hotel-manage-stack/auth
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Admins implicitly see all active apps (fixes empty portal for admin)

Browse source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
jtricerolph 2026-07-01 14:59:51 +00:00
parent b7589b702a
commit cd21697af3
1 changed files with 17 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

25
src/routes/auth.js
View file

@ -28,14 +28,23 @@ async function getUserWithApps(userId) {
) )
if (!user) return null if (!user) return null
const { rows: apps } = await pool.query( // Admins implicitly have access to every active app; everyone else sees
`SELECT a.slug, a.name, a.description, a.base_path, a.icon, a.theme_color // only the apps explicitly granted to them via user_app_perms.
FROM apps a const { rows: apps } = user.is_admin
JOIN user_app_perms p ON p.app_id = a.id ? await pool.query(
WHERE p.user_id = $1 AND a.active = true `SELECT a.slug, a.name, a.description, a.base_path, a.icon, a.theme_color
ORDER BY a.name`, FROM apps a
[userId] WHERE a.active = true
) ORDER BY a.name`
)
: await pool.query(
`SELECT a.slug, a.name, a.description, a.base_path, a.icon, a.theme_color
FROM apps a
JOIN user_app_perms p ON p.app_id = a.id
WHERE p.user_id = $1 AND a.active = true
ORDER BY a.name`,
[userId]
)
return { ...user, apps } return { ...user, apps }
} }