one api endpoint for admin/non-admin

pages/api/booking/[uuid]/bill.ts

@@ -0,0 +1,44 @@
+import { Bill } from '../../../../../db/bill'
+import { createBill, patchBill } from '../../../../../db/index'
+import withSession, { isAdminSession } from '../../../../../lib/session'
+
+export default withSession(async function billHandler(req, res): Promise<void> {
+  if (!isAdminSession(req)) {
+    res.status(403).send({ message: 'Not Authorized' })
+    return
+  }
+
+  const {
+    method,
+    query: { uuid: uuids },
+  } = req
+  const bookingUUID = Array.isArray(uuids) ? uuids[0] : uuids
+
+  let bill: Bill
+
+  switch (method) {
+    case 'POST':
+      try {
+        bill = await createBill(bookingUUID, req.body)
+        res.status(200).json(bill)
+      } catch (e) {
+        console.error(e)
+        res.status(500).end(`Internal Server Error...Guru is meditating...`)
+        return
+      }
+      break
+    case 'PATCH':
+      try {
+        bill = await patchBill(bookingUUID, req.body)
+        res.status(200).json(bill)
+      } catch (e) {
+        console.error(e)
+        res.status(500).end(`Internal Server Error...Guru is meditating...`)
+        return
+      }
+      break
+    default:
+      res.setHeader('Allow', ['POST', 'PATCH'])
+      res.status(405).end(`Method ${method} Not Allowed`)
+  }
+})

pages/api/booking/[uuid]/index.ts

@@ -2,8 +2,9 @@ import { NextApiRequest, NextApiResponse } from 'next'
 import { BookingDocument } from '../../../../db/booking'
 import { BOOKING_STATUS } from '../../../../db/enums'
 import { getBookingByUUID } from '../../../../db/index'
+import withSession, { isAdminSession } from '../../../../lib/session'
 
-export default async function userHandler(
+export default withSession(async function userHandler(
   req: NextApiRequest,
   res: NextApiResponse
 ): Promise<void> {
@@ -19,19 +20,21 @@ export default async function userHandler(
   switch (method) {
     case 'PATCH':
       booking = await getBookingByUUID(uuid)
-      const readonlyProps = Object.keys(req.body).filter(
-        (key) => key !== 'status'
-      )
 
-      if (readonlyProps.length) {
-        res
-          .status(400)
-          .end(
-            `The following attributes cannot be changed: ${readonlyProps.join(
-              ', '
-            )}`
-          )
-        break
+      if (!isAdminSession(req)) {
+        const deniedPropsForUser = Object.keys(req.body).filter(
+          (key) => key !== 'status'
+        )
+        if (deniedPropsForUser.length) {
+          res
+            .status(400)
+            .end(
+              `The following attributes cannot be changed: ${deniedPropsForUser.join(
+                ', '
+              )}`
+            )
+          break
+        }
       }
 
       if (!Object.values(BOOKING_STATUS).includes(req.body.status)) {
@@ -45,12 +48,17 @@ export default async function userHandler(
         break
       }
 
-      booking.status = req.body.status
-      await booking.save()
-      res.status(200).json(booking.toJSON())
+      booking.set(req.body)
+      try {
+        await booking.save()
+        await booking.populate('booker').execPopulate()
+        res.status(200).json(booking.toJSON())
+      } catch (error) {
+        res.status(400).end(`Failed to save booking: ${error.message}`)
+      }
       break
     default:
       res.setHeader('Allow', ['PATCH'])
       res.status(405).end(`Method ${method} Not Allowed`)
   }
-}
+})