Jennie Robinson Faber
28040f44f4
Delete uses findOneAndDelete with author match (no TOCTOU window); existence check only runs on miss to distinguish 403 vs 404. Posts list capped at 200. Drop unused resolveTagChannel and refreshParams; route slack URL building through the composable's slackUrl helper.
19 lines
593 B
JavaScript
19 lines
593 B
JavaScript
import BoardPost from '../../../models/boardPost.js'
|
|
import { requireAuth } from '../../../utils/auth.js'
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
const member = await requireAuth(event)
|
|
const id = getRouterParam(event, 'id')
|
|
|
|
const deleted = await BoardPost.findOneAndDelete({ _id: id, author: member._id })
|
|
|
|
if (!deleted) {
|
|
const exists = await BoardPost.exists({ _id: id })
|
|
throw createError({
|
|
statusCode: exists ? 403 : 404,
|
|
statusMessage: exists ? 'Not authorized to delete this post' : 'Post not found',
|
|
})
|
|
}
|
|
|
|
return { success: true }
|
|
})
|