check account sid on client delete (#560)

lib/routes/api/clients.js

@@ -39,10 +39,27 @@ const validateUpdate = async(req, sid) => {
   }
 };
 
+const validateRetrieveOrDelete = async(req, sid) => {
+  const clients = await Client.retrieve(sid);
+  if (clients.length === 0) {
+    throw new DbErrorBadRequest('not found');
+  }
+  const client = clients[0];
+  if (req.user.hasAccountAuth && client.account_sid !== req.user.account_sid) {
+    throw new DbErrorForbidden('insufficient permissions');
+  } else if (req.user.hasServiceProviderAuth) {
+    const accounts = await Account.retrieve(client.account_sid, req.user.service_provider_sid);
+    if (!accounts.length) {
+      throw new DbErrorForbidden('insufficient permissions');
+    }
+  }
+};
+
 
 const preconditions = {
   add: validateAdd,
   update: validateUpdate,
+  delete: validateRetrieveOrDelete,
 };
 
 decorate(router, Client, ['add', 'update', 'delete'], preconditions);