diff --git a/server/googleActions.js b/server/googleActions.js index ec541e5f5..51da56218 100644 --- a/server/googleActions.js +++ b/server/googleActions.js @@ -241,8 +241,8 @@ const GoogleActions = { return obj.data.id; }, - getGoogleBrew : async (id, accessId, accessType)=>{ - const drive = googleDrive.drive({ version: 'v3', auth: defaultAuth }); + getGoogleBrew : async (auth, id, accessId, accessType)=>{ + const drive = googleDrive.drive({ version: 'v3', auth: auth || defaultAuth }); const obj = await drive.files.get({ fileId : id, diff --git a/server/homebrew.api.js b/server/homebrew.api.js index f536ec45e..a75887742 100644 --- a/server/homebrew.api.js +++ b/server/homebrew.api.js @@ -106,6 +106,7 @@ const api = { stub = stub?.toObject(); googleId ??= stub?.googleId; + const isOwner = stub?.authors?.length === 0 || stub?.authors?.[0] === req.account?.username; const isAuthor = stub?.authors?.includes(req.account?.username); const isInvited = stub?.invitedAuthors?.includes(req.account?.username); @@ -122,9 +123,10 @@ const api = { } // If there is a google id, try to find the google brew - const googleBrew = await GoogleActions.getGoogleBrew(googleId || stub?.googleId, id, accessType) if(!stubOnly && googleId) { + const oAuth2Client = isOwner? GoogleActions.authCheck(req.account, res) : undefined; + const googleBrew = await GoogleActions.getGoogleBrew(oAuth2Client, googleId, id, accessType) .catch((googleError)=>{ const reason = googleError.errors?.[0].reason; if(reason == 'notFound') diff --git a/server/homebrew.api.spec.js b/server/homebrew.api.spec.js index 814db26f8..8270b1568 100644 --- a/server/homebrew.api.spec.js +++ b/server/homebrew.api.spec.js @@ -298,7 +298,7 @@ describe('Tests for api', ()=>{ expect(next).toHaveBeenCalled(); expect(api.getId).toHaveBeenCalledWith(req); expect(model.get).toHaveBeenCalledWith({ shareId: '1' }); - expect(google.getGoogleBrew).toHaveBeenCalledWith('2', '1', 'share'); + expect(google.getGoogleBrew).toHaveBeenCalledWith(undefined, '2', '1', 'share'); }); it('access is denied to a locked brew', async()=>{