auth for addMember

nycmeshnet · Aug 25, 2023 · 529509d · 529509d
1 parent eaa3334
commit 529509d
Showing 1 changed file with 12 additions and 4 deletions.
diff --git a/api/api.py b/api/api.py
@@ -66,8 +66,16 @@ def apiGetMemberDetailsByID(id):
 
 @app.route("/addMember", methods=["POST"])
 def apiAddMember():
-    try:   
-        queries.createNewMember(request.get_json())
-        return "OK", 200
+    token = request.headers["token"]
+    try:
+        permission = authenticate.getRolePermission(token, 'put')
     except:
-        return "Error", 500
+        return "Forbidden", 403
+    if permission == True:
+        try:   
+            queries.createNewMember(request.get_json())
+            return "OK", 200
+        except:
+            return "Error", 500
+    else:
+        return "Forbidden", 403