| 103 | } |
| 104 | |
| 105 | static async put( |
| 106 | req: AuthedRequestWithTenantAndBody<putMessageType>, |
| 107 | res: Response, |
| 108 | next: NextFunction |
| 109 | ) { |
| 110 | const message = await MessagesService.get({ |
| 111 | id: req.body.id, |
| 112 | accountId: req.tenant?.id!, |
| 113 | }); |
| 114 | |
| 115 | const ownerId = req.tenant_user?.id; |
| 116 | const authorId = message?.author?.id; |
| 117 | |
| 118 | if (!ownerId || !authorId || ownerId !== authorId) { |
| 119 | return next(new Forbidden('User is not allowed to update this message')); |
| 120 | } |
| 121 | |
| 122 | const updated = await MessagesService.update({ |
| 123 | messageId: req.body.id, |
| 124 | body: req.body.body, |
| 125 | }); |
| 126 | return res.json(updated); |
| 127 | } |
| 128 | |
| 129 | static async notImplemented(_: any, _2: any, next: NextFunction) { |
| 130 | next(new NotImplemented()); |