lorentz/seubert-claims
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(tasks): allow self-referencing userId filter for non-privileged users

Browse source 
Advocates could not filter their own task list by client because the
/api/tasks endpoint treated any userId query param as a request to
view another user's tasks, rejecting non-Admin/Manager callers with
403 even when userId matched their own session id.
This commit is contained in:
lorentz 2026-07-07 00:48:00 +00:00
parent b1b0dfa64d
commit db37313631
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
ondeck/src/app/api/tasks/route.ts
View file

@ -81,7 +81,8 @@ export async function GET(request: NextRequest) {
} }
if (viewUserId) { if (viewUserId) {
const userRoles = (session.user as any).roles || [] const userRoles = (session.user as any).roles || []
if (!userRoles.includes('Admin') && !userRoles.includes('Manager')) { const isSelf = viewUserId === (session.user as any).id
if (!isSelf && !userRoles.includes('Admin') && !userRoles.includes('Manager')) {
return NextResponse.json({ error: 'Forbidden' }, { status: 403 }) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
} }
where.assignments = { some: { userId: viewUserId } } where.assignments = { some: { userId: viewUserId } }