feat: tmp user only write, no read

2022-03-27 23:52:59 +08:00
parent 4ed92568d8
commit dd3c208fe1
7 changed files with 30 additions and 6 deletions
--- a/src/api/vote.rs
+++ b/src/api/vote.rs
@@ -47,6 +47,8 @@ pub struct VoteInput {

 #[post("/vote", data = "<vi>")]
 pub async fn vote(vi: Form<VoteInput>, user: CurrentUser, rconn: RdsConn) -> JsonAPI {
+    user.id.ok_or_else(|| NotAllowed)?;
+
    let pid = vi.pid;
    let opts = PollOption::init(pid, &rconn).get_list().await?;
    if opts.is_empty() {