External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: replace requireAdmin with requirePermission on all routes

Browse Source 
Migrate settings, teams, branding, and user management routes to use
the new permission-based authorization system. Remove requireAdmin
function entirely.
This commit is contained in:
Siddharth Kumar Sah
2026-04-10 21:25:30 +08:00
parent 885ace54f0
commit af7f57d52f
5 changed files with 37 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/routes/teams.ts
+5 -5
View File
@@ -11,7 +11,7 @@ import { randomUUID } from "node:crypto";
import { eq, sql } from "drizzle-orm";
import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
import { db, schema } from "../db/index.js";
import { requireAdmin, requireAuth } from "../plugins/auth.js";
import { requirePermission } from "../permissions.js";
function validateTeamName(name: unknown): string | null {
if (typeof name !== "string") return "Team name is required";
@@ -24,7 +24,7 @@ function validateTeamName(name: unknown): string | null {
export async function teamsRoutes(app: FastifyInstance): Promise<void> {
// GET /api/v1/teams — List all teams with member count
app.get("/api/v1/teams", async (request: FastifyRequest, reply: FastifyReply) => {
const user = requireAuth(request, reply);
const user = requirePermission("teams:manage")(request, reply);
if (!user) return;
const teams = db
@@ -47,7 +47,7 @@ export async function teamsRoutes(app: FastifyInstance): Promise<void> {
// POST /api/v1/teams — Create team (admin only)
app.post("/api/v1/teams", async (request: FastifyRequest, reply: FastifyReply) => {
const admin = requireAdmin(request, reply);
const admin = requirePermission("teams:manage")(request, reply);
if (!admin) return;
const body = request.body as { name?: string } | null;
@@ -81,7 +81,7 @@ export async function teamsRoutes(app: FastifyInstance): Promise<void> {
app.put(
"/api/v1/teams/:id",
async (request: FastifyRequest<{ Params: { id: string } }>, reply: FastifyReply) => {
const admin = requireAdmin(request, reply);
const admin = requirePermission("teams:manage")(request, reply);
if (!admin) return;
const { id } = request.params;
@@ -122,7 +122,7 @@ export async function teamsRoutes(app: FastifyInstance): Promise<void> {
app.delete(
"/api/v1/teams/:id",
async (request: FastifyRequest<{ Params: { id: string } }>, reply: FastifyReply) => {
const admin = requireAdmin(request, reply);
const admin = requirePermission("teams:manage")(request, reply);
if (!admin) return;
const { id } = request.params;