Press n or j to go to the next uncovered block, b, p or k for the previous block.
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 | 1x 1x 1x 1x 1x 19x 19x 19x 19x 19x 6x 13x 12x 2x 10x 10x 10x 2x 8x 3x 5x 4x 2x 2x | const { DynamoDBClient } = require('@aws-sdk/client-dynamodb')
const { DynamoDBDocumentClient, GetCommand, DeleteCommand } = require('@aws-sdk/lib-dynamodb')
const client = new DynamoDBClient({})
const docClient = DynamoDBDocumentClient.from(client)
exports.handler = async (event) => {
try {
const tenantId = event.pathParameters?.tenantId
const targetUserId = event.pathParameters?.userId
const currentUserId = event.requestContext?.authorizer?.claims?.sub
if (!currentUserId || !tenantId || !targetUserId) {
return {
statusCode: 401,
headers: {
'Content-Type': 'application/json',
'Access-Control-Allow-Origin': '*'
},
body: JSON.stringify({ error: 'Unauthorized' })
}
}
// Get tenant info to check ownership
const tenant = await docClient.send(
new GetCommand({
TableName: process.env.TENANTS_TABLE_NAME,
Key: { id: tenantId }
})
)
if (!tenant.Item) {
return {
statusCode: 404,
headers: {
'Content-Type': 'application/json',
'Access-Control-Allow-Origin': '*'
},
body: JSON.stringify({ error: 'Tenant not found' })
}
}
// Check authorization: user can remove themselves, or owner can remove anyone
const isOwner = tenant.Item.ownerId === currentUserId
const isSelf = targetUserId === currentUserId
if (!isOwner && !isSelf) {
return {
statusCode: 403,
headers: {
'Content-Type': 'application/json',
'Access-Control-Allow-Origin': '*'
},
body: JSON.stringify({
error: 'Only the owner or the user themselves can remove this membership'
})
}
}
// Prevent owner from removing themselves
if (tenant.Item.ownerId === targetUserId) {
return {
statusCode: 400,
headers: {
'Content-Type': 'application/json',
'Access-Control-Allow-Origin': '*'
},
body: JSON.stringify({ error: 'Owner cannot be removed from tenant' })
}
}
// Delete from MEMBERSHIPS_TABLE
await docClient.send(
new DeleteCommand({
TableName: process.env.MEMBERSHIPS_TABLE_NAME,
Key: { userId: targetUserId, tenantId }
})
)
return {
statusCode: 200,
headers: {
'Content-Type': 'application/json',
'Access-Control-Allow-Origin': '*'
},
body: JSON.stringify({ message: 'Membership removed successfully' })
}
} catch (error) {
console.error('Error removing member:', error)
return {
statusCode: 500,
headers: {
'Content-Type': 'application/json',
'Access-Control-Allow-Origin': '*'
},
body: JSON.stringify({ error: 'Failed to remove member' })
}
}
}
|