From 4b4d32ec9c9e78e32b977882d8affa6baef4bc19 Mon Sep 17 00:00:00 2001
From: Jack Foltz <jack@foltz.io>
Date: Mon, 15 Jan 2018 11:48:58 -0500
Subject: [PATCH] Add scope middleware to invites

---
 app/routes/invites.js | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/app/routes/invites.js b/app/routes/invites.js
index 3ebfae7..55b1583 100644
--- a/app/routes/invites.js
+++ b/app/routes/invites.js
@@ -3,6 +3,18 @@ var router = express.Router();
 
 var Invite = require('../models/Invite.js');
 
+var requireScope = function (perm) {
+    return function(req, res, next) {
+        User.findOne({username: req.session.passport.user}, function(err, user) {
+            if (err) throw err;
+            if (user.scope.indexOf(perm) === -1)
+                res.status(400).json({'message': 'No permission.'});
+            else
+                next();
+        });
+    }
+};
+
 router.post('/create', function (req, res) {
     if (!req.body.scope) {
         res.status(400).json({'message': 'Bad request.'});