Pascal/pichunt
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(auth): simplify authorization checks to use membership only

Browse Source 
- Remove explicit ADMIN role checks in API handlers
- Replace combined creator/member role checks with membership-only filters
- Update seed data roles to reflect changed authorization logic
- Add migration to insert hunt creators as members for consistent checks
- Prevent removal of hunt creator as a member with new explicit check
- Adjust related user role updates and queries accordingly
- Upgrade dependencies including nuxt and zod for compatibility
This commit is contained in:
Pascal
2026-07-30 21:59:36 +02:00
parent a6053855b8
commit cfda014760
18 changed files with 2598 additions and 487 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bun.lock
+2505 -240
View File
File diff suppressed because it is too large Load Diff
package.json
+3 -3
View File
@@ -33,7 +33,7 @@
"eslint": "^9.0.0",
"h3-zod": "^0.5.3",
"minio": "^8.0.5",
"nuxt": "^4.0.1",
"nuxt": "4.1.0",
"nuxt-auth-utils": "^0.5.22",
"pinia": "^3.0.3",
"pinia-plugin-persistedstate": "^4.5.0",
@@ -43,10 +43,10 @@
"vue": "^3.5.18",
"vue-matomo": "^4.2.0",
"vue-router": "^4.5.1",
"zod": "^4.0.0"
"zod": "^4.4.3"
},
"devDependencies": {
"@nuxt/devtools": "^2.6.2",
"@nuxt/devtools": "^2.6.4",
"@types/bun": "^1.2.20",
"prettier": "^3.6.2",
"prettier-plugin-organize-imports": "^4.2.0",
prisma/migrations/20260730000000_add_creators_as_hunt_members/migration.sql
+8
View File
@@ -0,0 +1,8 @@
-- Add hunt creators as HuntMembers so authorization only needs membership check
INSERT INTO "HuntMember" ("huntId", "memberId", "createdAt")
SELECT h."id", h."creatorId", NOW()
FROM "Hunt" h
WHERE NOT EXISTS (
SELECT 1 FROM "HuntMember" hm
WHERE hm."huntId" = h."id" AND hm."memberId" = h."creatorId"
);
prisma/seed/hunt.ts
+5 -2
View File
@@ -14,7 +14,7 @@ async function main() {
create: {
email: 'admin@mail.com',
name: 'Admin user',
role: 'ADMIN',
role: 'CREATOR',
password,
emailConfirmedAt: new Date()
}
@@ -25,7 +25,7 @@ async function main() {
create: {
email: 'team@mail.com',
name: 'Hunt member',
role: 'ADMIN',
role: 'USER',
password,
emailConfirmedAt: new Date()
}
@@ -202,6 +202,9 @@ async function main() {
creatorId: admin.id,
members: {
create: [
{
memberId: admin.id
},
{
memberId: huntMember.id
}
server/api/admin/answer/[answerId]/review.post.ts
+6 -20
View File
@@ -4,9 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({ status: 403, statusText: 'Not allowed!' });
}
const userId = user.user.id;
const { answerId } = await useValidatedParams(
event,
@@ -18,26 +15,15 @@ export default defineEventHandler(async (event) => {
const answer = await prisma.questAnswer.findUnique({
where: {
id: answerId,
OR: [
{
quest: {
hunt: {
creatorId: userId
}
}
},
{
quest: {
hunt: {
members: {
some: {
memberId: userId
}
}
quest: {
hunt: {
members: {
some: {
memberId: userId
}
}
}
]
}
},
select: { id: true }
});
server/api/admin/hunt/[huntId]/image.delete.ts
+4 -17
View File
@@ -4,12 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const userId = user.user.id;
const { huntId } = await useValidatedParams(
event,
@@ -21,18 +15,11 @@ export default defineEventHandler(async (event) => {
const hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
OR: [
{
creatorId: userId
},
{
members: {
some: {
memberId: userId
}
}
members: {
some: {
memberId: userId
}
]
}
},
select: {
id: true
server/api/admin/hunt/[huntId]/image.post.ts
+4 -17
View File
@@ -6,12 +6,6 @@ import { minioClient, s3Bucket, s3Host } from '~~/lib/s3';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const userId = user.user.id;
const { huntId } = await useValidatedParams(
event,
@@ -23,18 +17,11 @@ export default defineEventHandler(async (event) => {
const hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
OR: [
{
creatorId: userId
},
{
members: {
some: {
memberId: userId
}
}
members: {
some: {
memberId: userId
}
]
}
},
select: {
id: true
server/api/admin/hunt/[huntId]/index.get.ts
+4 -17
View File
@@ -5,12 +5,6 @@ import { sendJson } from '~~/server/utils/json';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const userId = user.user.id;
const { huntId } = await useValidatedParams(
event,
@@ -22,18 +16,11 @@ export default defineEventHandler(async (event) => {
const hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
OR: [
{
creatorId: userId
},
{
members: {
some: {
memberId: userId
}
}
members: {
some: {
memberId: userId
}
]
}
},
select: {
id: true,
server/api/admin/hunt/[huntId]/index.post.ts
+4 -14
View File
@@ -4,9 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({ status: 403, statusText: 'Not allowed!' });
}
const userId = user.user.id;
const { huntId } = await useValidatedParams(
event,
@@ -42,18 +39,11 @@ export default defineEventHandler(async (event) => {
where: {
id: huntId,
updatedAt,
OR: [
{
creatorId: userId
},
{
members: {
some: {
memberId: userId
}
}
members: {
some: {
memberId: userId
}
]
}
},
data
});
server/api/admin/hunt/[huntId]/member.delete.ts
+25 -21
View File
@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const { huntId } = await useValidatedParams(
event,
z.object({
@@ -25,26 +18,37 @@ export default defineEventHandler(async (event) => {
})
);
const hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
members: {
some: {
memberId: user.user.id
}
}
},
select: {
creatorId: true
}
});
if (!hunt) {
throw createError({ status: 404, statusText: 'Not found!' });
}
if (hunt.creatorId === userId) {
throw createError({
status: 403,
statusText: 'Cannot remove the hunt creator!'
