Files
Pascal cfda014760 refactor(auth): simplify authorization checks to use membership only
- Remove explicit ADMIN role checks in API handlers
- Replace combined creator/member role checks with membership-only filters
- Update seed data roles to reflect changed authorization logic
- Add migration to insert hunt creators as members for consistent checks
- Prevent removal of hunt creator as a member with new explicit check
- Adjust related user role updates and queries accordingly
- Upgrade dependencies including nuxt and zod for compatibility
2026-07-30 21:59:36 +02:00

97 lines
1.9 KiB
TypeScript

import { useValidatedParams, z, zh } from 'h3-zod';
import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
const userId = user.user.id;
const { huntId } = await useValidatedParams(
event,
z.object({
huntId: zh.numAsString
})
);
const _hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
members: {
some: {
memberId: userId
}
}
},
select: {
id: true,
name_de: true,
name_en: true,
teams: {
omit: {
huntId: true,
ownerId: true
},
orderBy: {
createdAt: 'desc'
},
include: {
owner: {
select: {
id: true,
name: true,
email: true
}
},
_count: {
select: {
answers: true
}
},
answers: {
select: {
review: {
select: {
score: true
}
}
},
where: {
review: {
score: {
gt: 0
}
}
}
},
members: {
select: {
createdAt: true,
member: {
select: {
id: true,
name: true,
email: true
}
}
}
}
}
}
}
});
if (!_hunt) {
throw createError({ status: 404, statusText: 'Not found!' });
}
const { teams, ...hunt } = _hunt;
return {
teams: teams
.map(({ answers, ...t }) => ({
...t,
score: answers.reduce((sum, a) => sum + (a.review?.score || 0), 0)
}))
.toSorted((a, b) => b.score - a.score),
...hunt
};
});