Working on live surveys

questions.go

@@ -3,6 +3,7 @@ package main
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"net/http"
 	"strconv"
 	"time"
@@ -38,10 +39,18 @@ func init() {
 
 		return formatApiResponse(s.NewQuestion(new.Title, new.DescriptionRaw, new.Placeholder, new.Kind))
 	}), adminRestricted))
-	router.GET("/api/questions/:qid", apiHandler(questionHandler(
-		func(s Question, _ []byte) HTTPResponse {
-			return APIResponse{s}
-		}), adminRestricted))
+	router.GET("/api/questions/:qid", apiAuthHandler(questionAuthHandler(
+		func(q Question, u *User, _ []byte) HTTPResponse {
+			if u.IsAdmin {
+				return APIResponse{q}
+			} else if s, err := getSurvey(int(q.IdSurvey)); err != nil {
+				return APIErrorResponse{err: err}
+			} else if s.Shown || (s.Direct != nil && *s.Direct == q.Id) {
+				return APIResponse{q}
+			} else {
+				return APIErrorResponse{err: fmt.Errorf("Not authorized"), status: http.StatusForbidden}
+			}
+		}), loggedUser))
 	router.GET("/api/surveys/:sid/questions/:qid", apiHandler(questionHandler(
 		func(s Question, _ []byte) HTTPResponse {
 			return APIResponse{s}