From 73fe39bfbd27fc4f5d549cd4ce0b4af630e603e9 Mon Sep 17 00:00:00 2001
From: michaelschal <35957947-michaelschal@users.noreply.replit.com>
Date: Fri, 10 Oct 2025 08:47:23 +0000
Subject: [PATCH] Allow users to select from assigned pages and manage their
 posts

Modify routes to differentiate admin and user permissions for fetching, deleting, and updating scheduled posts. Admins can access all data, while regular users can only manage posts associated with their assigned pages.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: ae4037a0-2a6f-4530-9bac-79b543286bda
Replit-Commit-Checkpoint-Type: intermediate_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/397bca8c-984f-43ff-841a-10897aeb8140/ae4037a0-2a6f-4530-9bac-79b543286bda/G1P4XGr
---
 server/routes.ts | 36 +++++++++++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 5 deletions(-)

diff --git a/server/routes.ts b/server/routes.ts
index 4b4dcc7..e50e9a6 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -758,7 +758,23 @@ export async function registerRoutes(app: Express): Promise<Server> {
       const start = startDate ? new Date(startDate as string) : undefined;
       const end = endDate ? new Date(endDate as string) : undefined;
       
-      const scheduledPosts = await storage.getScheduledPosts(userId, start, end);
+      let scheduledPosts;
+      
+      if (user.role === 'admin') {
+        // Admin voit tous les posts programmés
+        const allUsers = await storage.getAllUsers();
+        const allPostsPromises = allUsers.map(u => storage.getScheduledPosts(u.id, start, end));
+        const allPostsArrays = await Promise.all(allPostsPromises);
+        scheduledPosts = allPostsArrays.flat();
+      } else {
+        // User voit uniquement les posts des pages qui lui sont attribuées
+        const accessiblePages = await storage.getUserAccessiblePages(userId);
+        const accessiblePageIds = accessiblePages.map(p => p.id);
+        
+        const userScheduledPosts = await storage.getScheduledPosts(userId, start, end);
+        scheduledPosts = userScheduledPosts.filter(sp => accessiblePageIds.includes(sp.pageId));
+      }
+      
       res.json(scheduledPosts);
     } catch (error) {
       console.error("Error fetching scheduled posts:", error);
@@ -772,14 +788,19 @@ export async function registerRoutes(app: Express): Promise<Server> {
       const userId = user.id;
       const { id } = req.params;
       
-      // Verify the scheduled post belongs to the user before deleting
+      // Verify the scheduled post exists
       const scheduledPost = await storage.getScheduledPost(id);
       if (!scheduledPost) {
         return res.status(404).json({ error: "Scheduled post not found" });
       }
       
       const post = await storage.getPost(scheduledPost.postId);
-      if (!post || post.userId !== userId) {
+      if (!post) {
+        return res.status(404).json({ error: "Post not found" });
+      }
+      
+      // Admin peut tout supprimer, user peut supprimer uniquement ses propres posts
+      if (user.role !== 'admin' && post.userId !== userId) {
         return res.status(403).json({ error: "Unauthorized" });
       }
       
@@ -797,14 +818,19 @@ export async function registerRoutes(app: Express): Promise<Server> {
       const userId = user.id;
       const { id } = req.params;
       
-      // Verify the scheduled post belongs to the user before updating
+      // Verify the scheduled post exists
       const scheduledPost = await storage.getScheduledPost(id);
       if (!scheduledPost) {
         return res.status(404).json({ error: "Scheduled post not found" });
       }
       
       const post = await storage.getPost(scheduledPost.postId);
-      if (!post || post.userId !== userId) {
+      if (!post) {
+        return res.status(404).json({ error: "Post not found" });
+      }
+      
+      // Admin peut tout modifier, user peut modifier uniquement ses propres posts
+      if (user.role !== 'admin' && post.userId !== userId) {
         return res.status(403).json({ error: "Unauthorized" });
       }