fix: "Moje žádosti" page shows only current user's requests

Admins were seeing all requests on their own requests page.
Added mine=1 param to force user_id filter regardless of role.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
BOHA
2026-03-28 09:03:05 +01:00
parent 79b2fa5570
commit 2402b7cbc8
2 changed files with 2 additions and 2 deletions

View File

@@ -61,7 +61,7 @@ export default function LeaveRequests() {
const fetchRequests = useCallback(async () => { const fetchRequests = useCallback(async () => {
try { try {
const response = await apiFetch(`${API_BASE}/leave-requests`); const response = await apiFetch(`${API_BASE}/leave-requests?mine=1`);
if (response.status === 401) return; if (response.status === 401) return;
const result = await response.json(); const result = await response.json();
if (result.success) { if (result.success) {

View File

@@ -29,7 +29,7 @@ export default async function leaveRequestsRoutes(
const isAdmin = authData.permissions.includes("attendance.approve"); const isAdmin = authData.permissions.includes("attendance.approve");
const where: Record<string, unknown> = {}; const where: Record<string, unknown> = {};
if (!isAdmin) where.user_id = authData.userId; if (!isAdmin || query.mine === "1") where.user_id = authData.userId;
else if (query.user_id) where.user_id = Number(query.user_id); else if (query.user_id) where.user_id = Number(query.user_id);
if (query.status) where.status = String(query.status); if (query.status) where.status = String(query.status);