Protect GET /trips with a session cookie

When an admin requests /trips, they see all of the trips in the Trips
table. When a user requests /trips, they see only their trips.

1 files changed, 8 insertions, 2 deletions

diff --git a/src/Trips.hs b/src/Trips.hs
index 55bc6b958d0f..ec52ec58fee9 100644
--- a/src/Trips.hs
+++ b/src/Trips.hs
@@ -22,6 +22,12 @@ delete dbFile tripPK =
       (tripPK |> T.tripPKFields)
 
 -- | Return a list of all of the trips in `dbFile`.
-list :: FilePath -> IO [T.Trip]
-list dbFile = withConnection dbFile $ \conn ->
+listAll :: FilePath -> IO [T.Trip]
+listAll dbFile = withConnection dbFile $ \conn ->
   query_ conn "SELECT username,destination,startDate,endDate,comment FROM Trips"
+
+-- | Return a list of all of the trips in `dbFile`.
+list :: FilePath -> T.Username -> IO [T.Trip]
+list dbFile username = withConnection dbFile $ \conn ->
+  query conn "SELECT username,destination,startDate,endDate,comment FROM Trips WHERE username = ?"
+    (Only username)