watson/umami
1
0
Fork 0
mirror of https://github.com/umami-software/umami.git synced 2025-12-06 01:18:00 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

clean up teams api messaging and permissions

Browse source
This commit is contained in:
Francis Cao 2025-10-21 15:35:17 -07:00
parent d8fdba77db
commit 06230ad2e9
4 changed files with 12 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/app/api/teams/[teamId]/route.ts
View file

@ -41,7 +41,7 @@ export async function POST(request: Request, { params }: { params: Promise<{ tea
const { teamId } = await params;
if (!(await canUpdateTeam(auth, teamId))) {
return unauthorized({ message: 'You must be the owner of this team.' });
return unauthorized({ message: 'You must be the owner/manager of this team.' });
}
const team = await updateTeam(teamId, body);
@ -62,7 +62,7 @@ export async function DELETE(
const { teamId } = await params;
if (!(await canDeleteTeam(auth, teamId))) {
return unauthorized({ message: 'You must be the owner of this team.' });
return unauthorized({ message: 'You must be the owner/manager of this team.' });
}
await deleteTeam(teamId);

6
src/app/api/teams/[teamId]/users/[userId]/route.ts
View file

@ -17,7 +17,7 @@ export async function GET(
const { teamId, userId } = await params;
if (!(await canUpdateTeam(auth, teamId))) {
return unauthorized({ message: 'You must be the owner of this team.' });
return unauthorized({ message: 'You must be the owner/manager of this team.' });
}
const teamUser = await getTeamUser(teamId, userId);
@ -42,7 +42,7 @@ export async function POST(
const { teamId, userId } = await params;
if (!(await canUpdateTeam(auth, teamId))) {
return unauthorized({ message: 'You must be the owner of this team.' });
return unauthorized({ message: 'You must be the owner/manager of this team.' });
}
const teamUser = await getTeamUser(teamId, userId);
@ -69,7 +69,7 @@ export async function DELETE(
const { teamId, userId } = await params;
if (!(await canDeleteTeamUser(auth, teamId, userId))) {
return unauthorized({ message: 'You must be the owner of this team.' });
return unauthorized({ message: 'You must be the owner/manager of this team.' });
}
const teamUser = await getTeamUser(teamId, userId);

14
src/app/api/teams/[teamId]/users/route.ts
View file

@ -1,9 +1,9 @@
import { z } from 'zod';
import { unauthorized, json, badRequest } from '@/lib/response';
import { canAddUserToTeam, canViewTeam } from '@/permissions';
import { getQueryFilters, parseRequest } from '@/lib/request';
import { pagingParams, teamRoleParam, searchParams } from '@/lib/schema';
import { badRequest, json, unauthorized } from '@/lib/response';
import { pagingParams, searchParams, teamRoleParam } from '@/lib/schema';
import { canUpdateTeam, canViewTeam } from '@/permissions';
import { createTeamUser, getTeamUser, getTeamUsers } from '@/queries/prisma';
import { z } from 'zod';
export async function GET(request: Request, { params }: { params: Promise<{ teamId: string }> }) {
const schema = z.object({
@ -20,7 +20,7 @@ export async function GET(request: Request, { params }: { params: Promise<{ team
const { teamId } = await params;
if (!(await canViewTeam(auth, teamId))) {
return unauthorized({ message: 'You must be the owner of this team.' });
return unauthorized({ message: 'You must be a member of this team.' });
}
const filters = await getQueryFilters(query);
@ -65,8 +65,8 @@ export async function POST(request: Request, { params }: { params: Promise<{ tea
const { teamId } = await params;
if (!(await canAddUserToTeam(auth))) {
return unauthorized();
if (!(await canUpdateTeam(auth, teamId))) {
return unauthorized({ message: 'You must be the owner/manager of this team.' });
}
const { userId, role } = body;

4
src/permissions/team.ts
View file

@ -39,10 +39,6 @@ export async function canDeleteTeam({ user }: Auth, teamId: string) {
return teamUser && hasPermission(teamUser.role, PERMISSIONS.teamDelete);
}
export async function canAddUserToTeam({ user }: Auth) {
return user.isAdmin;
}
export async function canDeleteTeamUser({ user }: Auth, teamId: string, removeUserId: string) {
if (user.isAdmin) {
return true;