From d90648824b20a462807bc44402aaf4475b24196a Mon Sep 17 00:00:00 2001
From: jschoeny <jared@schoeny.com>
Date: Sat, 3 Jan 2026 08:15:08 -1000
Subject: [PATCH] Fix non-admin hack actions permissions

---
 src/app/hack/[slug]/actions.ts | 80 ++++++++++++++--------------------
 1 file changed, 32 insertions(+), 48 deletions(-)

diff --git a/src/app/hack/[slug]/actions.ts b/src/app/hack/[slug]/actions.ts
index 9ac4673..fc76a37 100644
--- a/src/app/hack/[slug]/actions.ts
+++ b/src/app/hack/[slug]/actions.ts
@@ -452,12 +452,10 @@ export async function archivePatchVersion(slug: string, patchId: number): Promis
 
   // Check permissions: creator first (optimization), then admin
   if (!canEditAsCreator(hack, user.id)) {
-    return { ok: false, error: "Forbidden" };
-  }
-
-  const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
-  if (!editableAsAdmin) {
-    return { ok: false, error: "Forbidden" };
+    const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
+    if (!editableAsAdmin) {
+      return { ok: false, error: "Forbidden" };
+    }
   }
 
   // Cannot archive current_patch
@@ -503,12 +501,10 @@ export async function restorePatchVersion(slug: string, patchId: number): Promis
 
   // Check permissions: creator first (optimization), then admin
   if (!canEditAsCreator(hack, user.id)) {
-    return { ok: false, error: "Forbidden" };
-  }
-
-  const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
-  if (!editableAsAdmin) {
-    return { ok: false, error: "Forbidden" };
+    const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
+    if (!editableAsAdmin) {
+      return { ok: false, error: "Forbidden" };
+    }
   }
 
   // Verify patch belongs to this hack
@@ -549,12 +545,10 @@ export async function rollbackToVersion(slug: string, patchId: number): Promise<
 
   // Check permissions: creator first (optimization), then admin
   if (!canEditAsCreator(hack, user.id)) {
-    return { ok: false, error: "Forbidden" };
-  }
-
-  const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
-  if (!editableAsAdmin) {
-    return { ok: false, error: "Forbidden" };
+    const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
+    if (!editableAsAdmin) {
+      return { ok: false, error: "Forbidden" };
+    }
   }
 
   // Verify patch belongs to this hack and get its created_at
@@ -605,12 +599,10 @@ export async function updatePatchChangelog(slug: string, patchId: number, change
 
   // Check permissions: creator first (optimization), then admin
   if (!canEditAsCreator(hack, user.id)) {
-    return { ok: false, error: "Forbidden" };
-  }
-
-  const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
-  if (!editableAsAdmin) {
-    return { ok: false, error: "Forbidden" };
+    const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
+    if (!editableAsAdmin) {
+      return { ok: false, error: "Forbidden" };
+    }
   }
 
   // Verify patch belongs to this hack
@@ -653,12 +645,10 @@ export async function updatePatchVersion(slug: string, patchId: number, version:
 
   // Check permissions: creator first (optimization), then admin
   if (!canEditAsCreator(hack, user.id)) {
-    return { ok: false, error: "Forbidden" };
-  }
-
-  const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
-  if (!editableAsAdmin) {
-    return { ok: false, error: "Forbidden" };
+    const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
+    if (!editableAsAdmin) {
+      return { ok: false, error: "Forbidden" };
+    }
   }
 
   // Verify patch belongs to this hack
@@ -723,12 +713,10 @@ export async function publishPatchVersion(slug: string, patchId: number): Promis
 
   // Check permissions: creator first (optimization), then admin
   if (!canEditAsCreator(hack, user.id)) {
-    return { ok: false, error: "Forbidden" };
-  }
-
-  const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
-  if (!editableAsAdmin) {
-    return { ok: false, error: "Forbidden" };
+    const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
+    if (!editableAsAdmin) {
+      return { ok: false, error: "Forbidden" };
+    }
   }
 
   // Verify patch belongs to this hack and get its created_at
@@ -798,12 +786,10 @@ export async function reuploadPatchVersion(
 
   // Check permissions: creator first (optimization), then admin
   if (!canEditAsCreator(hack, user.id)) {
-    return { ok: false, error: "Forbidden" };
-  }
-
-  const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
-  if (!editableAsAdmin) {
-    return { ok: false, error: "Forbidden" };
+    const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
+    if (!editableAsAdmin) {
+      return { ok: false, error: "Forbidden" };
+    }
   }
 
   // Verify patch belongs to this hack
@@ -843,12 +829,10 @@ export async function confirmReuploadPatchVersion(
 
   // Check permissions: creator first (optimization), then admin
   if (!canEditAsCreator(hack, user.id)) {
-    return { ok: false, error: "Forbidden" };
-  }
-
-  const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
-  if (!editableAsAdmin) {
-    return { ok: false, error: "Forbidden" };
+    const editableAsAdmin = await canEditAsAdmin(hack, user.id, supabase);
+    if (!editableAsAdmin) {
+      return { ok: false, error: "Forbidden" };
+    }
   }
 
   // Verify patch belongs to this hack