updates

controllers/store_secrets.go

@@ -83,7 +83,17 @@ func UpdateSecret(c *gin.Context) {
 
 	fmt.Printf("UpdateSecret received JSON input '%v'\n", input)
 
-	// TODO - verify that the user role is not readonly
+	// Get the user and role id of the requestor
+	u, err := models.GetUserRoleFromToken(c)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	// Verify that the user role is not readonly
+	if u.ReadOnly {
+		c.JSON(http.StatusForbidden, gin.H{"error": "user role does not permit updates"})
+		return
+	}
 
 	// Populate fields
 	s := models.Secret{}