kavehhn/gameno-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(perm): allow array of permissions in permissionMiddleware and accept classes:update or classes:delete

Browse Source
This commit is contained in:
kavehhn
2026-08-21 13:35:16 +03:30
parent e34fd25af7
commit cbcf3f55db
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/classes/classRoutes.js
+2 -2
View File
@@ -23,8 +23,8 @@ router.get('/admin/get-all', perm.requires(PERMISSIONS.CLASSES_READ), classContr
router.get('/admin/get-one/:id', perm.requires(PERMISSIONS.CLASSES_READ), classController.getOne);
router.post('/admin/create', perm.requires(PERMISSIONS.CLASSES_CREATE), classController.create);
router.put('/admin/update/:id', perm.requires(PERMISSIONS.CLASSES_UPDATE), classController.update);
router.delete('/admin/delete/:id', perm.requires(PERMISSIONS.CLASSES_DELETE), classController.delete);
router.post('/admin/restore/:id', perm.requires(PERMISSIONS.CLASSES_DELETE), classController.restore);
router.delete('/admin/delete/:id', perm.requires([PERMISSIONS.CLASSES_DELETE, PERMISSIONS.CLASSES_UPDATE]), classController.delete);
router.post('/admin/restore/:id', perm.requires([PERMISSIONS.CLASSES_DELETE, PERMISSIONS.CLASSES_UPDATE]), classController.restore);
router.post('/admin/:id/register-users', perm.requires(PERMISSIONS.CLASSES_REGISTER_USERS), classController.registerUsers);
router.delete('/admin/:id/students/:userId', perm.requires(PERMISSIONS.CLASSES_REGISTER_USERS), classController.removeUser);
middlewares/permissionMiddleware.js
+3 -2
View File
@@ -3,6 +3,7 @@
const AppError = require('../utils/AppError');
const requirePermission = (requiredPermission) => {
const perms = Array.isArray(requiredPermission) ? requiredPermission : [requiredPermission];
return (req, res, next) => {
try {
if (!req.user) {
@@ -19,8 +20,8 @@ const requirePermission = (requiredPermission) => {
return next();
}
// Check if required permission is held by role
if (Array.isArray(role.permissions) && role.permissions.includes(requiredPermission)) {
// Check if any required permission is held by role
if (Array.isArray(role.permissions) && perms.some((p) => role.permissions.includes(p))) {
return next();
}