Add access control rework

2026-04-02 03:18:37 +02:00
parent 314a26325f
commit 37cac95b38
111 changed files with 5355 additions and 1892 deletions
--- a/server/src/routes/join-requests.ts
+++ b/server/src/routes/join-requests.ts
@@ -6,6 +6,7 @@ import {
  updateJoinRequestStatus
 } from '../cqrs';
 import { notifyUser } from '../websocket/broadcast';
+import { resolveServerPermission } from '../services/server-permissions.service';

 const router = Router();

@@ -19,7 +20,7 @@ router.put('/:id', async (req, res) => {

  const server = await getServerById(request.serverId);

-  if (!server || server.ownerId !== ownerId)
+  if (!server || !ownerId || !resolveServerPermission(server, String(ownerId), 'manageServer'))
    return res.status(403).json({ error: 'Not authorized' });

  await updateJoinRequestStatus(id, status as JoinRequestPayload['status']);