boha_admin/app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 26 Wiki Activity

fix: allow any authenticated user to list vehicles

Browse Source 
Vehicle list (GET) now requires only authentication, not trips.vehicles
permission. Users with trips.view can see available cars in the trip
modal. Create/update/delete still require trips.vehicles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
BOHA
2026-03-23 13:12:22 +01:00
parent 20c1aab14c
commit 9a0acb8983
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/routes/admin/vehicles.ts
View File

@@ -1,13 +1,13 @@
import { FastifyInstance } from 'fastify';
import prisma from '../../config/database';
import { requirePermission } from '../../middleware/auth';
import { requireAuth, requirePermission } from '../../middleware/auth';
import { logAudit } from '../../services/audit';
import { success, error, parseId } from '../../utils/response';
import { parseBody } from '../../schemas/common';
import { CreateVehicleSchema, UpdateVehicleSchema } from '../../schemas/vehicles.schema';
export default async function vehiclesRoutes(fastify: FastifyInstance): Promise<void> {
fastify.get('/', { preHandler: requirePermission('trips.vehicles') }, async (_request, reply) => {
fastify.get('/', { preHandler: requireAuth }, async (_request, reply) => {
const vehicles = await prisma.vehicles.findMany({ orderBy: { name: 'asc' } });
// Compute current_km and trip_count from trips table