mirror of
https://github.com/umami-software/umami.git
synced 2026-02-12 00:27:11 +01:00
Block share token from all editing permissions.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
parent
e782c2e627
commit
fdafe13c35
6 changed files with 89 additions and 9 deletions
|
|
@ -4,7 +4,11 @@ import type { Auth } from '@/lib/types';
|
|||
import { getPixel, getTeamUser } from '@/queries/prisma';
|
||||
|
||||
export async function canViewPixel({ user }: Auth, pixelId: string) {
|
||||
if (user?.isAdmin) {
|
||||
if (!user) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (user.isAdmin) {
|
||||
return true;
|
||||
}
|
||||
|
||||
|
|
@ -24,6 +28,10 @@ export async function canViewPixel({ user }: Auth, pixelId: string) {
|
|||
}
|
||||
|
||||
export async function canUpdatePixel({ user }: Auth, pixelId: string) {
|
||||
if (!user) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (user.isAdmin) {
|
||||
return true;
|
||||
}
|
||||
|
|
@ -44,6 +52,10 @@ export async function canUpdatePixel({ user }: Auth, pixelId: string) {
|
|||
}
|
||||
|
||||
export async function canDeletePixel({ user }: Auth, pixelId: string) {
|
||||
if (!user) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (user.isAdmin) {
|
||||
return true;
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue