added logic for better security

src/controllers/resource_types/favoritesController.js

@@ -84,6 +84,26 @@ const postFavoritesController = (req, res, next, config) => {
         })
 }
 
+const restoreFavoritesController = (req, res, next, config) => {
+    const conn = mysql.start(config)
+    const user_uuid = req.auth.user || null
+
+    modifyFavoritesModel({ ...req.params, user_uuid, deleted: false, conn })
+        .then((favorites) => {
+            const result = {
+                _data: favorites
+            }
+            next(result)
+        })
+        .catch((err) => {
+            const error = errorHandler(err, config.environment)
+            res.status(error.code).json(error)
+        })
+        .finally(() => {
+            mysql.end(conn)
+        })
+}
+
 const putFavoritesController = (req, res, next, config) => {
     const conn = mysql.start(config)
 
@@ -133,4 +153,5 @@ export {
     postFavoritesController,
     softDeleteFavoritesController,
     putFavoritesController,
+    restoreFavoritesController
 }

src/repositories/resource_types/favoritesRepository.js

@@ -29,7 +29,7 @@ const _favoritesQuery = (_pagination = '') => ({count}) => ({uuid, place_uuid, u
       WHERE
         r.created <= :now
       AND
-        (r.created > :now OR r.deleted IS NULL)
+        (r.deleted > :now OR r.deleted IS NULL)
       AND
         true
         ${uuidCondition}
@@ -76,12 +76,14 @@ const modifyFavoritesQuery = ({new_place_uuid, new_user_uuid}) => {
   const showNewPlaceCondition = new_place_uuid ? 'AND dbmaster.places.uuid = :new_place_uuid' : ''
   const userUuidCondition = new_user_uuid ? 'fk_user = (SELECT id from dbmaster.users WHERE uuid = :new_user_uuid),' : '';
   const showNewUserCondition = new_user_uuid? 'AND dbmaster.users.uuid = :new_user_uuid' : ''
+  const deletedCondition = deleted == false ? 'deleted = NULL,' : 'deleted = :deleted,';
   return `
     UPDATE 
         dbmaster.favorites as favorites
     SET 
         ${placeUuidCondition}
         ${userUuidCondition}
+        ${deletedCondition}
         favorites.created = favorites.created
     WHERE
         favorites.fk_place = (SELECT id from dbmaster.places WHERE uuid = :place_uuid)