Michael/LogiFlow
1
0 Fork 0
mirror of https://github.com/R0m1k3/LogiFlow.git synced 2026-10-12 09:47:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

Enforce granular permissions for DLC product management operations

Browse Source 
Implement role-based access control for all DLC product API endpoints, ensuring users only have access to actions they are authorized for (view, create, edit, validate, delete).

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: b163d4c0-de5e-4f4e-a9c0-aed4c7049718
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/b163d4c0-de5e-4f4e-a9c0-aed4c7049718/unrxPjo
This commit is contained in:
michaelschal committed 2025-08-12 13:38:52 +00:00
1 parent 82fe7abd05
commit c1718f2f1f
2 files changed
+8 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

attached_assets/{C0EB3F72-6919-46C0-A54C-84D869D92459}_1755005798705.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 365 KiB

server/routes.ts
+8 -10
View File
@@ -2161,7 +2161,7 @@ RÉSUMÉ DU SCAN
});
// DLC Products routes
app.get('/api/dlc-products', isAuthenticated, async (req: any, res) => {
app.get('/api/dlc-products', isAuthenticated, requirePermission('dlc', 'view'), async (req: any, res) => {
try {
const userId = req.user.claims ? req.user.claims.sub : req.user.id;
const user = await storage.getUserWithGroups(userId);
@@ -2208,7 +2208,7 @@ RÉSUMÉ DU SCAN
}
});
app.get('/api/dlc-products/stats', isAuthenticated, async (req: any, res) => {
app.get('/api/dlc-products/stats', isAuthenticated, requirePermission('dlc', 'view'), async (req: any, res) => {
try {
const userId = req.user.claims ? req.user.claims.sub : req.user.id;
const user = await storage.getUserWithGroups(userId);
@@ -2237,7 +2237,7 @@ RÉSUMÉ DU SCAN
}
});
app.get('/api/dlc-products/:id', isAuthenticated, async (req: any, res) => {
app.get('/api/dlc-products/:id', isAuthenticated, requirePermission('dlc', 'view'), async (req: any, res) => {
try {
const id = parseInt(req.params.id);
const dlcProduct = await storage.getDlcProduct(id);
@@ -2264,7 +2264,7 @@ RÉSUMÉ DU SCAN
}
});
app.post('/api/dlc-products', isAuthenticated, async (req: any, res) => {
app.post('/api/dlc-products', isAuthenticated, requirePermission('dlc', 'create'), async (req: any, res) => {
try {
console.log('📨 POST /api/dlc-products - Request body:', JSON.stringify(req.body, null, 2));
@@ -2304,7 +2304,7 @@ RÉSUMÉ DU SCAN
}
});
app.put('/api/dlc-products/:id', isAuthenticated, async (req: any, res) => {
app.put('/api/dlc-products/:id', isAuthenticated, requirePermission('dlc', 'edit'), async (req: any, res) => {
try {
const id = parseInt(req.params.id);
const userId = req.user.claims ? req.user.claims.sub : req.user.id;
@@ -2339,15 +2339,13 @@ RÉSUMÉ DU SCAN
}
});
app.post('/api/dlc-products/:id/validate', isAuthenticated, async (req: any, res) => {
app.post('/api/dlc-products/:id/validate', isAuthenticated, requirePermission('dlc', 'validate'), async (req: any, res) => {
try {
const id = parseInt(req.params.id);
const userId = req.user.claims ? req.user.claims.sub : req.user.id;
const user = await storage.getUser(userId);
if (!user || !hasPermission(user.role, 'dlc', 'validate')) {
return res.status(403).json({ message: "Insufficient permissions to validate products" });
}
// Permission already checked by middleware
// Check if the product exists and user has access
const existingProduct = await storage.getDlcProduct(id);
@@ -2371,7 +2369,7 @@ RÉSUMÉ DU SCAN
}
});
app.delete('/api/dlc-products/:id', isAuthenticated, async (req: any, res) => {
app.delete('/api/dlc-products/:id', isAuthenticated, requirePermission('dlc', 'delete'), async (req: any, res) => {
try {
const id = parseInt(req.params.id);
const userId = req.user.claims ? req.user.claims.sub : req.user.id;