From 67eb136ff79109565f6910b6f9117c482f4700aa Mon Sep 17 00:00:00 2001
From: Guillaume Dorce <polynux.dev@gmail.com>
Date: Fri, 14 Oct 2022 16:43:28 +0200
Subject: [PATCH] fix permission for deletion

---
 src/controller/PostController.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/controller/PostController.ts b/src/controller/PostController.ts
index 1f487ec..3478842 100644
--- a/src/controller/PostController.ts
+++ b/src/controller/PostController.ts
@@ -1,6 +1,7 @@
 import { PrismaClient, Post as PrismaPost, Like } from '@prisma/client';
 import { Post } from '@/models/PostModel';
 import { exclude } from '@/lib/utils';
+import { getUserById } from './UserController';
 
 const prisma = new PrismaClient();
 
@@ -82,7 +83,11 @@ const deletePost = async (id: number, userId: number): Promise<PrismaPost | Erro
   if (post === null) {
     return new Error('Post not found');
   }
-  if (post.authorId !== userId) {
+  const user = await getUserById(userId);
+  if (!user) {
+    return new Error('User not found');
+  }
+  if (post.authorId !== userId && user.role === 'USER') {
     return new Error('User is not the author of this post');
   }
   return prisma.post.delete({