rsp2k/headplane
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

feat: add capabilities enforcement on users

Browse source
This commit is contained in:
Aarnav Tale 2025-04-02 23:34:32 -04:00
parent 5d3fada266
commit 259d150fc4
4 changed files with 31 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

20
app/routes/users/user-actions.ts
View file

@ -9,8 +9,12 @@ export async function userAction({
context,
}: ActionFunctionArgs<LoadContext>) {
const session = await context.sessions.auth(request);
const apiKey = session.get('api_key')!;
const check = await context.sessions.check(request, Capabilities.write_users);
if (!check) {
return data({ success: false }, 403);
}
const apiKey = session.get('api_key')!;
const formData = await request.formData();
const action = formData.get('action_id')?.toString();
if (!action) {
@ -84,20 +88,6 @@ async function reassignUser(
context: LoadContext,
session: Session<AuthSession, unknown>,
) {
const executor = session.get('user');
if (!executor?.subject) {
return data({ success: false }, 400);
}
const check = await context.sessions.checkSubject(
executor.subject,
Capabilities.write_users,
);
if (!check) {
return data({ success: false }, 403);
}
const userId = formData.get('user_id')?.toString();
const newRole = formData.get('new_role')?.toString();
if (!userId || !newRole) {