refactor(auth): simplify authorization checks to use membership only

- Remove explicit ADMIN role checks in API handlers
- Replace combined creator/member role checks with membership-only filters
- Update seed data roles to reflect changed authorization logic
- Add migration to insert hunt creators as members for consistent checks
- Prevent removal of hunt creator as a member with new explicit check
- Adjust related user role updates and queries accordingly
- Upgrade dependencies including nuxt and zod for compatibility

server/api/admin/answer/[answerId]/review.post.ts

@@ -4,9 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({ status: 403, statusText: 'Not allowed!' });
-  }
   const userId = user.user.id;
   const { answerId } = await useValidatedParams(
     event,
@@ -18,26 +15,15 @@ export default defineEventHandler(async (event) => {
   const answer = await prisma.questAnswer.findUnique({
     where: {
       id: answerId,
-      OR: [
-        {
-          quest: {
-            hunt: {
-              creatorId: userId
-            }
-          }
-        },
-        {
-          quest: {
-            hunt: {
-              members: {
-                some: {
-                  memberId: userId
-                }
-              }
+      quest: {
+        hunt: {
+          members: {
+            some: {
+              memberId: userId
             }
           }
         }
-      ]
+      }
     },
     select: { id: true }
   });

server/api/admin/hunt/[huntId]/image.delete.ts

@@ -4,12 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
   const userId = user.user.id;
   const { huntId } = await useValidatedParams(
     event,
@@ -21,18 +15,11 @@ export default defineEventHandler(async (event) => {
   const hunt = await prisma.hunt.findUnique({
     where: {
       id: huntId,
-      OR: [
-        {
-          creatorId: userId
-        },
-        {
-          members: {
-            some: {
-              memberId: userId
-            }
-          }
+      members: {
+        some: {
+          memberId: userId
         }
-      ]
+      }
     },
     select: {
       id: true

server/api/admin/hunt/[huntId]/image.post.ts

@@ -6,12 +6,6 @@ import { minioClient, s3Bucket, s3Host } from '~~/lib/s3';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
   const userId = user.user.id;
   const { huntId } = await useValidatedParams(
     event,
@@ -23,18 +17,11 @@ export default defineEventHandler(async (event) => {
   const hunt = await prisma.hunt.findUnique({
     where: {
       id: huntId,
-      OR: [
-        {
-          creatorId: userId
-        },
-        {
-          members: {
-            some: {
-              memberId: userId
-            }
-          }
+      members: {
+        some: {
+          memberId: userId
         }
-      ]
+      }
     },
     select: {
       id: true

server/api/admin/hunt/[huntId]/index.get.ts

@@ -5,12 +5,6 @@ import { sendJson } from '~~/server/utils/json';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
   const userId = user.user.id;
   const { huntId } = await useValidatedParams(
     event,
@@ -22,18 +16,11 @@ export default defineEventHandler(async (event) => {
   const hunt = await prisma.hunt.findUnique({
     where: {
       id: huntId,
-      OR: [
-        {
-          creatorId: userId
-        },
-        {
-          members: {
-            some: {
-              memberId: userId
-            }
-          }
+      members: {
+        some: {
+          memberId: userId
         }
-      ]
+      }
     },
     select: {
       id: true,

server/api/admin/hunt/[huntId]/index.post.ts

@@ -4,9 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({ status: 403, statusText: 'Not allowed!' });
-  }
   const userId = user.user.id;
   const { huntId } = await useValidatedParams(
     event,
@@ -42,18 +39,11 @@ export default defineEventHandler(async (event) => {
     where: {
       id: huntId,
       updatedAt,
-      OR: [
-        {
-          creatorId: userId
-        },
-        {
-          members: {
-            some: {
-              memberId: userId
-            }
-          }
+      members: {
+        some: {
+          memberId: userId
         }
-      ]
+      }
     },
     data
   });

server/api/admin/hunt/[huntId]/member.delete.ts

@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
-
   const { huntId } = await useValidatedParams(
     event,
     z.object({
@@ -25,26 +18,37 @@ export default defineEventHandler(async (event) => {
     })
   );
 
+  const hunt = await prisma.hunt.findUnique({
+    where: {
+      id: huntId,
+      members: {
+        some: {
+          memberId: user.user.id
+        }
+      }
+    },
+    select: {
+      creatorId: true
+    }
+  });
+
+  if (!hunt) {
+    throw createError({ status: 404, statusText: 'Not found!' });
+  }
+
+  if (hunt.creatorId === userId) {
+    throw createError({
+      status: 403,
+      statusText: 'Cannot remove the hunt creator!'
+    });
+  }
+
   try {
     await prisma.huntMember.delete({
       where: {
         memberId_huntId: {
           memberId: userId,
           huntId
-        },
-        hunt: {
-          OR: [
-            {
-              creatorId: user.user.id
-            },
-            {
-              members: {
-                some: {
-                  memberId: user.user.id
-                }
-              }
-            }
-          ]
         }
       },
       select: {

