Admin page for bill wit iron-session (#13)

pages/api/booking/[uuid]/bill.ts

@@ -1,18 +1,20 @@
-import { NextApiRequest, NextApiResponse } from 'next'
 import { BillDocument } from '../../../../db/bill'
 import { createBill, patchBill } from '../../../../db/index'
+import withSession from '../../../../lib/session'
 
-export default async function userHandler(
-  req: NextApiRequest,
-  res: NextApiResponse
-) {
+export default withSession(async function billHandler(req, res) {
   const {
     method,
     query: { uuid: uuids },
   } = req
-
   const bookingUUID = Array.isArray(uuids) ? uuids[0] : uuids
 
+  const user = req?.session.get('user')
+  if (!user || user.role !== 'admin') {
+    res.status(401).end('Your are unauthorized. Best to move along...')
+    return
+  }
+
   let bill: BillDocument
 
   switch (method) {
@@ -40,4 +42,4 @@ export default async function userHandler(
       res.setHeader('Allow', ['POST'])
       res.status(405).end(`Method ${method} Not Allowed`)
   }
-}
+})