cat/Kanban
Private
Public Access
1
0
Fork 0
Code Activity

Phase 3: Roles & permissions enforcement with guards, member management, and admin panel

Browse Source 
Centralize permission checks into guards.ts (requireAuth, requireBoardView,
requireBoardEditor, requireBoardOwner, requireColumnEditor, requireCardEditor,
requireBoardMemberManager, requireTenantAdmin) that fetch entities and check
permissions in a single call, replacing ~100 lines of duplicated inline checks
across all API routes. Adds board member management (add by email, change role,
remove with last-owner protection), tenant admin panel (user role toggle with
last-admin protection, board overview), and fixes missing view guard on card GET.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Catherine Renelle
2026-02-25 23:13:29 -05:00
parent bd12160ebb
commit 9b5708af64
18 changed files with 747 additions and 182 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/routes/api/boards/[boardId]/+server.ts
+4 -59
View File
@@ -2,6 +2,7 @@ import { json, error } from '@sveltejs/kit';
import type { RequestHandler } from './$types.js';
import { boardSchema } from '$lib/server/validation.js';
import { withTenant } from '$lib/server/rls.js';
import { requireBoardView, requireBoardEditor, requireBoardOwner } from '$lib/server/guards.js';
// Get single board with all columns and cards
export const GET: RequestHandler = async ({ params, locals }) => {
@@ -9,43 +10,9 @@ export const GET: RequestHandler = async ({ params, locals }) => {
if (!tenant) throw error(400, 'Unknown tenant');
const board = await withTenant(tenant.id, async (tx) => {
return tx.board.findFirst({
where: { id: params.boardId, tenantId: tenant.id },
include: {
columns: {
orderBy: { position: 'asc' },
include: {
cards: {
where: { archived: false },
orderBy: { position: 'asc' },
include: {
assignees: {
include: { user: { select: { id: true, name: true, avatarUrl: true } } }
},
labels: { include: { tag: true } },
_count: { select: { comments: true, checklists: true, attachments: true } }
}
}
}
},
members: {
include: { user: { select: { id: true, name: true, email: true, avatarUrl: true } } }
}
}
});
return requireBoardView(tx, locals.user, params.boardId, tenant.id);
});
if (!board) throw error(404, 'Board not found');
// Check access
if (board.visibility === 'PRIVATE') {
if (!locals.user) throw error(401, 'Not authenticated');
const isMember = board.members.some((m) => m.userId === locals.user!.id);
const isAdmin =
locals.user.globalRole === 'SITE_ADMIN' || locals.user.tenantRole === 'ADMIN';
if (!isMember && !isAdmin) throw error(403, 'Access denied');
}
return json({ board });
};
@@ -53,7 +20,6 @@ export const GET: RequestHandler = async ({ params, locals }) => {
export const PATCH: RequestHandler = async ({ params, request, locals }) => {
const tenant = locals.tenant;
if (!tenant) throw error(400, 'Unknown tenant');
if (!locals.user) throw error(401, 'Not authenticated');
const body = await request.json();
const result = boardSchema.partial().safeParse(body);
@@ -62,17 +28,7 @@ export const PATCH: RequestHandler = async ({ params, request, locals }) => {
}
const updated = await withTenant(tenant.id, async (tx) => {
const board = await tx.board.findFirst({
where: { id: params.boardId, tenantId: tenant.id },
include: { members: true }
});
if (!board) throw error(404, 'Board not found');
const member = board.members.find((m) => m.userId === locals.user!.id);
const isAdmin =
locals.user!.globalRole === 'SITE_ADMIN' || locals.user!.tenantRole === 'ADMIN';
if (!member && !isAdmin) throw error(403, 'Access denied');
if (member && member.role === 'VIEWER') throw error(403, 'Viewers cannot edit boards');
await requireBoardEditor(tx, locals.user, params.boardId, tenant.id);
return tx.board.update({
where: { id: params.boardId },
@@ -87,20 +43,9 @@ export const PATCH: RequestHandler = async ({ params, request, locals }) => {
export const DELETE: RequestHandler = async ({ params, locals }) => {
const tenant = locals.tenant;
if (!tenant) throw error(400, 'Unknown tenant');
if (!locals.user) throw error(401, 'Not authenticated');
await withTenant(tenant.id, async (tx) => {
const board = await tx.board.findFirst({
where: { id: params.boardId, tenantId: tenant.id },
include: { members: true }
});
if (!board) throw error(404, 'Board not found');
const member = board.members.find((m) => m.userId === locals.user!.id);
const isAdmin =
locals.user!.globalRole === 'SITE_ADMIN' || locals.user!.tenantRole === 'ADMIN';
if (member?.role !== 'OWNER' && !isAdmin) throw error(403, 'Only owners can delete boards');
await requireBoardOwner(tx, locals.user, params.boardId, tenant.id);
await tx.board.delete({ where: { id: params.boardId } });
});