Security patch

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+### Added
+- Added Admin validation for list export
+
 ### Changed
 
 - Cypress code improvements

dotnet/Controlers/RoutesController.cs

@@ -1,33 +1,40 @@
-namespace service.Controllers
+namespace service.Controllers
 {
     using System;
-    using System.Collections.Generic;
-    using System.Linq;
     using System.Net;
     using System.Threading.Tasks;
-    using Microsoft.AspNetCore.Http;
     using Microsoft.AspNetCore.Mvc;
-    using Newtonsoft.Json;
     using Vtex.Api.Context;
     using WishList.Data;
     using WishList.Models;
+    using WishList.Services;
 
     public class RoutesController : Controller
     {
         private readonly IIOServiceContext _context;
         private readonly IWishListRepository _wishListRepository;
+        private readonly IWishListService _wishListService;
 
-        public RoutesController(IIOServiceContext context, IWishListRepository wishListRepository)
+        public RoutesController(IIOServiceContext context, IWishListRepository wishListRepository, IWishListService wishListService)
         {
             this._context = context ?? throw new ArgumentNullException(nameof(context));
             this._wishListRepository = wishListRepository ?? throw new ArgumentNullException(nameof(wishListRepository));
+            this._wishListService = wishListService ?? throw new ArgumentNullException(nameof(wishListService));
         }
 
         public async Task<IActionResult> ExportAllLists()
         {
-            WishListsWrapper wishListsWrapper = await _wishListRepository.GetAllLists();
-
-            return Json(wishListsWrapper);
+            HttpStatusCode isAdminUser = await _wishListService.IsValidAuthUser();
+            if (isAdminUser.Equals(HttpStatusCode.OK))
+            {
+                WishListsWrapper wishListsWrapper = await _wishListRepository.GetAllLists();
+
+                return Json(wishListsWrapper);
+            }
+            else
+            {
+                return Unauthorized();
+            }
         }
     }
 }