server/api/admin/hunt/[huntId]/member.post.ts

@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
-
   const { huntId } = await useValidatedParams(
     event,
     z.object({
@@ -28,18 +21,11 @@ export default defineEventHandler(async (event) => {
   const hunt = await prisma.hunt.findUnique({
     where: {
       id: huntId,
-      OR: [
-        {
-          creatorId: user.user.id
-        },
-        {
-          members: {
-            some: {
-              memberId: user.user.id
-            }
-          }
+      members: {
+        some: {
+          memberId: user.user.id
         }
-      ]
+      }
     },
     select: {
       id: true,
@@ -61,8 +47,7 @@ export default defineEventHandler(async (event) => {
 
   const newUser = await prisma.user.findUnique({
     select: {
-      id: true,
-      role: true
+      id: true
     },
     where: {
       id: userId,
@@ -101,16 +86,6 @@ export default defineEventHandler(async (event) => {
       memberId: newUser.id
     }
   });
-  if (newUser.role !== 'ADMIN') {
-    await prisma.user.update({
-      where: {
-        id: newUser.id
-      },
-      data: {
-        role: 'ADMIN'
-      }
-    });
-  }
 
   return { success: true };
 });

server/api/admin/hunt/[huntId]/teamless.get.ts

@@ -4,12 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
   const userId = user.user.id;
   const { huntId } = await useValidatedParams(
     event,
@@ -20,18 +14,11 @@ export default defineEventHandler(async (event) => {
   const hunt = await prisma.hunt.findUnique({
     where: {
       id: huntId,
-      OR: [
-        {
-          creatorId: userId
-        },
-        {
-          members: {
-            some: {
-              memberId: userId
-            }
-          }
+      members: {
+        some: {
+          memberId: userId
         }
-      ]
+      }
     },
     select: { id: true }
   });

server/api/admin/hunt/[huntId]/teams.get.ts

@@ -4,12 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
   const userId = user.user.id;
   const { huntId } = await useValidatedParams(
     event,
@@ -21,18 +15,11 @@ export default defineEventHandler(async (event) => {
   const _hunt = await prisma.hunt.findUnique({
     where: {
       id: huntId,
-      OR: [
-        {
-          creatorId: userId
-        },
-        {
-          members: {
-            some: {
-              memberId: userId
-            }
-          }
+      members: {
+        some: {
+          memberId: userId
         }
-      ]
+      }
     },
     select: {
       id: true,

server/api/admin/quest/[questId]/index.get.ts

@@ -4,9 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({ status: 403, statusText: 'Not allowed!' });
-  }
   const userId = user.user.id;
   const { questId } = await useValidatedParams(
     event,
@@ -18,22 +15,13 @@ export default defineEventHandler(async (event) => {
   const quest = await prisma.huntQuest.findUnique({
     where: {
       id: questId,
-      OR: [
-        {
-          hunt: {
-            creatorId: userId
-          }
-        },
-        {
-          hunt: {
-            members: {
-              some: {
-                memberId: userId
-              }
-            }
+      hunt: {
+        members: {
+          some: {
+            memberId: userId
           }
         }
-      ]
+      }
     },
     omit: {
       huntId: true,

server/api/admin/team/[teamId]/add.post.ts

@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
-
   const { teamId } = await useValidatedParams(
     event,
     z.object({
@@ -29,18 +22,11 @@ export default defineEventHandler(async (event) => {
     where: {
       id: teamId,
       hunt: {
-        OR: [
-          {
-            creatorId: user.user.id
-          },
-          {
-            members: {
-              some: {
-                memberId: user.user.id
-              }
-            }
+        members: {
+          some: {
+            memberId: user.user.id
           }
-        ]
+        }
       }
     },
     select: {

server/api/admin/team/[teamId]/index.delete.ts

@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
-
   const { teamId } = await useValidatedParams(
     event,
     z.object({
@@ -23,18 +16,11 @@ export default defineEventHandler(async (event) => {
       where: {
         id: teamId,
         hunt: {
-          OR: [
-            {
-              creatorId: user.user.id
-            },
-            {
-              members: {
-                some: {
-                  memberId: user.user.id
-                }
-              }
+          members: {
+            some: {
+              memberId: user.user.id
             }
-          ]
+          }
         }
       }
     });

server/api/admin/team/[teamId]/kick.post.ts

@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
-
   const { teamId } = await useValidatedParams(
     event,
     z.object({
@@ -34,18 +27,11 @@ export default defineEventHandler(async (event) => {
         },
         team: {
           hunt: {
-            OR: [
-              {
-                creatorId: user.user.id
-              },
-              {
-                members: {
-                  some: {
-                    memberId: user.user.id
-                  }
-                }
+            members: {
+              some: {
+                memberId: user.user.id
               }
-            ]
+            }
           }
         }
       },