From 2229610f874d2e7bfa7eac4e9d4f27970034db95 Mon Sep 17 00:00:00 2001
From: Matt Aitken <matt@mattaitken.com>
Date: Fri, 30 Aug 2024 10:04:05 +0100
Subject: [PATCH] Added auth to the sync

---
 .../webapp/app/routes/sync.traces.$traceId.ts | 27 +++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/apps/webapp/app/routes/sync.traces.$traceId.ts b/apps/webapp/app/routes/sync.traces.$traceId.ts
index fa1e9ba12..123fc4ad6 100644
--- a/apps/webapp/app/routes/sync.traces.$traceId.ts
+++ b/apps/webapp/app/routes/sync.traces.$traceId.ts
@@ -1,4 +1,5 @@
 import type { LoaderFunctionArgs } from "@remix-run/node";
+import { $replica } from "~/db.server";
 import { env } from "~/env.server";
 import { logger } from "~/services/logger.server";
 import { getUserId, requireUserId } from "~/services/session.server";
@@ -10,10 +11,32 @@ export async function loader({ params, request }: LoaderFunctionArgs) {
   logger.log(`/sync/traces/${params.traceId}`, { userId });
 
   if (!userId) {
-    return new Response("authorization header not found", { status: 401 });
+    return new Response("No user found in cookie", { status: 401 });
   }
 
-  //todo check the user has access to this trace
+  const trace = await $replica.taskEvent.findFirst({
+    select: {
+      organizationId: true,
+    },
+    where: {
+      traceId: params.traceId,
+    },
+  });
+
+  if (!trace) {
+    return new Response("No trace found", { status: 404 });
+  }
+
+  const member = await $replica.orgMember.findFirst({
+    where: {
+      organizationId: trace.organizationId,
+      userId,
+    },
+  });
+
+  if (!member) {
+    return new Response("Not a member of this org", { status: 401 });
+  }
 
   const url = new URL(request.url);
   const originUrl = new URL(`${env.ELECTRIC_ORIGIN}/v1/shape/public."TaskEvent"`);