From 1a353c350bd8afa58fe3ef058caecfca12f25bf9 Mon Sep 17 00:00:00 2001
From: Kalle <38327916+Sendouc@users.noreply.github.com>
Date: Sat, 13 Aug 2022 15:54:18 +0300
Subject: [PATCH] Validate permission to report results

---
 app/routes/calendar/$id/report-winners.tsx | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/app/routes/calendar/$id/report-winners.tsx b/app/routes/calendar/$id/report-winners.tsx
index 574f836fb..55d86e500 100644
--- a/app/routes/calendar/$id/report-winners.tsx
+++ b/app/routes/calendar/$id/report-winners.tsx
@@ -96,6 +96,7 @@ const reportWinnersParamsSchema = z.object({
 });
 
 export const action: ActionFunction = async ({ request, params }) => {
+  const user = await requireUser(request);
   const parsedParams = reportWinnersParamsSchema.parse(params);
   const parsedInput = await safeParseRequestFormData({
     request,
@@ -108,6 +109,16 @@ export const action: ActionFunction = async ({ request, params }) => {
     };
   }
 
+  const event = notFoundIfFalsy(db.calendarEvents.findById(parsedParams.id));
+  validate(
+    canReportCalendarEventWinners({
+      user,
+      event,
+      startTimes: event.startTimes,
+    }),
+    401
+  );
+
   db.calendarEvents.upsertReportedScores({
     eventId: parsedParams.id,
     participantCount: parsedInput.data.participantCount,