Secure actor-owned game API routes

2026-07-25 08:50:41 +00:00
parent 6889c463fd
commit a9d6541c18
13 changed files with 301 additions and 118 deletions
@@ -13,3 +13,25 @@ export const getMyGeneral = async (ctx: Pick<GameApiContext, 'db' | 'auth'>) =>
    }
    return general;
 };
+
+export const getOwnedGeneral = async (
+    ctx: Pick<GameApiContext, 'db' | 'auth'>,
+    generalId: number
+) => {
+    if (!ctx.auth?.user.id) {
+        throw new TRPCError({ code: 'UNAUTHORIZED' });
+    }
+    const general = await ctx.db.general.findUnique({
+        where: { id: generalId },
+    });
+    if (!general) {
+        throw new TRPCError({ code: 'NOT_FOUND', message: 'General not found.' });
+    }
+    if (general.userId !== ctx.auth.user.id) {
+        throw new TRPCError({
+            code: 'FORBIDDEN',
+            message: 'General is not owned by the authenticated user.',
+        });
+    }
+    return general;
+};