Michael/Socialflow
1
0 Fork 0
mirror of https://github.com/R0m1k3/Socialflow.git synced 2026-10-11 17:26:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

Improve security and filtering for scheduled posts across user pages

Browse Source 
Adds a `getScheduledPostsByPages` method to storage, enabling efficient filtering of scheduled posts by authorized page IDs. Updates API routes to correctly retrieve posts based on user roles (admin vs. standard user) and accessible pages, enhancing data security and user experience.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: ae4037a0-2a6f-4530-9bac-79b543286bda
Replit-Commit-Checkpoint-Type: intermediate_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/397bca8c-984f-43ff-841a-10897aeb8140/ae4037a0-2a6f-4530-9bac-79b543286bda/77tIrOr
This commit is contained in:
michaelschal committed 2025-10-28 15:20:15 +00:00
1 parent 1a16c71a41
commit 6014c4e083
3 files changed
+54 -15
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

server/routes.ts
+17 -14
View File
@@ -991,24 +991,27 @@ export async function registerRoutes(app: Express): Promise<Server> {
let scheduledPosts;
if (user.role === 'admin') {
// Admin voit tous les posts programmés
const allUsers = await storage.getAllUsers();
const allPostsPromises = allUsers.map(u => storage.getScheduledPosts(u.id, start, end));
const allPostsArrays = await Promise.all(allPostsPromises);
scheduledPosts = allPostsArrays.flat();
// Admin voit tous les posts programmés - on récupère toutes les pages
const allPages = await storage.getAllUsers().then(users =>
Promise.all(users.map(u => storage.getSocialPages(u.id)))
).then(pagesArrays => pagesArrays.flat());
const allPageIds = allPages.map(p => p.id);
if (allPageIds.length > 0) {
scheduledPosts = await storage.getScheduledPostsByPages(allPageIds, start, end);
} else {
scheduledPosts = [];
}
} else {
// User voit tous les posts programmés sur les pages qui lui sont attribuées (peu importe qui les a créés)
// User voit uniquement les posts programmés sur les pages qui lui sont attribuées
const accessiblePages = await storage.getUserAccessiblePages(userId);
const accessiblePageIds = accessiblePages.map(p => p.id);
// Récupérer tous les posts programmés de tous les utilisateurs
const allUsers = await storage.getAllUsers();
const allPostsPromises = allUsers.map(u => storage.getScheduledPosts(u.id, start, end));
const allPostsArrays = await Promise.all(allPostsPromises);
const allScheduledPosts = allPostsArrays.flat();
// Filtrer uniquement les posts des pages accessibles
scheduledPosts = allScheduledPosts.filter(sp => accessiblePageIds.includes(sp.pageId));
if (accessiblePageIds.length > 0) {
scheduledPosts = await storage.getScheduledPostsByPages(accessiblePageIds, start, end);
} else {
scheduledPosts = [];
}
}
res.json(scheduledPosts);