Check that sold bet is by auth'd user

2022-06-01 18:30:40 -05:00 · 2022-06-01 18:30:40 -05:00 · f14bb63393
commit f14bb63393
parent c2f993ddf2
1 changed files with 1 additions and 0 deletions
--- a/functions/src/sell-bet.ts
+++ b/functions/src/sell-bet.ts
@ -50,6 +50,7 @@ export const sellBet = functions.runWith({ minInstances: 1 }).https.onCall(
      if (!betSnap.exists) return { status: 'error', message: 'Invalid bet' }
      const bet = betSnap.data() as Bet

+      if (userId !== bet.userId) return { status: 'error', message: 'Not authorized' }
      if (bet.isSold) return { status: 'error', message: 'Bet already sold' }

      const newBetDoc = firestore