rick/rosterchirp-dev
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.9.44 permissions changes

Browse Source
This commit is contained in:
Ricky Stretch
2026-03-16 20:15:28 -04:00
parent 177c05d7da
commit ccfccaac0c
11 changed files with 52 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
backend/src/middleware/auth.js
View File

@@ -43,15 +43,18 @@ function adminMiddleware(req, res, next) {
next();
}
// Allows admins OR members of groups designated as Group Managers or Schedule Managers
// Allows admins OR members of groups designated as Tool Managers
function teamManagerMiddleware(req, res, next) {
if (req.user?.role === 'admin') return next();
const db = getDb();
const gmSetting = db.prepare("SELECT value FROM settings WHERE key = 'team_group_managers'").get();
const smSetting = db.prepare("SELECT value FROM settings WHERE key = 'team_schedule_managers'").get();
// Prefer unified key, fall back to legacy keys for older installs
const tmSetting = db.prepare("SELECT value FROM settings WHERE key = 'team_tool_managers'").get();
const gmSetting = db.prepare("SELECT value FROM settings WHERE key = 'team_group_managers'").get();
const allowedGroupIds = [
...JSON.parse(gmSetting?.value || '[]'),
...JSON.parse(smSetting?.value || '[]'),
...new Set([
...JSON.parse(tmSetting?.value || '[]'),
...JSON.parse(gmSetting?.value || '[]'),
])
];
if (allowedGroupIds.length === 0) return res.status(403).json({ error: 'Access denied' });
const member = db.prepare(`