Changeset 98ecf51 in Klonkt for src/middleware/auth.js

Timestamp:

06/18/2026 03:19:09 AM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

7881080

Parents:

6a2abb1

Message:

Hub #1+#2: site admin permissions work + assign owner to another user

#1 — canAdminSite was reading user.siteRoles which was NEVER populated (dead
code) → only god and the literal owner passed admin checks. Now canAdminSite
queries site_members directly (an assigned co-admin). requireSiteManager/BySlug
use canAdminSite so collaborators can access site management too.

#2 — owner_id was hard-coded to the creating god → you couldn't assign a site to
another user (the core of hub mode was missing). Now: god-only "Owner" select in
the site form; create/save set owner_id + a site_members-admin row for that owner
(upsert). Non-god doesn't see the field and cannot change the owner.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@…>

File:

• src/middleware/auth.js (modified) (3 diffs)

src/middleware/auth.js

@@ -4 +4 @@
 
 import db from '../config/database.js';
+import PermissionsService from '../services/PermissionsService.js';
 
 /**
@@ -65 +66 @@
   if (u.role === 'god' || u.role === 'kijker') return next(); // kijker = alleen-lezen kijk-toegang
   const site = res.locals.site;
-  if (site && site.owner_id === u.id) return next();
+  // owner OF toegewezen mede-beheerder (site_members) — canAdminSite dekt beide.
+  if (site && PermissionsService.canAdminSite(u, site)) return next();
   return res.status(403).send('Geen toegang tot deze site.');
 }
@@ -74 +76 @@
   const u = req.session.user;
   if (u.role === 'god' || u.role === 'kijker') return next(); // kijker = alleen-lezen kijk-toegang
-  const site = db.prepare('SELECT owner_id FROM sites WHERE slug = ?').get(req.params.slug);
-  if (site && site.owner_id === u.id) return next();
+  const site = db.prepare('SELECT id, owner_id FROM sites WHERE slug = ?').get(req.params.slug);
+  if (site && PermissionsService.canAdminSite(u, site)) return next();
   return res.status(403).send('Geen toegang tot deze site.');
 }