refactor(auth): simplify authorization checks to use membership only

- Remove explicit ADMIN role checks in API handlers
- Replace combined creator/member role checks with membership-only filters
- Update seed data roles to reflect changed authorization logic
- Add migration to insert hunt creators as members for consistent checks
- Prevent removal of hunt creator as a member with new explicit check
- Adjust related user role updates and queries accordingly
- Upgrade dependencies including nuxt and zod for compatibility

package.json

@@ -33,7 +33,7 @@
     "eslint": "^9.0.0",
     "h3-zod": "^0.5.3",
     "minio": "^8.0.5",
-    "nuxt": "^4.0.1",
+    "nuxt": "4.1.0",
     "nuxt-auth-utils": "^0.5.22",
     "pinia": "^3.0.3",
     "pinia-plugin-persistedstate": "^4.5.0",
@@ -43,10 +43,10 @@
     "vue": "^3.5.18",
     "vue-matomo": "^4.2.0",
     "vue-router": "^4.5.1",
-    "zod": "^4.0.0"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@nuxt/devtools": "^2.6.2",
+    "@nuxt/devtools": "^2.6.4",
     "@types/bun": "^1.2.20",
     "prettier": "^3.6.2",
     "prettier-plugin-organize-imports": "^4.2.0",

prisma/migrations/20260730000000_add_creators_as_hunt_members/migration.sql

@@ -0,0 +1,8 @@
+-- Add hunt creators as HuntMembers so authorization only needs membership check
+INSERT INTO "HuntMember" ("huntId", "memberId", "createdAt")
+SELECT h."id", h."creatorId", NOW()
+FROM "Hunt" h
+WHERE NOT EXISTS (
+  SELECT 1 FROM "HuntMember" hm
+  WHERE hm."huntId" = h."id" AND hm."memberId" = h."creatorId"
+);

prisma/seed/hunt.ts

@@ -14,7 +14,7 @@ async function main() {
       create: {
         email: 'admin@mail.com',
         name: 'Admin user',
-        role: 'ADMIN',
+        role: 'CREATOR',
         password,
         emailConfirmedAt: new Date()
       }
@@ -25,7 +25,7 @@ async function main() {
       create: {
         email: 'team@mail.com',
         name: 'Hunt member',
-        role: 'ADMIN',
+        role: 'USER',
         password,
         emailConfirmedAt: new Date()
       }
@@ -202,6 +202,9 @@ async function main() {
         creatorId: admin.id,
         members: {
           create: [
+            {
+              memberId: admin.id
+            },
             {
               memberId: huntMember.id
             }

server/api/admin/answer/[answerId]/review.post.ts

@@ -4,9 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({ status: 403, statusText: 'Not allowed!' });
-  }
   const userId = user.user.id;
   const { answerId } = await useValidatedParams(
     event,
@@ -18,15 +15,6 @@ export default defineEventHandler(async (event) => {
   const answer = await prisma.questAnswer.findUnique({
     where: {
       id: answerId,
-      OR: [
-        {
-          quest: {
-            hunt: {
-              creatorId: userId
-            }
-          }
-        },
-        {
       quest: {
         hunt: {
           members: {
@@ -36,8 +24,6 @@ export default defineEventHandler(async (event) => {
           }
         }
       }
-        }
-      ]
     },
     select: { id: true }
   });

server/api/admin/hunt/[huntId]/image.delete.ts

@@ -4,12 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
   const userId = user.user.id;
   const { huntId } = await useValidatedParams(
     event,
@@ -21,18 +15,11 @@ export default defineEventHandler(async (event) => {
   const hunt = await prisma.hunt.findUnique({
     where: {
       id: huntId,
-      OR: [
-        {
-          creatorId: userId
-        },
-        {
       members: {
         some: {
           memberId: userId
         }
       }
-        }
-      ]
     },
     select: {
       id: true

server/api/admin/hunt/[huntId]/image.post.ts

@@ -6,12 +6,6 @@ import { minioClient, s3Bucket, s3Host } from '~~/lib/s3';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
   const userId = user.user.id;
   const { huntId } = await useValidatedParams(
     event,
@@ -23,18 +17,11 @@ export default defineEventHandler(async (event) => {
   const hunt = await prisma.hunt.findUnique({
     where: {
       id: huntId,
-      OR: [
-        {
-          creatorId: userId
-        },
-        {
       members: {
         some: {
           memberId: userId
         }
       }
-        }
-      ]
     },
     select: {
       id: true

server/api/admin/hunt/[huntId]/index.get.ts

@@ -5,12 +5,6 @@ import { sendJson } from '~~/server/utils/json';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
   const userId = user.user.id;
   const { huntId } = await useValidatedParams(
     event,
@@ -22,18 +16,11 @@ export default defineEventHandler(async (event) => {
   const hunt = await prisma.hunt.findUnique({
     where: {
       id: huntId,
-      OR: [
-        {
-          creatorId: userId
-        },
-        {
       members: {
         some: {
           memberId: userId
         }
       }
-        }
-      ]
     },
     select: {
       id: true,

server/api/admin/hunt/[huntId]/index.post.ts

@@ -4,9 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({ status: 403, statusText: 'Not allowed!' });
-  }
   const userId = user.user.id;
   const { huntId } = await useValidatedParams(
     event,
@@ -42,18 +39,11 @@ export default defineEventHandler(async (event) => {
     where: {
       id: huntId,
       updatedAt,
-      OR: [
-        {
-          creatorId: userId
-        },
-        {
       members: {
         some: {
           memberId: userId
         }
       }
-        }
-      ]
     },
     data
   });

server/api/admin/hunt/[huntId]/member.delete.ts

@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
-
   const { huntId } = await useValidatedParams(
     event,
     z.object({
@@ -25,26 +18,37 @@ export default defineEventHandler(async (event) => {
     })
   );
 
