hotel-manage-stack/hk-planner
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Gate planner config write endpoints with requireCap('planner')

Browse source 
Six PUT /api/config/* routes were missing per-route capability checks —
any authenticated hk-planner user could modify staff, time requirements,
pickup data, tasks, adjustments, and last-reviewed regardless of their cap.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
jtricerolph 2026-07-13 09:24:55 +00:00
parent 2400e224f1
commit e4e6958ff9
1 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
backend/src/routes/config.js
View file

@ -42,7 +42,7 @@ export async function configRoutes(app) {
// ── PUT /api/config/time-requirements ────────────────────────────────────
app.put('/api/config/time-requirements', async (req, reply) => {
app.put('/api/config/time-requirements', { preHandler: requireCap('planner') }, async (req, reply) => {
const { cat, action, value } = req.body || {}
if (!cat || !['depart', 'stay', 'arrive'].includes(action)) {
return reply.status(400).send({ error: 'Invalid data' })
@ -57,7 +57,7 @@ export async function configRoutes(app) {
// ── PUT /api/config/staff ─────────────────────────────────────────────────
app.put('/api/config/staff', async (req, reply) => {
app.put('/api/config/staff', { preHandler: requireCap('planner') }, async (req, reply) => {
const { staff_data } = req.body || {}
if (!Array.isArray(staff_data)) return reply.status(400).send({ error: 'Invalid data' })
@ -76,7 +76,7 @@ export async function configRoutes(app) {
// ── PUT /api/config/pickup ────────────────────────────────────────────────
app.put('/api/config/pickup', async (req, reply) => {
app.put('/api/config/pickup', { preHandler: requireCap('planner') }, async (req, reply) => {
const { pickup_data } = req.body || {}
if (!pickup_data || typeof pickup_data !== 'object') {
return reply.status(400).send({ error: 'Invalid data' })
@ -100,7 +100,7 @@ export async function configRoutes(app) {
// ── PUT /api/config/general-tasks ────────────────────────────────────────
app.put('/api/config/general-tasks', async (req, reply) => {
app.put('/api/config/general-tasks', { preHandler: requireCap('planner') }, async (req, reply) => {
const { general_tasks } = req.body || {}
if (!Array.isArray(general_tasks)) return reply.status(400).send({ error: 'Invalid data' })
@ -118,7 +118,7 @@ export async function configRoutes(app) {
// ── PUT /api/config/last-reviewed ────────────────────────────────────────
app.put('/api/config/last-reviewed', async (req, reply) => {
app.put('/api/config/last-reviewed', { preHandler: requireCap('planner') }, async (req, reply) => {
const { date } = req.body || {}
if (!date || !/^\d{4}-\d{2}-\d{2}$/.test(date)) {
return reply.status(400).send({ error: 'Invalid date' })
@ -142,7 +142,7 @@ export async function configRoutes(app) {
// ── PUT /api/config/adjustments ──────────────────────────────────────────
app.put('/api/config/adjustments', async (req, reply) => {
app.put('/api/config/adjustments', { preHandler: requireCap('planner') }, async (req, reply) => {
const { adjustments } = req.body || {}
if (!Array.isArray(adjustments)) return reply.status(400).send({ error: 'Invalid data' })