boha_admin/app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 26 Wiki Activity

fix(plan): correct admin role check (roleName not role) + drop stale category casts

Browse Source 
isAdminLike read authData.role, which doesn't exist on AuthData (it's roleName; role is on JwtPayload), so admins were always self-scoped on /entries and /overrides. Typed the param (no more any). Also removed 4 'category: input.category as any' casts now that category is a String column.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
BOHA
2026-06-06 02:16:23 +02:00
parent 05596642bc
commit 379725a096
2 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/routes/admin/plan.ts
View File

@@ -6,6 +6,7 @@ import {
} from "../../middleware/auth";
import { success, error, parseId } from "../../utils/response";
import { parseBody } from "../../schemas/common";
import { AuthData } from "../../types";
import { logAudit } from "../../services/audit";
import {
CreatePlanEntrySchema,
@@ -40,8 +41,12 @@ import {
const MAX_RANGE_DAYS = 92;
function isAdminLike(authData: any): boolean {
return authData?.role === "admin";
// NOTE: AuthData carries `roleName` (not `role` — that lives on JwtPayload).
// The previous `authData.role` read was always undefined, so admins were
// wrongly scoped to their own plan rows on the /entries and /overrides
// endpoints. Typed (not `any`) so this can't silently regress.
function isAdminLike(authData: AuthData | undefined): boolean {
return authData?.roleName === "admin";
}
function forceFromQuery(query: unknown): boolean {