+  const hunt = await prisma.hunt.findUnique({
+    where: {
+      id: huntId,
+      members: {
+        some: {
+          memberId: user.user.id
+        }
+      }
+    },
+    select: {
+      creatorId: true
+    }
+  });
+
+  if (!hunt) {
+    throw createError({ status: 404, statusText: 'Not found!' });
+  }
+
+  if (hunt.creatorId === userId) {
+    throw createError({
+      status: 403,
+      statusText: 'Cannot remove the hunt creator!'
+    });
+  }
+
   try {
     await prisma.huntMember.delete({
       where: {
         memberId_huntId: {
           memberId: userId,
           huntId
-        },
-        hunt: {
-          OR: [
-            {
-              creatorId: user.user.id
-            },
-            {
-              members: {
-                some: {
-                  memberId: user.user.id
-                }
-              }
-            }
-          ]
         }
       },
       select: {

server/api/admin/hunt/[huntId]/member.post.ts

@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
-
   const { huntId } = await useValidatedParams(
     event,
     z.object({
@@ -28,18 +21,11 @@ export default defineEventHandler(async (event) => {
   const hunt = await prisma.hunt.findUnique({
     where: {
       id: huntId,
-      OR: [
-        {
-          creatorId: user.user.id
-        },
-        {
       members: {
         some: {
           memberId: user.user.id
         }
       }
-        }
-      ]
     },
     select: {
       id: true,
@@ -61,8 +47,7 @@ export default defineEventHandler(async (event) => {
 
   const newUser = await prisma.user.findUnique({
     select: {
-      id: true,
+      id: true
-      role: true
     },
     where: {
       id: userId,
@@ -101,16 +86,6 @@ export default defineEventHandler(async (event) => {
       memberId: newUser.id
     }
   });
-  if (newUser.role !== 'ADMIN') {
-    await prisma.user.update({
-      where: {
-        id: newUser.id
-      },
-      data: {
-        role: 'ADMIN'
-      }
-    });
-  }
 
   return { success: true };
 });

server/api/admin/hunt/[huntId]/teamless.get.ts

@@ -4,12 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
   const userId = user.user.id;
   const { huntId } = await useValidatedParams(
     event,
@@ -20,18 +14,11 @@ export default defineEventHandler(async (event) => {
   const hunt = await prisma.hunt.findUnique({
     where: {
       id: huntId,
-      OR: [
-        {
-          creatorId: userId
-        },
-        {
       members: {
         some: {
           memberId: userId
         }
       }
-        }
-      ]
     },
     select: { id: true }
   });

server/api/admin/hunt/[huntId]/teams.get.ts

@@ -4,12 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
   const userId = user.user.id;
   const { huntId } = await useValidatedParams(
     event,
@@ -21,18 +15,11 @@ export default defineEventHandler(async (event) => {
   const _hunt = await prisma.hunt.findUnique({
     where: {
       id: huntId,
-      OR: [
-        {
-          creatorId: userId
-        },
-        {
       members: {
         some: {
           memberId: userId
         }
       }
-        }
-      ]
     },
     select: {
       id: true,

server/api/admin/quest/[questId]/index.get.ts

@@ -4,9 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({ status: 403, statusText: 'Not allowed!' });
-  }
   const userId = user.user.id;
   const { questId } = await useValidatedParams(
     event,
@@ -18,13 +15,6 @@ export default defineEventHandler(async (event) => {
   const quest = await prisma.huntQuest.findUnique({
     where: {
       id: questId,
-      OR: [
-        {
-          hunt: {
-            creatorId: userId
-          }
-        },
-        {
       hunt: {
         members: {
           some: {
@@ -32,8 +22,6 @@ export default defineEventHandler(async (event) => {
           }
         }
       }
-        }
-      ]
     },
     omit: {
       huntId: true,

server/api/admin/team/[teamId]/add.post.ts

@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
-
   const { teamId } = await useValidatedParams(
     event,
     z.object({
@@ -29,19 +22,12 @@ export default defineEventHandler(async (event) => {
     where: {
       id: teamId,
       hunt: {
-        OR: [
-          {
-            creatorId: user.user.id
-          },
-          {
         members: {
           some: {
             memberId: user.user.id
           }
         }
       }
-        ]
-      }
     },
     select: {
       id: true,

server/api/admin/team/[teamId]/index.delete.ts

@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
-
   const { teamId } = await useValidatedParams(
     event,
     z.object({
@@ -23,19 +16,12 @@ export default defineEventHandler(async (event) => {
       where: {
         id: teamId,
         hunt: {
-          OR: [
-            {
-              creatorId: user.user.id
-            },
-            {
           members: {
             some: {
               memberId: user.user.id
             }
           }
         }
-          ]
-        }
       }
     });
   } catch (e) {

server/api/admin/team/[teamId]/kick.post.ts

@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
-
   const { teamId } = await useValidatedParams(
     event,
     z.object({
@@ -34,19 +27,12 @@ export default defineEventHandler(async (event) => {
         },
         team: {
           hunt: {
-            OR: [
-              {
-                creatorId: user.user.id
-              },
-              {
             members: {
               some: {
                 memberId: user.user.id
               }
             }
           }
-            ]
-          }
         }
       },
       select: {

shared/utils/slugcheck.test.ts

@@ -1,4 +1,3 @@
-// @ts-expect-error weird bun import with nuxt
 import { describe, expect, it } from 'bun:test';
 import { checkSlug, parseSlug, type SlugRecord } from './slugcheck';