Add admin check. (#1716)

* Add admin check.

* Fix teamId check.

pages/api/teams/[id]/index.ts

@@ -20,13 +20,10 @@ export default async (
 ) => {
   await useAuth(req, res);
 
-  const {
-    user: { id: userId },
-  } = req.auth;
   const { id: teamId } = req.query;
 
   if (req.method === 'GET') {
-    if (!(await canViewTeam(userId, teamId))) {
+    if (!(await canViewTeam(req.auth, teamId))) {
       return unauthorized(res);
     }
 
@@ -38,7 +35,7 @@ export default async (
   if (req.method === 'POST') {
     const { name } = req.body;
 
-    if (!(await canUpdateTeam(userId, teamId))) {
+    if (!(await canUpdateTeam(req.auth, teamId))) {
       return unauthorized(res, 'You must be the owner of this team.');
     }
 
@@ -48,7 +45,7 @@ export default async (
   }
 
   if (req.method === 'DELETE') {
-    if (!(await canDeleteTeam(userId, teamId))) {
+    if (!(await canDeleteTeam(req.auth, teamId))) {
       return unauthorized(res, 'You must be the owner of this team.');
     }
 

pages/api/teams/[id]/users.ts

@@ -21,13 +21,10 @@ export default async (
 ) => {
   await useAuth(req, res);
 
-  const {
-    user: { id: userId },
-  } = req.auth;
   const { id: teamId } = req.query;
 
   if (req.method === 'GET') {
-    if (!(await canViewTeam(userId, teamId))) {
+    if (!(await canViewTeam(req.auth, teamId))) {
       return unauthorized(res);
     }
 
@@ -37,7 +34,7 @@ export default async (
   }
 
   if (req.method === 'POST') {
-    if (!(await canUpdateTeam(userId, teamId))) {
+    if (!(await canUpdateTeam(req.auth, teamId))) {
       return unauthorized(res, 'You must be the owner of this team.');
     }
 
@@ -56,7 +53,7 @@ export default async (
   }
 
   if (req.method === 'DELETE') {
-    if (await canUpdateTeam(userId, teamId)) {
+    if (await canUpdateTeam(req.auth, teamId)) {
       return unauthorized(res, 'You must be the owner of this team.');
     }
     const { teamUserId } = req.body;

pages/api/teams/[id]/websites.ts

@@ -20,13 +20,10 @@ export default async (
 ) => {
   await useAuth(req, res);
 
-  const {
-    user: { id: userId },
-  } = req.auth;
   const { id: teamId } = req.query;
 
   if (req.method === 'GET') {
-    if (await canViewTeam(userId, teamId)) {
+    if (await canViewTeam(req.auth, teamId)) {
       return unauthorized(res);
     }
 

pages/api/teams/index.ts

@@ -28,7 +28,7 @@ export default async (
   }
 
   if (req.method === 'POST') {
-    if (!(await canCreateTeam(userId))) {
+    if (!(await canCreateTeam(req.auth))) {
       return unauthorized(res);
     }