Protect asset create endpoint

[jd2rogers2]

Dev Summary

only a user that is part of an org should be able to create an asset/post
to do this i added a new auth guard and used it on the endpoint

still to do -> fix the test that's breaking locally

(later to come, checking that updating/deleting a post can only be done by user within poster's org)

Test Plan

repro steps:

for these tests you can see that i have the seeded users and orgs, but i also inserted into user_orgs userId, organizationsId values 1, 1 to create a relationship between my user 1 and the first org

1. in browser login with user 1 and get cookie from dev tools
2. make curl request with user 1's cookie. expect success (because they have an org related)

curl -X POST localhost:3001/api/assets \
--cookie "NEH_is_cool=s%3AeyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwiZmlyc3ROYW1lIjoidXNlcjFGaXJzdCIsImxhc3RfbmFtZSI6InVzZXIxTGFzdCIsImVtYWlsIjoidXNlcjFGaXJzdEBleGFtcGxlLmNvbSIsImVtYWlsX25vdGlmaWNhdGlvbl9vcHRfb3V0IjpmYWxzZSwiaWF0IjoxNjcyODg2NTk4LCJleHAiOjE2NzI4OTAxOTh9._QCbE3mJWcKa72l6vnCEO1hCrtgR2cwzm8CdyzuOjTE.FdOBENq0wBAtBcXENuEwGX7X4Wm2ctqlajkL1enxP64" \
-H "Content-Type: application/json" \
-d '{ "title": "title", "description": "description", "quantity": 1 }'

3. repeat 1 and 2 with other user (with no org). expect fail

--cookie "NEH_is_cool=s%3AeyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MiwiZmlyc3ROYW1lIjoidXNlcjJGaXJzdCIsImxhc3RfbmFtZSI6InVzZXIyTGFzdCIsImVtYWlsIjoidXNlcjJGaXJzdEBleGFtcGxlLmNvbSIsImVtYWlsX25vdGlmaWNhdGlvbl9vcHRfb3V0IjpmYWxzZSwiaWF0IjoxNjcyODg4NjM5LCJleHAiOjE2NzI4OTIyMzl9.bqtpcaXXf3Eg1plPHBsBtjOmpdpDY-nvV7jHZKwe-7Y.MVgCtcVqxDUkxSpBhGlUQVtQEWRte%2FQjpa8ijLGxZ6k" \
-H "Content-Type: application/json" \
-d '{ "title": "title", "description": "description", "quantity": 1 }'

Resources

• find where
• https://docs.nestjs.com/custom-decorators
• https://docs.nestjs.com/guards

[esteban-gs]

My changes in #264 throws a wrench in your work. Happy to pair on merge conflicts

[skyfox93]

Aren't assets with that are "offers"/ "donations" created by users without orgs? It's only the "request" asset type that needs this guard.

[skyfox93]

Reminder that relations do this for us. I.e, we already have a method on the user entity, user.organizations, that does the same thing as this method.

[esteban-gs]

Aren't assets with that are "offers"/ "donations" created by users without orgs? It's only the "request" asset type that needs this guard.

This sounds right.