diff --git a/src/routes/admin/plan.ts b/src/routes/admin/plan.ts index 923579f..738e009 100644 --- a/src/routes/admin/plan.ts +++ b/src/routes/admin/plan.ts @@ -6,6 +6,7 @@ import { } from "../../middleware/auth"; import { success, error, parseId } from "../../utils/response"; import { parseBody } from "../../schemas/common"; +import { AuthData } from "../../types"; import { logAudit } from "../../services/audit"; import { CreatePlanEntrySchema, @@ -40,8 +41,12 @@ import { const MAX_RANGE_DAYS = 92; -function isAdminLike(authData: any): boolean { - return authData?.role === "admin"; +// NOTE: AuthData carries `roleName` (not `role` — that lives on JwtPayload). +// The previous `authData.role` read was always undefined, so admins were +// wrongly scoped to their own plan rows on the /entries and /overrides +// endpoints. Typed (not `any`) so this can't silently regress. +function isAdminLike(authData: AuthData | undefined): boolean { + return authData?.roleName === "admin"; } function forceFromQuery(query: unknown): boolean { diff --git a/src/services/plan.service.ts b/src/services/plan.service.ts index 9d99be7..8e82714 100644 --- a/src/services/plan.service.ts +++ b/src/services/plan.service.ts @@ -448,7 +448,7 @@ export async function createEntry( date_from: toDateOnly(input.date_from), date_to: toDateOnly(input.date_to), project_id: input.project_id ?? null, - category: input.category as any, + category: input.category, note: input.note, created_by: actorUserId, }, @@ -515,7 +515,7 @@ export async function updateEntry( date_from: input.date_from ? toDateOnly(input.date_from) : undefined, date_to: input.date_to ? toDateOnly(input.date_to) : undefined, project_id: input.project_id === undefined ? undefined : input.project_id, - category: input.category as any, + category: input.category, note: input.note, }, }); @@ -636,7 +636,7 @@ export async function createOverride( user_id: input.user_id, shift_date: date, project_id: input.project_id ?? null, - category: input.category as any, + category: input.category, note: input.note, created_by: actorUserId, }, @@ -707,7 +707,7 @@ export async function updateOverride( where: { id }, data: { project_id: input.project_id === undefined ? undefined : input.project_id, - category: input.category as any, + category: input.category, note: input.note, }, });