Changeset 98ecf51 in Klonkt for src/services

Timestamp:

06/18/2026 03:19:09 AM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

7881080

Parents:

6a2abb1

Message:

Hub #1+#2: site admin permissions work + assign owner to another user

#1 — canAdminSite was reading user.siteRoles which was NEVER populated (dead
code) → only god and the literal owner passed admin checks. Now canAdminSite
queries site_members directly (an assigned co-admin). requireSiteManager/BySlug
use canAdminSite so collaborators can access site management too.

#2 — owner_id was hard-coded to the creating god → you couldn't assign a site to
another user (the core of hub mode was missing). Now: god-only "Owner" select in
the site form; create/save set owner_id + a site_members-admin row for that owner
(upsert). Non-god doesn't see the field and cannot change the owner.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@…>

File:

• src/services/PermissionsService.js (modified) (2 diffs)

src/services/PermissionsService.js

@@ -3 +3 @@
  * Used in templates to show/hide edit buttons, delete buttons, etc.
  */
+
+import db from '../config/database.js';
 
 class PermissionsService {
@@ -54 +56 @@
    */
   static canAdminSite(user, site) {
-    if (!user) return false;
+    if (!user || !site) return false;
     if (user.role === 'god') return true;
     if (user.id === site.owner_id) return true;
-    // Check site_members table
-    return user.siteRoles && user.siteRoles[site.id] === 'admin';
+    // Toegewezen mede-beheerder (collaborator) via site_members. Dit werd
+    // voorheen via een nooit-gevulde user.siteRoles gelezen → dode code; nu
+    // direct op de tabel (paar checks per pagina, indexed = goedkoop).
+    return !!db.prepare(
+      "SELECT 1 FROM site_members WHERE site_id = ? AND user_id = ? AND role = 'admin' LIMIT 1"
+    ).get(site.id, user.id);
   }