@@ -5,6 +5,8 @@ let actions = {
5
5
new : async ( user , network , operation , operationNetwork , scheduled ) => {
6
6
if ( ! validator . validate ( operationNetwork , operation ) )
7
7
return { error : 'operation validation failed' }
8
+ else if ( ! validator . general . positiveInteger ( scheduled ) || scheduled < new Date ( ) . getTime ( ) )
9
+ return { error : 'scheduled timestamp must be in the future' }
8
10
let newDoc
9
11
try {
10
12
newDoc = await mongo . db . collection ( 'operations' ) . insertOne ( {
@@ -22,6 +24,20 @@ let actions = {
22
24
edit : async ( user , network , id , updatedOperation , updatedOperationNetwork , scheduled ) => {
23
25
if ( ! validator . validate ( updatedOperationNetwork , updatedOperation ) )
24
26
return { error : 'updated operation validation failed' }
27
+ else if ( ! validator . general . positiveInteger ( scheduled ) || scheduled < new Date ( ) . getTime ( ) )
28
+ return { error : 'scheduled timestamp must be in the future' }
29
+ let existing
30
+ try {
31
+ existing = await mongo . db . collection ( 'operations' ) . findOne ( { _id : new mongo . objectId ( id ) } )
32
+ } catch ( e ) {
33
+ return { error : e . toString ( ) }
34
+ }
35
+ if ( ! existing )
36
+ return { error : 'operation id does not exist' }
37
+ else if ( existing . tx || existing . error )
38
+ return { error : 'cannot edit operations that have already been broadcasted' }
39
+ else if ( existing . user !== user || existing . network !== network )
40
+ return { error : 'operation isn\'t yours to edit' }
25
41
let update = { $set : { } }
26
42
if ( updatedOperation )
27
43
update . $set . operation = updatedOperation
@@ -35,6 +51,16 @@ let actions = {
35
51
return { result : { ok : 1 } }
36
52
} ,
37
53
delete : async ( user , network , id ) => {
54
+ let existing
55
+ try {
56
+ existing = await mongo . db . collection ( 'operations' ) . findOne ( { _id : new mongo . objectId ( id ) } )
57
+ } catch ( e ) {
58
+ return { error : e . toString ( ) }
59
+ }
60
+ if ( ! existing )
61
+ return { error : 'operation id does not exist already' }
62
+ else if ( existing . user !== user || existing . network !== network )
63
+ return { error : 'operation isn\'t yours to delete' }
38
64
try {
39
65
await mongo . db . collection ( 'operations' ) . deleteOne ( { _id : new mongo . objectId ( id ) } )
40
66
} catch ( e ) {
@@ -49,6 +75,8 @@ let actions = {
49
75
} catch ( e ) {
50
76
return { error : e . toString ( ) }
51
77
}
78
+ if ( result . user !== user || result . network !== network )
79
+ return { error : 'operation isn\'t yours to look at' }
52
80
return { result : result }
53
81
} ,
54
82
list : async ( user , network ) => {
0 commit comments