Pascal
cfda014760
- Remove explicit ADMIN role checks in API handlers - Replace combined creator/member role checks with membership-only filters - Update seed data roles to reflect changed authorization logic - Add migration to insert hunt creators as members for consistent checks - Prevent removal of hunt creator as a member with new explicit check - Adjust related user role updates and queries accordingly - Upgrade dependencies including nuxt and zod for compatibility
76 lines
1.5 KiB
TypeScript
76 lines
1.5 KiB
TypeScript
import { useValidatedParams, z, zh } from 'h3-zod';
|
|
import { randomUUID } from 'node:crypto';
|
|
import prisma from '~~/lib/prisma';
|
|
import { minioClient, s3Bucket, s3Host } from '~~/lib/s3';
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
const user = await requireUserSession(event);
|
|
|
|
const userId = user.user.id;
|
|
const { huntId } = await useValidatedParams(
|
|
event,
|
|
z.object({
|
|
huntId: zh.numAsString
|
|
})
|
|
);
|
|
|
|
const hunt = await prisma.hunt.findUnique({
|
|
where: {
|
|
id: huntId,
|
|
members: {
|
|
some: {
|
|
memberId: userId
|
|
}
|
|
}
|
|
},
|
|
select: {
|
|
id: true
|
|
}
|
|
});
|
|
if (!hunt) {
|
|
throw createError({ status: 404, statusText: 'Not found!' });
|
|
}
|
|
|
|
const body = await readFormData(event);
|
|
const formDataObj = Object.fromEntries(body.entries());
|
|
|
|
const { image } = z
|
|
.object({
|
|
image: z
|
|
.file()
|
|
.mime(['image/png', 'image/jpeg', 'image/jpg'])
|
|
.max(10_000_000)
|
|
})
|
|
.parse(formDataObj);
|
|
|
|
const uuid = randomUUID();
|
|
await minioClient.putObject(
|
|
s3Bucket,
|
|
uuid,
|
|
Buffer.from(await image.arrayBuffer()),
|
|
undefined,
|
|
{
|
|
'Cache-Control': 'public, max-age=31536000, immutable',
|
|
'Content-Type': image.type
|
|
}
|
|
);
|
|
|
|
await prisma.hunt.update({
|
|
where: {
|
|
id: huntId
|
|
},
|
|
data: {
|
|
picture: {
|
|
create: {
|
|
creatorId: userId,
|
|
url: `https://${s3Bucket}.${s3Host}/${uuid}`,
|
|
uuid,
|
|
huntId
|
|
}
|
|
}
|
|
}
|
|
});
|
|
|
|
return { success: true };
|
|
});
|