});
}
try {
await prisma.huntMember.delete({
where: {
memberId_huntId: {
memberId: userId,
huntId
},
hunt: {
OR: [
{
creatorId: user.user.id
},
{
members: {
some: {
memberId: user.user.id
}
}
}
]
}
},
select: {
server/api/admin/hunt/[huntId]/member.post.ts
+5 -30
View File
@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const { huntId } = await useValidatedParams(
event,
z.object({
@@ -28,18 +21,11 @@ export default defineEventHandler(async (event) => {
const hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
OR: [
{
creatorId: user.user.id
},
{
members: {
some: {
memberId: user.user.id
}
}
members: {
some: {
memberId: user.user.id
}
]
}
},
select: {
id: true,
@@ -61,8 +47,7 @@ export default defineEventHandler(async (event) => {
const newUser = await prisma.user.findUnique({
select: {
id: true,
role: true
id: true
},
where: {
id: userId,
@@ -101,16 +86,6 @@ export default defineEventHandler(async (event) => {
memberId: newUser.id
}
});
if (newUser.role !== 'ADMIN') {
await prisma.user.update({
where: {
id: newUser.id
},
data: {
role: 'ADMIN'
}
});
}
return { success: true };
});
server/api/admin/hunt/[huntId]/teamless.get.ts
+4 -17
View File
@@ -4,12 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const userId = user.user.id;
const { huntId } = await useValidatedParams(
event,
@@ -20,18 +14,11 @@ export default defineEventHandler(async (event) => {
const hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
OR: [
{
creatorId: userId
},
{
members: {
some: {
memberId: userId
}
}
members: {
some: {
memberId: userId
}
]
}
},
select: { id: true }
});
server/api/admin/hunt/[huntId]/teams.get.ts
+4 -17
View File
@@ -4,12 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const userId = user.user.id;
const { huntId } = await useValidatedParams(
event,
@@ -21,18 +15,11 @@ export default defineEventHandler(async (event) => {
const _hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
OR: [
{
creatorId: userId
},
{
members: {
some: {
memberId: userId
}
}
members: {
some: {
memberId: userId
}
]
}
},
select: {
id: true,
server/api/admin/quest/[questId]/index.get.ts
+5 -17
View File
@@ -4,9 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({ status: 403, statusText: 'Not allowed!' });
}
const userId = user.user.id;
const { questId } = await useValidatedParams(
event,
@@ -18,22 +15,13 @@ export default defineEventHandler(async (event) => {
const quest = await prisma.huntQuest.findUnique({
where: {
id: questId,
OR: [
{
hunt: {
creatorId: userId
}
},
{
hunt: {
members: {
some: {
memberId: userId
}
}
hunt: {
members: {
some: {
memberId: userId
}
}
]
}
},
omit: {
huntId: true,
server/api/admin/team/[teamId]/add.post.ts
+4 -18
View File
@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const { teamId } = await useValidatedParams(
event,
z.object({
@@ -29,18 +22,11 @@ export default defineEventHandler(async (event) => {
where: {
id: teamId,
hunt: {
OR: [
{
creatorId: user.user.id
},
{
members: {
some: {
memberId: user.user.id
}
}
members: {
some: {
memberId: user.user.id
}
]
}
}
},
select: {
server/api/admin/team/[teamId]/index.delete.ts
+4 -18
View File
@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const { teamId } = await useValidatedParams(
event,
z.object({
@@ -23,18 +16,11 @@ export default defineEventHandler(async (event) => {
where: {
id: teamId,
hunt: {
OR: [
{
creatorId: user.user.id
},
{
members: {
some: {
memberId: user.user.id
}
}
members: {
some: {
memberId: user.user.id
}
]
}
}
}
});
server/api/admin/team/[teamId]/kick.post.ts
+4 -18
View File
@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
if (user.user.role !== 'ADMIN') {
throw createError({
status: 403,
statusText: 'Not allowed!'
});
}
const { teamId } = await useValidatedParams(
event,
z.object({
@@ -34,18 +27,11 @@ export default defineEventHandler(async (event) => {
},
team: {
hunt: {
OR: [
{
creatorId: user.user.id
},
{
members: {
some: {
memberId: user.user.id
}
}
members: {
some: {
memberId: user.user.id
}
]
}
}
}
},
shared/utils/slugcheck.test.ts
-1
View File
@@ -1,4 +1,3 @@
// @ts-expect-error weird bun import with nuxt
import { describe, expect, it } from 'bun:test';
import { checkSlug, parseSlug, type SlugRecord } from './slugcheck';