assignment(authorization): lock down admin routes

app/models/post.server.ts

@@ -5,12 +5,16 @@ export async function getPosts() {
   return prisma.post.findMany();
 }
 
+export async function getPostsByUserId(userId: string) {
+  return prisma.post.findMany({ where: { userId } });
+}
+
 export async function getPost(slug: string) {
   return prisma.post.findUnique({ where: { slug } });
 }
 
 export async function createPost(
-  post: Pick<Post, "slug" | "title" | "markdown">
+  post: Pick<Post, "slug" | "title" | "markdown" | "userId">
 ) {
   return prisma.post.create({ data: post });
 }

app/routes/posts.admin.new.tsx

@@ -3,10 +3,13 @@ import { json, redirect } from "@remix-run/node";
 import { Form, useActionData, useNavigation } from "@remix-run/react";
 import invariant from "tiny-invariant";
 import { createPost } from "~/models/post.server";
+import { requireUserId } from "~/session.server";
 
 const inputClassName = `w-full rounded border border-gray-500 px-2 py-1 text-lg`;
 
 export const action = async ({ request }: ActionArgs) => {
+  const userId = await requireUserId(request);
+
   const formData = await request.formData();
 
   const title = formData.get("title");
@@ -30,7 +33,7 @@ export const action = async ({ request }: ActionArgs) => {
   invariant(typeof slug === "string", "slug must be a string");
   invariant(typeof markdown === "string", "markdown must be a string");
 
-  await createPost({ title, slug, markdown });
+  await createPost({ title, slug, markdown, userId });
 
   return redirect("/posts/admin");
 };

app/routes/posts.admin.tsx

@@ -1,14 +1,18 @@
+import type { LoaderFunction } from "@remix-run/node";
 import { json } from "@remix-run/node";
 import { Link, Outlet, useLoaderData } from "@remix-run/react";
 
-import { getPosts } from "~/models/post.server";
+import { getPostsByUserId } from "~/models/post.server";
+import { requireUserId } from "~/session.server";
 
-export const loader = async () => {
-  return json({ posts: await getPosts() });
+export const loader: LoaderFunction = async ({ request }) => {
+  const userId = await requireUserId(request);
+  return json({ posts: await getPostsByUserId(userId) });
 };
 
 export default function PostAdmin() {
   const { posts } = useLoaderData<typeof loader>();
+
   return (
     <div className="mx-auto max-w-4xl">
       <h1 className="my-6 mb-2 border-b-2 text-center text-3xl">Blog Admin</h1>

prisma/migrations/20230619153413_user_id_field_for_posts/migration.sql

@@ -0,0 +1,22 @@
+/*
+  Warnings:
+
+  - Added the required column `userId` to the `Post` table without a default value. This is not possible if the table is not empty.
+
+*/
+-- RedefineTables
+PRAGMA foreign_keys=OFF;
+CREATE TABLE "new_Post" (
+    "slug" TEXT NOT NULL PRIMARY KEY,
+    "title" TEXT NOT NULL,
+    "markdown" TEXT NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
+    "userId" TEXT NOT NULL,
+    CONSTRAINT "Post_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+INSERT INTO "new_Post" ("createdAt", "markdown", "slug", "title", "updatedAt") SELECT "createdAt", "markdown", "slug", "title", "updatedAt" FROM "Post";
+DROP TABLE "Post";
+ALTER TABLE "new_Post" RENAME TO "Post";
+PRAGMA foreign_key_check;
+PRAGMA foreign_keys=ON;

prisma/schema.prisma

@@ -16,6 +16,7 @@ model User {
 
   password Password?
   notes    Note[]
+  Post     Post[]
 }
 
 model Password {
@@ -44,4 +45,7 @@ model Post {
 
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
+
+  user   User   @relation(fields: [userId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  userId String
 }

prisma/seed.ts

@@ -49,6 +49,7 @@ async function seed() {
 
   Isn't it great?
       `.trim(),
+      userId: user.id,
     },
     {
       slug: "90s-mixtape",
@@ -74,6 +75,7 @@ async function seed() {
   - Santa Monica (Everclear)
   - C'mon N' Ride it (Quad City DJ's)
       `.trim(),
+      userId: user.id,
     },
   ];