Enforce roleId checks on all admin page actions

2026-09-10 14:59:32 -05:00
parent 0cb4b2148a
commit 7596937f30
14 changed files with 217 additions and 112 deletions
@@ -2,12 +2,10 @@ import type { PageServerLoad } from './$types';
 import { error } from '@sveltejs/kit';
 import { prisma } from '$lib/db';
 import { rotateApiKey } from '$lib/server/api-key';
+import { isSuper } from '$lib/server/roles';

-const SUPER = 1;
-
-export const load: PageServerLoad = async ({ parent }) => {
-	const { adminUser } = await parent();
-	if (adminUser.roleId > SUPER) {
+export const load: PageServerLoad = async ({ locals }) => {
+	if (!isSuper(locals)) {
 		throw error(403, 'Only Super admins can manage API keys');
 	}

@@ -39,18 +37,9 @@ export const load: PageServerLoad = async ({ parent }) => {
 	};
 };

-async function viewerRoleId(locals: App.Locals): Promise<number> {
-	if (!locals.user?.id) return 4;
-	const user = await prisma.user.findUnique({
-		where: { id: locals.user.id },
-		select: { roleId: true }
-	});
-	return user?.roleId ?? 4;
-}
-
 export const actions = {
 	rotate: async ({ locals }) => {
-		if ((await viewerRoleId(locals)) > SUPER) {
+		if (!isSuper(locals)) {
 			return { success: false, error: 'Not authorized' };
 		}

@@ -63,7 +52,7 @@ export const actions = {
 		};
 	},
 	rotateEmergency: async ({ locals }) => {
-		if ((await viewerRoleId(locals)) > SUPER) {
+		if (!isSuper(locals)) {
 			return { success: false, error: 'Not authorized' };
 		}