Allow users to select from assigned pages and manage their posts

Modify routes to differentiate admin and user permissions for fetching, deleting, and updating scheduled posts. Admins can access all data, while regular users can only manage posts associated with their assigned pages.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: ae4037a0-2a6f-4530-9bac-79b543286bda
Replit-Commit-Checkpoint-Type: intermediate_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/397bca8c-984f-43ff-841a-10897aeb8140/ae4037a0-2a6f-4530-9bac-79b543286bda/G1P4XGr

server/routes.ts

@@ -758,7 +758,23 @@ export async function registerRoutes(app: Express): Promise<Server> {
       const start = startDate ? new Date(startDate as string) : undefined;
       const end = endDate ? new Date(endDate as string) : undefined;
       
-      const scheduledPosts = await storage.getScheduledPosts(userId, start, end);
+      let scheduledPosts;
+      
+      if (user.role === 'admin') {
+        // Admin voit tous les posts programmés
+        const allUsers = await storage.getAllUsers();
+        const allPostsPromises = allUsers.map(u => storage.getScheduledPosts(u.id, start, end));
+        const allPostsArrays = await Promise.all(allPostsPromises);
+        scheduledPosts = allPostsArrays.flat();
+      } else {
+        // User voit uniquement les posts des pages qui lui sont attribuées
+        const accessiblePages = await storage.getUserAccessiblePages(userId);
+        const accessiblePageIds = accessiblePages.map(p => p.id);
+        
+        const userScheduledPosts = await storage.getScheduledPosts(userId, start, end);
+        scheduledPosts = userScheduledPosts.filter(sp => accessiblePageIds.includes(sp.pageId));
+      }
+      
       res.json(scheduledPosts);
     } catch (error) {
       console.error("Error fetching scheduled posts:", error);
@@ -772,14 +788,19 @@ export async function registerRoutes(app: Express): Promise<Server> {
       const userId = user.id;
       const { id } = req.params;
       
-      // Verify the scheduled post belongs to the user before deleting
+      // Verify the scheduled post exists
       const scheduledPost = await storage.getScheduledPost(id);
       if (!scheduledPost) {
         return res.status(404).json({ error: "Scheduled post not found" });
       }
       
       const post = await storage.getPost(scheduledPost.postId);
-      if (!post || post.userId !== userId) {
+      if (!post) {
+        return res.status(404).json({ error: "Post not found" });
+      }
+      
+      // Admin peut tout supprimer, user peut supprimer uniquement ses propres posts
+      if (user.role !== 'admin' && post.userId !== userId) {
         return res.status(403).json({ error: "Unauthorized" });
       }
       
@@ -797,14 +818,19 @@ export async function registerRoutes(app: Express): Promise<Server> {
       const userId = user.id;
       const { id } = req.params;
       
-      // Verify the scheduled post belongs to the user before updating
+      // Verify the scheduled post exists
       const scheduledPost = await storage.getScheduledPost(id);
       if (!scheduledPost) {
         return res.status(404).json({ error: "Scheduled post not found" });
       }
       
       const post = await storage.getPost(scheduledPost.postId);
-      if (!post || post.userId !== userId) {
+      if (!post) {
+        return res.status(404).json({ error: "Post not found" });
+      }
+      
+      // Admin peut tout modifier, user peut modifier uniquement ses propres posts
+      if (user.role !== 'admin' && post.userId !== userId) {
         return res.status(403).json({ error: "Unauthorized" });
       }