feat: modeldata接口。fix: 部分权限校验bug

src/pages/api/chat/delChatRecordByIndex.ts

@@ -1,17 +1,25 @@
 import type { NextApiRequest, NextApiResponse } from 'next';
 import { jsonRes } from '@/service/response';
 import { connectToDatabase, Chat } from '@/service/mongo';
+import { authToken } from '@/service/utils/tools';
 
 export default async function handler(req: NextApiRequest, res: NextApiResponse) {
   try {
     const { chatId, index } = req.query as { chatId: string; index: string };
+    const { authorization } = req.headers;
 
+    if (!authorization) {
+      throw new Error('无权操作');
+    }
     if (!chatId || !index) {
       throw new Error('缺少参数');
     }
 
     await connectToDatabase();
 
+    // 凭证校验
+    const userId = await authToken(authorization);
+
     const chatRecord = await Chat.findById(chatId);
 
     if (!chatRecord) {
@@ -31,12 +39,18 @@ export default async function handler(req: NextApiRequest, res: NextApiResponse)
     }
 
     // 删除最一条数据库记录, 也就是预发送的那一条
-    await Chat.findByIdAndUpdate(chatId, {
-      $set: {
-        [`content.${deletedIndex}.deleted`]: true,
-        updateTime: Date.now()
+    await Chat.updateOne(
+      {
+        _id: chatId,
+        userId
+      },
+      {
+        $set: {
+          [`content.${deletedIndex}.deleted`]: true,
+          updateTime: Date.now()
+        }
       }
-    });
+    );
 
     jsonRes(res);
   } catch (err) {