Add permission checks.

pages/api/teams/[id]/website.ts

@@ -1,9 +1,10 @@
 import { NextApiRequestQueryBody } from 'interface/api/nextApi';
-import { uuid } from 'lib/crypto';
+import { allowQuery } from 'lib/auth';
+import { UmamiApi } from 'lib/constants';
 import { useAuth } from 'lib/middleware';
 import { NextApiResponse } from 'next';
-import { methodNotAllowed, ok } from 'next-basics';
-import { createTeamWebsite, deleteTeamWebsite, getWebsitesByTeamId } from 'queries';
+import { methodNotAllowed, ok, unauthorized } from 'next-basics';
+import { getWebsitesByTeamId } from 'queries';
 
 export interface TeamWebsiteRequestQuery {
   id: string;
@@ -23,26 +24,14 @@ export default async (
   const { id: teamId } = req.query;
 
   if (req.method === 'GET') {
+    if (!(await allowQuery(req, UmamiApi.AuthType.Team))) {
+      return unauthorized(res);
+    }
+
     const website = await getWebsitesByTeamId({ teamId });
 
     return ok(res, website);
   }
 
-  if (req.method === 'POST') {
-    const { website_id: websiteId } = req.body;
-
-    const updated = await createTeamWebsite({ id: uuid(), websiteId, teamId });
-
-    return ok(res, updated);
-  }
-
-  if (req.method === 'DELETE') {
-    const { team_website_id } = req.body;
-
-    await deleteTeamWebsite(team_website_id);
-
-    return ok(res);
-  }
-
   return methodNotAllowed(res);
 };