From cfdc2362974ae07e12fc987a838c0bd61da46008 Mon Sep 17 00:00:00 2001
From: Hongbo Wu <hongbo@omnivore.app>
Date: Mon, 22 Aug 2022 16:24:39 +0800
Subject: [PATCH] Validate token and authenticate user before setting Speech
 state to FAILED

---
 packages/api/src/routers/svc/speech.ts | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/packages/api/src/routers/svc/speech.ts b/packages/api/src/routers/svc/speech.ts
index 6c188d4fb..87ddfb981 100644
--- a/packages/api/src/routers/svc/speech.ts
+++ b/packages/api/src/routers/svc/speech.ts
@@ -21,28 +21,25 @@ export function speechServiceRouter() {
       // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
       body: req.body,
     })
+    const token = req.query.token as string
+    try {
+      if (!(await getClaimsByToken(token))) {
+        logger.info('Unauthorized request', { token })
+        return res.status(200).send('UNAUTHORIZED')
+      }
+    } catch (error) {
+      logger.error('Unauthorized request', { token, error })
+      return res.status(200).send('UNAUTHORIZED')
+    }
+
     const { userId, speechId } = req.body as {
       userId: string
       speechId: string
     }
     if (!userId || !speechId) {
-      speechId && (await setSpeechFailure(speechId))
       return res.status(200).send('Invalid data')
     }
 
-    const token = req.query.token as string
-    try {
-      if (!(await getClaimsByToken(token))) {
-        logger.info('Unauthorized request', { token })
-        await setSpeechFailure(speechId)
-        return res.status(200).send('UNAUTHORIZED')
-      }
-    } catch (error) {
-      logger.error('Unauthorized request', { token, error })
-      await setSpeechFailure(speechId)
-      return res.status(200).send('UNAUTHORIZED')
-    }
-
     logger.info(`Create article speech`, {
       body: {
         userId,
@@ -54,6 +51,7 @@ export function speechServiceRouter() {
     })
     const speech = await getRepository(Speech).findOneBy({
       id: speechId,
+      user: { id: userId },
     })
     if (!speech) {
       return res.status(200).send('Speech not found')