From db373136316d573d768c55aff0f12fe50c1c6389 Mon Sep 17 00:00:00 2001 From: lorentz Date: Tue, 7 Jul 2026 00:48:00 +0000 Subject: [PATCH] fix(tasks): allow self-referencing userId filter for non-privileged users Advocates could not filter their own task list by client because the /api/tasks endpoint treated any userId query param as a request to view another user's tasks, rejecting non-Admin/Manager callers with 403 even when userId matched their own session id. --- ondeck/src/app/api/tasks/route.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ondeck/src/app/api/tasks/route.ts b/ondeck/src/app/api/tasks/route.ts index be2f3b9..87922b5 100644 --- a/ondeck/src/app/api/tasks/route.ts +++ b/ondeck/src/app/api/tasks/route.ts @@ -81,7 +81,8 @@ export async function GET(request: NextRequest) { } if (viewUserId) { const userRoles = (session.user as any).roles || [] - if (!userRoles.includes('Admin') && !userRoles.includes('Manager')) { + const isSelf = viewUserId === (session.user as any).id + if (!isSelf && !userRoles.includes('Admin') && !userRoles.includes('Manager')) { return NextResponse.json({ error: 'Forbidden' }, { status: 403 }) } where.assignments = { some: { userId: viewUserId } }