melabidi/carmanagement
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

apply security fix
Build & Push / Build & Push Docker Image (push) Failing after 3m46s
Details

Browse Source
This commit is contained in:
root
2026-07-19 22:22:33 -04:00
parent ec03e783e5
commit a010ad6811
41 changed files with 626 additions and 224 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/modules/team/team.routes.ts
+9 -9
View File
@@ -1,7 +1,7 @@
import { Router } from 'express'
import { requireCompanyAuth } from '../../middleware/requireCompanyAuth'
import { requireTenant } from '../../middleware/requireTenant'
import { requireSubscription } from '../../middleware/requireSubscription'
import { requireSubscriptionRead, requireSubscriptionWrite } from '../../middleware/requireSubscription'
import { requireRole } from '../../middleware/requireRole'
import { parseBody, parseParams } from '../../http/validate'
import { ok, created } from '../../http/respond'
@@ -10,28 +10,28 @@ import { inviteSchema, roleSchema, idParamSchema } from './team.schemas'
const router = Router()
router.use(requireCompanyAuth, requireTenant, requireSubscription)
router.use(requireCompanyAuth, requireTenant, requireSubscriptionRead)
router.get('/', async (req, res, next) => {
router.get('/', requireRole('MANAGER'), async (req, res, next) => {
try {
ok(res, await service.getMembers(req.companyId))
} catch (err) { next(err) }
})
router.get('/stats', async (req, res, next) => {
router.get('/stats', requireRole('MANAGER'), async (req, res, next) => {
try {
ok(res, await service.getMemberStats(req.companyId))
} catch (err) { next(err) }
})
router.post('/invite', requireRole('OWNER'), async (req, res, next) => {
router.post('/invite', requireSubscriptionWrite, requireRole('OWNER'), async (req, res, next) => {
try {
const body = parseBody(inviteSchema, req)
created(res, { data: await service.inviteEmployee(req.companyId, req.employee.id, body) })
} catch (err) { next(err) }
})
router.patch('/:id/role', requireRole('OWNER'), async (req, res, next) => {
router.patch('/:id/role', requireSubscriptionWrite, requireRole('OWNER'), async (req, res, next) => {
try {
const { id } = parseParams(idParamSchema, req)
const { role } = parseBody(roleSchema, req)
@@ -39,21 +39,21 @@ router.patch('/:id/role', requireRole('OWNER'), async (req, res, next) => {
} catch (err) { next(err) }
})
router.post('/:id/deactivate', requireRole('OWNER'), async (req, res, next) => {
router.post('/:id/deactivate', requireSubscriptionWrite, requireRole('OWNER'), async (req, res, next) => {
try {
const { id } = parseParams(idParamSchema, req)
ok(res, await service.deactivateEmployee(req.companyId, req.employee.role, id))
} catch (err) { next(err) }
})
router.post('/:id/reactivate', requireRole('OWNER'), async (req, res, next) => {
router.post('/:id/reactivate', requireSubscriptionWrite, requireRole('OWNER'), async (req, res, next) => {
try {
const { id } = parseParams(idParamSchema, req)
ok(res, await service.reactivateEmployee(req.companyId, req.employee.role, id))
} catch (err) { next(err) }
})
router.delete('/:id', requireRole('OWNER'), async (req, res, next) => {
router.delete('/:id', requireSubscriptionWrite, requireRole('OWNER'), async (req, res, next) => {
try {
const { id } = parseParams(idParamSchema, req)
ok(res, await service.removeEmployee(req.companyId, req.employee.role, id))