Leahnaya/hackdex-website
1
0
Fork 0
mirror of https://github.com/Hackdex-App/hackdex-website.git synced 2026-08-22 08:34:13 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix non-admin hack actions permissions

Browse Source
This commit is contained in:
jschoeny
2026-01-03 08:15:08 -10:00
parent 0b496d04ff
commit d90648824b
1 changed files with 32 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

80
src/app/hack/[slug]/actions.ts
View File

@@ -452,12 +452,10 @@ export async function archivePatchVersion(slug: string, patchId: number): Promis
// Check permissions: creator first (optimization), then admin
if (!canEditAsCreator(hack, user.id)) {
return { ok: false, error: "Forbidden" };
}
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
}
}
// Cannot archive current_patch
@@ -503,12 +501,10 @@ export async function restorePatchVersion(slug: string, patchId: number): Promis
// Check permissions: creator first (optimization), then admin
if (!canEditAsCreator(hack, user.id)) {
return { ok: false, error: "Forbidden" };
}
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
}
}
// Verify patch belongs to this hack
@@ -549,12 +545,10 @@ export async function rollbackToVersion(slug: string, patchId: number): Promise<
// Check permissions: creator first (optimization), then admin
if (!canEditAsCreator(hack, user.id)) {
return { ok: false, error: "Forbidden" };
}
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
}
}
// Verify patch belongs to this hack and get its created_at
@@ -605,12 +599,10 @@ export async function updatePatchChangelog(slug: string, patchId: number, change
// Check permissions: creator first (optimization), then admin
if (!canEditAsCreator(hack, user.id)) {
return { ok: false, error: "Forbidden" };
}
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
}
}
// Verify patch belongs to this hack
@@ -653,12 +645,10 @@ export async function updatePatchVersion(slug: string, patchId: number, version:
// Check permissions: creator first (optimization), then admin
if (!canEditAsCreator(hack, user.id)) {
return { ok: false, error: "Forbidden" };
}
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
}
}
// Verify patch belongs to this hack
@@ -723,12 +713,10 @@ export async function publishPatchVersion(slug: string, patchId: number): Promis
// Check permissions: creator first (optimization), then admin
if (!canEditAsCreator(hack, user.id)) {
return { ok: false, error: "Forbidden" };
}
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
}
}
// Verify patch belongs to this hack and get its created_at
@@ -798,12 +786,10 @@ export async function reuploadPatchVersion(
// Check permissions: creator first (optimization), then admin
if (!canEditAsCreator(hack, user.id)) {
return { ok: false, error: "Forbidden" };
}
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
}
}
// Verify patch belongs to this hack
@@ -843,12 +829,10 @@ export async function confirmReuploadPatchVersion(
// Check permissions: creator first (optimization), then admin
if (!canEditAsCreator(hack, user.id)) {
return { ok: false, error: "Forbidden" };
}
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
if (!editableAsAdmin) {
return { ok: false, error: "Forbidden" };
}
}
// Verify patch belongs to this hack