External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): wrap role rename and delete in transactions

Browse Source
This commit is contained in:
SnapOtter
2026-06-13 10:35:28 +08:00
parent 3c4433583b
commit b564932083
1 changed files with 16 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/routes/roles.ts
+16 -12
View File
@@ -160,11 +160,6 @@ export async function rolesRoutes(app: FastifyInstance): Promise<void> {
if (dup && dup.id !== id) {
return reply.status(409).send({ error: "Role name already exists", code: "CONFLICT" });
}
// Update users on old role name to new name
await db
.update(schema.users)
.set({ role: body.name })
.where(eq(schema.users.role, role.name));
updates.name = body.name;
}
if (body.description !== undefined) {
@@ -181,7 +176,15 @@ export async function rolesRoutes(app: FastifyInstance): Promise<void> {
updates.permissions = body.permissions;
}
await db.update(schema.roles).set(updates).where(eq(schema.roles.id, id));
await db.transaction(async (tx) => {
if (body.name) {
await tx
.update(schema.users)
.set({ role: body.name })
.where(eq(schema.users.role, role.name));
}
await tx.update(schema.roles).set(updates).where(eq(schema.roles.id, id));
});
await auditLog(request.log, "ROLE_UPDATED", { adminId: user.id, roleId: id });
return reply.send({ ok: true });
@@ -206,12 +209,13 @@ export async function rolesRoutes(app: FastifyInstance): Promise<void> {
.send({ error: "Cannot delete built-in roles", code: "VALIDATION_ERROR" });
}
await db
.update(schema.users)
.set({ role: "user", updatedAt: new Date() })
.where(eq(schema.users.role, role.name));
await db.delete(schema.roles).where(eq(schema.roles.id, id));
await db.transaction(async (tx) => {
await tx
.update(schema.users)
.set({ role: "user", updatedAt: new Date() })
.where(eq(schema.users.role, role.name));
await tx.delete(schema.roles).where(eq(schema.roles.id, id));
});
await auditLog(request.log, "ROLE_DELETED", {
adminId: user.id,
roleId: id,