[offers][fix] make offers api open to unauthenticated users

apps/portal/src/server/router/offers/offers-comments-router.ts

@@ -1,9 +1,9 @@
 import { z } from 'zod';
 import * as trpc from '@trpc/server';
 
-import { createProtectedRouter } from '../context';
+import { createRouter } from '../context';
 
-export const offersCommentsRouter = createProtectedRouter()
+export const offersCommentsRouter = createRouter()
   .query('getComments', {
     input: z.object({
       profileId: z.string(),
@@ -71,70 +71,87 @@ export const offersCommentsRouter = createProtectedRouter()
       message: z.string(),
       profileId: z.string(),
       replyingToId: z.string().optional(),
-      userId: z.string().optional(),
+      token: z.string().optional(),
+      userId: z.string().optional()
     }),
     async resolve({ ctx, input }) {
-      const createdReply = await ctx.prisma.offersReply.create({
+      const profile = await ctx.prisma.offersProfile.findFirst({
-        data: {
+        where: {
-          message: input.message,
+          id: input.profileId,
-          profile: {
-            connect: {
-              id: input.profileId,
-            },
-          },
         },
       });
 
-      if (input.replyingToId) {
+      const profileEditToken = profile?.editToken;
-        await ctx.prisma.offersReply.update({
+
+      if (input.token === profileEditToken || input.userId) {
+        const createdReply = await ctx.prisma.offersReply.create({
           data: {
-            replyingTo: {
+            message: input.message,
+            profile: {
               connect: {
-                id: input.replyingToId,
+                id: input.profileId,
               },
             },
           },
-          where: {
-            id: createdReply.id,
-          },
         });
-      }
 
-      if (input.userId) {
+        if (input.replyingToId) {
-        await ctx.prisma.offersReply.update({
+          await ctx.prisma.offersReply.update({
-          data: {
+            data: {
-            user: {
+              replyingTo: {
-              connect: {
+                connect: {
-                id: input.userId,
+                  id: input.replyingToId,
+                },
+              },
+            },
+            where: {
+              id: createdReply.id,
+            },
+          });
+        }
+
+        if (input.userId) {
+          await ctx.prisma.offersReply.update({
+            data: {
+              user: {
+                connect: {
+                  id: input.userId,
+                },
+              },
+            },
+            where: {
+              id: createdReply.id,
+            },
+          });
+        }
+        // Get replies
+        const result = await ctx.prisma.offersProfile.findFirst({
+          include: {
+            discussion: {
+              include: {
+                replies: true,
+                replyingTo: true,
+                user: true,
               },
             },
           },
           where: {
-            id: createdReply.id,
+            id: input.profileId,
           },
         });
-      }
-      // Get replies
-      const result = await ctx.prisma.offersProfile.findFirst({
-        include: {
-          discussion: {
-            include: {
-              replies: true,
-              replyingTo: true,
-              user: true,
-            },
-          },
-        },
-        where: {
-          id: input.profileId,
-        },
-      });
 
-      if (result) {
+        if (result) {
-        return result.discussion.filter((x) => x.replyingToId === null);
+          return result.discussion.filter((x) => x.replyingToId === null);
-      }
+        }
+
+        return result;
+    }
+
+    throw new trpc.TRPCError({
+      code: 'UNAUTHORIZED',
+      message: 'Missing userId or wrong token.',
+    });
 
-      return result;
     },
   })
   .mutation('update', {