Michael/LogiFlow
1
0 Fork 0
mirror of https://github.com/R0m1k3/LogiFlow.git synced 2026-10-11 17:27:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ensure all invoice-related API endpoints require user authentication

Browse Source 
Replace module permission checks with a general authentication requirement for all /api/avoirs routes.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 9fcf4b21-eb0c-4e53-a567-e2ce4a6ad869
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/9fcf4b21-eb0c-4e53-a567-e2ce4a6ad869/0C3uBiZ
This commit is contained in:
michaelschal committed 2025-09-08 14:08:26 +00:00
1 parent d6f6042d20
commit 8ae757e3a2
2 files changed
+7 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

server/routes.ts
+7 -7
View File
@@ -2339,7 +2339,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
});
// Avoir routes
app.get('/api/avoirs', requireModulePermission('avoir', 'view'), async (req: any, res) => {
app.get('/api/avoirs', isAuthenticated, async (req: any, res) => {
try {
const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
if (!user) {
@@ -2373,7 +2373,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
}
});
app.get('/api/avoirs/:id', requireModulePermission('avoir', 'view'), async (req: any, res) => {
app.get('/api/avoirs/:id', isAuthenticated, async (req: any, res) => {
try {
const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
if (!user) {
@@ -2402,7 +2402,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
}
});
app.post('/api/avoirs', requireModulePermission('avoir', 'create'), async (req: any, res) => {
app.post('/api/avoirs', isAuthenticated, async (req: any, res) => {
try {
const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
if (!user) {
@@ -2472,7 +2472,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
}
});
app.put('/api/avoirs/:id', requireModulePermission('avoir', 'edit'), async (req: any, res) => {
app.put('/api/avoirs/:id', isAuthenticated, async (req: any, res) => {
try {
const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
if (!user) {
@@ -2503,7 +2503,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
}
});
app.delete('/api/avoirs/:id', requireModulePermission('avoir', 'delete'), async (req: any, res) => {
app.delete('/api/avoirs/:id', isAuthenticated, async (req: any, res) => {
try {
const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
if (!user) {
@@ -2540,7 +2540,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
});
// Avoir status update routes
app.put('/api/avoirs/:id/webhook-status', requireModulePermission('avoir', 'edit'), async (req: any, res) => {
app.put('/api/avoirs/:id/webhook-status', isAuthenticated, async (req: any, res) => {
try {
const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
if (!user) {
@@ -2563,7 +2563,7 @@ export async function registerRoutes(app: Express): Promise<Server> {
}
});
app.put('/api/avoirs/:id/nocodb-verification', requireModulePermission('avoir', 'edit'), async (req: any, res) => {
app.put('/api/avoirs/:id/nocodb-verification', isAuthenticated, async (req: any, res) => {
try {
const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
if (!user) {