gitea_admin/maestro
1
0
Fork 0
mirror of https://github.com/dadosfera/maestro.git synced 2026-09-14 22:04:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

FEAT: protected update route with admin seqid or if user request to equal a jwt user id claim

Browse Source
This commit is contained in:
Marcos Rodrigues
2025-12-18 12:32:53 -03:00
parent 61109f8ae9
commit 8b93d4e97b
3 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/modules/users/users.controller.ts
+4 -1
View File
@@ -266,7 +266,6 @@ export class UsersController {
}
@Patch(':id')
@RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
@ApiOkResponse({ type: UpdateUserRes })
async updateUser(
@User() user: RequestUser,
@@ -274,6 +273,10 @@ export class UsersController {
@Param('id') id: string,
@Language() language: LanguageEnum,
) {
if (user.user_id !== id || !user.permissions.includes(PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid)) {
throw new ErrorBuilder(ErrorCodes.AUTH.FORBIDDEN);
}
this.logger.info('updateUser', { user });
this.userService.setLanguage(language);
return await this.userService.updateUser(body, id, user.customer_id);