server/AyaNova/DataList/DataListFetcher.cs

@@ -7,18 +7,29 @@ using Microsoft.AspNetCore.Mvc;
 using AyaNova.Models;
 using System.Threading.Tasks;
 using Microsoft.EntityFrameworkCore;
+using EnumsNET;
 
 namespace AyaNova.DataList
 {
     internal static class DataListFetcher
     {
         internal static async Task<ApiPagedResponse> GetResponse(string DataListKey, AyContext ct, IUrlHelper Url,
-        string routeName, ListOptions listOptions, long UserId)
+        string routeName, ListOptions listOptions, long UserId, AuthorizationRoles UserRoles)
         {
 
             // var AyaObjectFields = AyaObjectFieldDefinitions.AyaObjectFields(AyaObjectFieldDefinitions.TEST_WIDGET_USER_EMAIL_ADDRESS_LIST_KEY);
             var DataList = DataListFactory.GetAyaDataList(DataListKey);
+            //was the name not found as a list?
+            if (DataList == null)
+            {
+                throw new System.ArgumentOutOfRangeException($"DataList \"{DataListKey}\" specified does not exist");
+            }
 
+            //check rights
+            if (!UserRoles.HasAnyFlags(DataList.AllowedRoles))
+            {
+                throw new System.NotSupportedException("User roles insufficient for this datalist");
+            }
 
             //TODO: FETCH DATALISTTEMPLATE HERE OR USE DEFAULT IF FAULTY OR NOT FOUND
             var JSONDataListTemplate = DataList.DefaultDataListDisplayTemplate;