External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: replace requireAdmin with requirePermission on all routes

Browse Source 
Migrate settings, teams, branding, and user management routes to use
the new permission-based authorization system. Remove requireAdmin
function entirely.
This commit is contained in:
Siddharth Kumar Sah
2026-04-10 21:25:30 +08:00
parent 885ace54f0
commit af7f57d52f
5 changed files with 37 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/routes/branding.ts
+3 -3
View File
@@ -12,7 +12,7 @@ import { eq } from "drizzle-orm";
import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
import sharp from "sharp";
import { db, schema } from "../db/index.js";
import { requireAdmin } from "../plugins/auth.js";
import { requirePermission } from "../permissions.js";
const BRANDING_DIR = join(process.cwd(), "data", "branding");
const LOGO_PATH = join(BRANDING_DIR, "logo.png");
@@ -33,7 +33,7 @@ function upsertSetting(key: string, value: string): void {
export async function brandingRoutes(app: FastifyInstance): Promise<void> {
// POST /api/v1/settings/logo — Upload logo (admin only)
app.post("/api/v1/settings/logo", async (request: FastifyRequest, reply: FastifyReply) => {
const admin = requireAdmin(request, reply);
const admin = requirePermission("branding:manage")(request, reply);
if (!admin) return;
const file = await request.file();
@@ -86,7 +86,7 @@ export async function brandingRoutes(app: FastifyInstance): Promise<void> {
// DELETE /api/v1/settings/logo — Remove logo (admin only)
app.delete("/api/v1/settings/logo", async (request: FastifyRequest, reply: FastifyReply) => {
const admin = requireAdmin(request, reply);
const admin = requirePermission("branding:manage")(request, reply);
if (!admin) return;
if (existsSync(LOGO_PATH)) {