mirror of
https://github.com/R0m1k3/LogiFlow.git
synced 2026-10-11 17:27:31 +02:00
Fix issue where non-admin users could see all groups
Add console logging for debugging group data access by user role and fix group filtering logic to ensure correct data is returned for non-admin users. Replit-Commit-Author: Agent Replit-Commit-Session-Id: 28b81ac1-a55f-409c-b6a9-88ad420d8a9a Replit-Commit-Checkpoint-Type: full_checkpoint Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/28b81ac1-a55f-409c-b6a9-88ad420d8a9a/6PoDWd4
This commit is contained in:
1 parent
510a62915b
commit
2f71b06744
2 files changed
+17
-1
No files matched your search
+17
-1
@@ -80,12 +80,28 @@ export async function registerRoutes(app: Express): Promise<Server> {
|
||||
return res.status(404).json({ message: "User not found" });
|
||||
}
|
||||
|
||||
console.log('🔍 [DEBUG] Groups request:', {
|
||||
userId,
|
||||
userRole: user.role,
|
||||
userGroupsCount: (user as any).userGroups?.length || 0,
|
||||
userGroups: (user as any).userGroups?.map((ug: any) => ({
|
||||
groupId: ug.groupId,
|
||||
groupName: ug.group?.name
|
||||
})) || []
|
||||
});
|
||||
|
||||
// Only admin sees all groups, all other roles (manager, employee, directeur) see only their assigned groups
|
||||
if (user.role === 'admin') {
|
||||
const groups = await storage.getGroups();
|
||||
console.log('🔍 [DEBUG] Admin - returning all groups:', groups.length);
|
||||
res.json(groups);
|
||||
} else {
|
||||
const userGroups = (user as any).userGroups?.map((ug: any) => ug.group) || [];
|
||||
const userGroups = (user as any).userGroups?.map((ug: any) => ug.group).filter(Boolean) || [];
|
||||
console.log('🔍 [DEBUG] Non-admin - returning filtered groups:', {
|
||||
role: user.role,
|
||||
filteredGroupsCount: userGroups.length,
|
||||
groups: userGroups.map((g: any) => ({ id: g.id, name: g.name }))
|
||||
});
|
||||
res.json(userGroups);
|
||||
}
|
||||
} catch (error) {
|
||||
|
||||
Reference in new issue
Block a user