From 5cfe0a14e9586ff6529b0226290f9c686673828b Mon Sep 17 00:00:00 2001
From: Hongbo Wu <hongbo@omnivore.app>
Date: Mon, 22 Aug 2022 16:44:05 +0800
Subject: [PATCH] Authorize user to get or create speech in the API

---
 packages/api/src/routers/article_router.ts | 32 ++++++++++++++--------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/packages/api/src/routers/article_router.ts b/packages/api/src/routers/article_router.ts
index b472e2099..cd798ae05 100644
--- a/packages/api/src/routers/article_router.ts
+++ b/packages/api/src/routers/article_router.ts
@@ -103,18 +103,28 @@ export function articleRouter() {
         order: {
           createdAt: 'DESC',
         },
+        relations: ['user'],
       })
-      if (existingSpeech?.state === SpeechState.COMPLETED) {
-        logger.info('Found existing completed speech', {
-          audioUrl: existingSpeech.audioFileName,
-          speechMarksUrl: existingSpeech.speechMarksFileName,
-        })
-        return res.redirect(await redirectUrl(existingSpeech, outputFormat))
-      }
-      if (existingSpeech?.state === SpeechState.INITIALIZED) {
-        logger.info('Found existing in progress speech')
-        // retry later
-        return res.status(202).send('Speech is in progress')
+      if (existingSpeech) {
+        if (existingSpeech.user.id !== uid) {
+          logger.info('User is not allowed to access speech of the article', {
+            userId: uid,
+            articleId,
+          })
+          return res.status(401).send({ errorCode: 'UNAUTHORIZED' })
+        }
+        if (existingSpeech.state === SpeechState.COMPLETED) {
+          logger.info('Found existing completed speech', {
+            audioUrl: existingSpeech.audioFileName,
+            speechMarksUrl: existingSpeech.speechMarksFileName,
+          })
+          return res.redirect(await redirectUrl(existingSpeech, outputFormat))
+        }
+        if (existingSpeech.state === SpeechState.INITIALIZED) {
+          logger.info('Found existing in progress speech')
+          // retry later
+          return res.status(202).send('Speech is in progress')
+        }
       }
 
       logger.info('Text to speech request', { articleId })