../lib/session'
 
-export default withSession(async function billHandler(req, res): Promise<void> {
-  if (!isAdminSession(req)) {
-    res.status(403).send({ message: 'Not Authorized' })
-    return
-  }
+export default async function billHandler(req, res): Promise<void> {
 
   const {
     method,
@@ -41,4 +36,4 @@ export default withSession(async function billHandler(req, res): Promise<void> {
       res.setHeader('Allow', ['POST', 'PATCH'])
       res.status(405).end(`Method ${method} Not Allowed`)
   }
-})
+}

pages/api/bookings/[uuid]/index.ts

@@ -2,9 +2,8 @@ import { NextApiRequest, NextApiResponse } from 'next'
 import { BookingDocument } from '../../../../db/booking'
 import { BOOKING_STATUS } from '../../../../db/enums'
 import { getBookingByUUID } from '../../../../db/index'
-import withSession, { isAdminSession } from '../../../../lib/session'
 
-export default withSession(async function userHandler(
+export default async function userHandler(
   req: NextApiRequest,
   res: NextApiResponse
 ): Promise<void> {
@@ -21,22 +20,6 @@ export default withSession(async function userHandler(
     case 'PATCH':
       booking = await getBookingByUUID(uuid)
 
-      if (!isAdminSession(req)) {
-        const deniedPropsForUser = Object.keys(req.body).filter(
-          (key) => key !== 'status'
-        )
-        if (deniedPropsForUser.length) {
-          res
-            .status(400)
-            .end(
-              `The following attributes cannot be changed: ${deniedPropsForUser.join(
-                ', '
-              )}`
-            )
-          break
-        }
-      }
-
       if (!Object.values(BOOKING_STATUS).includes(req.body.status)) {
         res
           .status(400)
@@ -60,4 +43,4 @@ export default withSession(async function userHandler(
       res.setHeader('Allow', ['PATCH'])
       res.status(405).end(`Method ${method} Not Allowed`)
   }
-})
+}