Files
pichunt/server/api/admin/team/[teamId]/add.post.ts
T
Pascal cfda014760 refactor(auth): simplify authorization checks to use membership only
- Remove explicit ADMIN role checks in API handlers
- Replace combined creator/member role checks with membership-only filters
- Update seed data roles to reflect changed authorization logic
- Add migration to insert hunt creators as members for consistent checks
- Prevent removal of hunt creator as a member with new explicit check
- Adjust related user role updates and queries accordingly
- Upgrade dependencies including nuxt and zod for compatibility
2026-07-30 21:59:36 +02:00

97 lines
1.7 KiB
TypeScript

import { useValidatedBody, useValidatedParams, z, zh } from 'h3-zod';
import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
const { teamId } = await useValidatedParams(
event,
z.object({
teamId: zh.numAsString
})
);
const { userId } = await useValidatedBody(
event,
z.object({
userId: z.int().gt(0)
})
);
const team = await prisma.huntTeam.findUnique({
where: {
id: teamId,
hunt: {
members: {
some: {
memberId: user.user.id
}
}
}
},
select: {
id: true,
ownerId: true,
huntId: true,
members: {
select: {
memberId: true
},
where: {
memberId: userId
},
take: 1
}
}
});
if (!team) {
throw createError({ status: 404, statusText: 'Not found!' });
}
const huntId = team.huntId;
const newUser = await prisma.user.findUnique({
select: {
id: true
},
where: {
id: userId,
teamsOwner: {
none: {
huntId
}
},
teamsMember: {
none: {
team: {
huntId
}
}
},
huntsMember: {
none: {
huntId
}
},
huntsCreated: {
none: {
id: huntId
}
}
}
});
if (!newUser) {
throw createError({ status: 409, statusText: 'User is already member!' });
}
await prisma.teamMember.create({
data: {
teamId: team.id,
memberId: newUser.id
}
});
return { success: true };
});