Files
pichunt/server/api/admin/hunt/[huntId]/teamless.get.ts
T
Pascal cfda014760 refactor(auth): simplify authorization checks to use membership only
- Remove explicit ADMIN role checks in API handlers
- Replace combined creator/member role checks with membership-only filters
- Update seed data roles to reflect changed authorization logic
- Add migration to insert hunt creators as members for consistent checks
- Prevent removal of hunt creator as a member with new explicit check
- Adjust related user role updates and queries accordingly
- Upgrade dependencies including nuxt and zod for compatibility
2026-07-30 21:59:36 +02:00

76 lines
1.3 KiB
TypeScript

import { useValidatedParams, useValidatedQuery, z, zh } from 'h3-zod';
import prisma from '~~/lib/prisma';
export default defineEventHandler(async (event) => {
const user = await requireUserSession(event);
const userId = user.user.id;
const { huntId } = await useValidatedParams(
event,
z.object({
huntId: zh.numAsString
})
);
const hunt = await prisma.hunt.findUnique({
where: {
id: huntId,
members: {
some: {
memberId: userId
}
}
},
select: { id: true }
});
if (!hunt) {
throw createError({ status: 404, statusText: 'Not found!' });
}
const { email } = await useValidatedQuery(
event,
z.object({
email: z.string().trim().default('')
})
);
return prisma.user.findMany({
select: {
email: true,
name: true,
id: true
},
where: {
email: {
contains: email
},
teamsOwner: {
none: {
huntId
}
},
teamsMember: {
none: {
team: {
huntId
}
}
},
huntsMember: {
none: {
huntId
}
},
huntsCreated: {
none: {
id: huntId
}
}
},
take: 10,
orderBy: {
createdAt: 'desc'
}
});
});