feat: Permissions for board members

Closes #262

server/api/controllers/labels/update.js

@@ -1,4 +1,7 @@
 const Errors = {
+  NOT_ENOUGH_RIGHTS: {
+    notEnoughRights: 'Not enough rights',
+  },
   LABEL_NOT_FOUND: {
     labelNotFound: 'Label not found',
   },
@@ -24,6 +27,9 @@ module.exports = {
   },
 
   exits: {
+    notEnoughRights: {
+      responseType: 'forbidden',
+    },
     labelNotFound: {
       responseType: 'notFound',
     },
@@ -36,12 +42,19 @@ module.exports = {
       .getProjectPath(inputs.id)
       .intercept('pathNotFound', () => Errors.LABEL_NOT_FOUND);
 
-    const isBoardMember = await sails.helpers.users.isBoardMember(currentUser.id, label.boardId);
+    const boardMembership = await BoardMembership.findOne({
+      boardId: label.boardId,
+      userId: currentUser.id,
+    });
 
-    if (!isBoardMember) {
+    if (!boardMembership) {
       throw Errors.LABEL_NOT_FOUND; // Forbidden
     }
 
+    if (boardMembership.role !== BoardMembership.Roles.EDITOR) {
+      throw Errors.NOT_ENOUGH_RIGHTS;
+    }
+
     const values = _.pick(inputs, ['name', 'color']);
     label = await sails.helpers.labels.updateOne(label, values, this.req);