watson/umami
1
0
Fork 0
mirror of https://github.com/umami-software/umami.git synced 2026-02-12 16:45:35 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Updated roles and permissions logic.

Browse source
This commit is contained in:
Mike Cao 2022-12-06 18:36:41 -08:00
parent 4eb3140e43
commit b57ecf33e6
63 changed files with 432 additions and 546 deletions
Download patch file Download diff file Expand all files Collapse all files

10
pages/api/users/[id]/index.ts
View file

@ -1,5 +1,5 @@
import { NextApiRequestQueryBody } from 'interface/api/nextApi';
import { canDeleteUser, canUpdateUser, canViewUser, checkAdmin } from 'lib/auth';
import { NextApiRequestQueryBody } from 'lib/types';
import { canUpdateUser, canViewUser } from 'lib/auth';
import { useAuth } from 'lib/middleware';
import { NextApiResponse } from 'next';
import { badRequest, hashPassword, methodNotAllowed, ok, unauthorized } from 'next-basics';
@ -21,7 +21,7 @@ export default async (
await useAuth(req, res);
const {
user: { id: userId },
user: { id: userId, isAdmin },
} = req.auth;
const { id } = req.query;
@ -51,7 +51,7 @@ export default async (
}
// Only admin can change these fields
if (username && (await checkAdmin(userId))) {
if (username && isAdmin) {
data.username = username;
}
@ -70,7 +70,7 @@ export default async (
}
if (req.method === 'DELETE') {
if (canDeleteUser(userId)) {
if (isAdmin) {
return unauthorized(res);
}