diff --git a/server/routes.ts b/server/routes.ts index 4b4dcc7..e50e9a6 100644 --- a/server/routes.ts +++ b/server/routes.ts @@ -758,7 +758,23 @@ export async function registerRoutes(app: Express): Promise { const start = startDate ? new Date(startDate as string) : undefined; const end = endDate ? new Date(endDate as string) : undefined; - const scheduledPosts = await storage.getScheduledPosts(userId, start, end); + let scheduledPosts; + + if (user.role === 'admin') { + // Admin voit tous les posts programmés + const allUsers = await storage.getAllUsers(); + const allPostsPromises = allUsers.map(u => storage.getScheduledPosts(u.id, start, end)); + const allPostsArrays = await Promise.all(allPostsPromises); + scheduledPosts = allPostsArrays.flat(); + } else { + // User voit uniquement les posts des pages qui lui sont attribuées + const accessiblePages = await storage.getUserAccessiblePages(userId); + const accessiblePageIds = accessiblePages.map(p => p.id); + + const userScheduledPosts = await storage.getScheduledPosts(userId, start, end); + scheduledPosts = userScheduledPosts.filter(sp => accessiblePageIds.includes(sp.pageId)); + } + res.json(scheduledPosts); } catch (error) { console.error("Error fetching scheduled posts:", error); @@ -772,14 +788,19 @@ export async function registerRoutes(app: Express): Promise { const userId = user.id; const { id } = req.params; - // Verify the scheduled post belongs to the user before deleting + // Verify the scheduled post exists const scheduledPost = await storage.getScheduledPost(id); if (!scheduledPost) { return res.status(404).json({ error: "Scheduled post not found" }); } const post = await storage.getPost(scheduledPost.postId); - if (!post || post.userId !== userId) { + if (!post) { + return res.status(404).json({ error: "Post not found" }); + } + + // Admin peut tout supprimer, user peut supprimer uniquement ses propres posts + if (user.role !== 'admin' && post.userId !== userId) { return res.status(403).json({ error: "Unauthorized" }); } @@ -797,14 +818,19 @@ export async function registerRoutes(app: Express): Promise { const userId = user.id; const { id } = req.params; - // Verify the scheduled post belongs to the user before updating + // Verify the scheduled post exists const scheduledPost = await storage.getScheduledPost(id); if (!scheduledPost) { return res.status(404).json({ error: "Scheduled post not found" }); } const post = await storage.getPost(scheduledPost.postId); - if (!post || post.userId !== userId) { + if (!post) { + return res.status(404).json({ error: "Post not found" }); + } + + // Admin peut tout modifier, user peut modifier uniquement ses propres posts + if (user.role !== 'admin' && post.userId !== userId) { return res.status(403).json({ error: "Unauthorized" }); }