Pascal/pichunt
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(auth): simplify authorization checks to use membership only

Browse Source 
- Remove explicit ADMIN role checks in API handlers
- Replace combined creator/member role checks with membership-only filters
- Update seed data roles to reflect changed authorization logic
- Add migration to insert hunt creators as members for consistent checks
- Prevent removal of hunt creator as a member with new explicit check
- Adjust related user role updates and queries accordingly
- Upgrade dependencies including nuxt and zod for compatibility
This commit is contained in:
Pascal
2026-07-30 21:59:36 +02:00
parent a6053855b8
commit cfda014760
18 changed files with 2598 additions and 487 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/api/admin/hunt/[huntId]/image.delete.ts
+4 -17
View File
@@ -4,12 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const userId = user.user.id;
const { huntId } = await useValidatedParams(
event,
@@ -21,18 +15,11 @@ export default defineEventHandler(async (event) => {
const hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
OR: [
{
creatorId: userId
},
{
members: {
some: {
memberId: userId
}
}
members: {
some: {
memberId: userId
}
]
}
},
select: {
id: true
server/api/admin/hunt/[huntId]/image.post.ts
+4 -17
View File
@@ -6,12 +6,6 @@ import { minioClient, s3Bucket, s3Host } from '~~/lib/s3';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const userId = user.user.id;
const { huntId } = await useValidatedParams(
event,
@@ -23,18 +17,11 @@ export default defineEventHandler(async (event) => {
const hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
OR: [
{
creatorId: userId
},
{
members: {
some: {
memberId: userId
}
}
members: {
some: {
memberId: userId
}
]
}
},
select: {
id: true
server/api/admin/hunt/[huntId]/index.get.ts
+4 -17
View File
@@ -5,12 +5,6 @@ import { sendJson } from '~~/server/utils/json';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const userId = user.user.id;
const { huntId } = await useValidatedParams(
event,
@@ -22,18 +16,11 @@ export default defineEventHandler(async (event) => {
const hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
OR: [
{
creatorId: userId
},
{
members: {
some: {
memberId: userId
}
}
members: {
some: {
memberId: userId
}
]
}
},
select: {
id: true,
server/api/admin/hunt/[huntId]/index.post.ts
+4 -14
View File
@@ -4,9 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({ status: 403, statusText: 'Not allowed!' });
}
const userId = user.user.id;
const { huntId } = await useValidatedParams(
event,
@@ -42,18 +39,11 @@ export default defineEventHandler(async (event) => {
where: {
id: huntId,
updatedAt,
OR: [
{
creatorId: userId
},
{
members: {
some: {
memberId: userId
}
}
members: {
some: {
memberId: userId
}
]
}
},
data
});
server/api/admin/hunt/[huntId]/member.delete.ts
+25 -21
View File
@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const { huntId } = await useValidatedParams(
event,
z.object({
@@ -25,26 +18,37 @@ export default defineEventHandler(async (event) => {
})
);
const hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
members: {
some: {
memberId: user.user.id
}
}
},
select: {
creatorId: true
}
});
if (!hunt) {
throw createError({ status: 404, statusText: 'Not found!' });
}
if (hunt.creatorId === userId) {
throw createError({
status: 403,
statusText: 'Cannot remove the hunt creator!'
});
}
try {
await prisma.huntMember.delete({
where: {
memberId_huntId: {
memberId: userId,
huntId
},
hunt: {
OR: [
{
creatorId: user.user.id
},
{
members: {
some: {
memberId: user.user.id
}
}
}
]
}
},
select: {
server/api/admin/hunt/[huntId]/member.post.ts
+5 -30
View File
@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const { huntId } = await useValidatedParams(
event,
z.object({
@@ -28,18 +21,11 @@ export default defineEventHandler(async (event) => {
const hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
OR: [
{
creatorId: user.user.id
},
{
members: {
some: {
memberId: user.user.id
}
}
members: {
some: {
memberId: user.user.id
}
]
}
},
select: {
id: true,
@@ -61,8 +47,7 @@ export default defineEventHandler(async (event) => {
const newUser = await prisma.user.findUnique({
select: {
id: true,
role: true
id: true
},
where: {
id: userId,
@@ -101,16 +86,6 @@ export default defineEventHandler(async (event) => {
memberId: newUser.id
}
});
if (newUser.role !== 'ADMIN') {
await prisma.user.update({
where: {
id: newUser.id
},
data: {
role: 'ADMIN'
}
});
}
return { success: true };
});
server/api/admin/hunt/[huntId]/teamless.get.ts
+4 -17
View File
@@ -4,12 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const userId = user.user.id;
const { huntId } = await useValidatedParams(
event,
@@ -20,18 +14,11 @@ export default defineEventHandler(async (event) => {
const hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
OR: [
{
creatorId: userId
},
{
members: {
some: {
memberId: userId
}
}
members: {
some: {
memberId: userId
}
]
}
},
select: { id: true }
});
server/api/admin/hunt/[huntId]/teams.get.ts
+4 -17
View File
@@ -4,12 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const userId = user.user.id;
const { huntId } = await useValidatedParams(
event,
@@ -21,18 +15,11 @@ export default defineEventHandler(async (event) => {
const _hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
OR: [
{
creatorId: userId
},
{
members: {
some: {
memberId: userId
}
}
members: {
some: {
memberId: userId
}
]
}
},
select: {
id: true,