Michael/LogiFlow
1
0 Fork 0
mirror of https://github.com/R0m1k3/LogiFlow.git synced 2026-10-24 15:38:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #363 from R0m1k3/1.1

Browse Source 
Ensure all invoice-related API endpoints require user authentication
This commit is contained in:
LogiFlow authored and GitHub committed 2025-09-08 16:08:50 +02:00
2 parents 5a4543a7bb 8ae757e3a2
commit 0b96f94806
2 files changed
+7 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

attached_assets/{F4105BB9-9643-4E02-8863-0D55E5C02439}_1757340393932.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 320 KiB

server/routes.ts
+7 -7
View File
@@ -2339,7 +2339,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
}); });
// Avoir routes // Avoir routes
app.get('/api/avoirs', requireModulePermission('avoir', 'view'), async (req: any, res) => { app.get('/api/avoirs', isAuthenticated, async (req: any, res) => {
try { try {
const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id); const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
if (!user) { if (!user) {
@@ -2373,7 +2373,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
} }
}); });
app.get('/api/avoirs/:id', requireModulePermission('avoir', 'view'), async (req: any, res) => { app.get('/api/avoirs/:id', isAuthenticated, async (req: any, res) => {
try { try {
const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id); const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
if (!user) { if (!user) {
@@ -2402,7 +2402,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
} }
}); });
app.post('/api/avoirs', requireModulePermission('avoir', 'create'), async (req: any, res) => { app.post('/api/avoirs', isAuthenticated, async (req: any, res) => {
try { try {
const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id); const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
if (!user) { if (!user) {
@@ -2472,7 +2472,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
} }
}); });
app.put('/api/avoirs/:id', requireModulePermission('avoir', 'edit'), async (req: any, res) => { app.put('/api/avoirs/:id', isAuthenticated, async (req: any, res) => {
try { try {
const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id); const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
if (!user) { if (!user) {
@@ -2503,7 +2503,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
} }
}); });
app.delete('/api/avoirs/:id', requireModulePermission('avoir', 'delete'), async (req: any, res) => { app.delete('/api/avoirs/:id', isAuthenticated, async (req: any, res) => {
try { try {
const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id); const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
if (!user) { if (!user) {
@@ -2540,7 +2540,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
}); });
// Avoir status update routes // Avoir status update routes
app.put('/api/avoirs/:id/webhook-status', requireModulePermission('avoir', 'edit'), async (req: any, res) => { app.put('/api/avoirs/:id/webhook-status', isAuthenticated, async (req: any, res) => {
try { try {
const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id); const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
if (!user) { if (!user) {
@@ -2563,7 +2563,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
} }
}); });
app.put('/api/avoirs/:id/nocodb-verification', requireModulePermission('avoir', 'edit'), async (req: any, res) => { app.put('/api/avoirs/:id/nocodb-verification', isAuthenticated, async (req: any, res) => {
try { try {
const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id); const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
if (!user) { if (!user) {