dfmsolutions/schulos
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add 8 files, update 14 files

Browse Source
This commit is contained in:
[dyad] committed 2026-08-02 14:00:21 +02:00
1 parent 669e029f45
commit c84b080fb8
22 files changed
+732 -101
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/app/api/users/[id]/route.ts
+13
View File
@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server';
import { z } from 'zod';
import { db } from '@/lib/db';
import { getSession } from '@/lib/auth';
import { canManageUser } from '@/lib/role-access';
const updateUserSchema = z.object({
firstName: z.string().min(1).optional(),
@@ -56,6 +57,10 @@ export async function GET(
return NextResponse.json({ error: 'User not found' }, { status: 404 });
}
if (!canManageUser(session.user?.role, user.role, user.id === session.userId)) {
return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
}
// School admins can only access users from their own school
if (
session.user?.role === 'SCHOOL_ADMIN' &&
@@ -108,6 +113,10 @@ export async function PUT(
return NextResponse.json({ error: 'User not found' }, { status: 404 });
}
if (!canManageUser(session.user?.role, existing.role, id === session.userId)) {
return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
}
// School admins can only edit users from their own school
if (
session.user?.role === 'SCHOOL_ADMIN' &&
@@ -210,6 +219,10 @@ export async function DELETE(
return NextResponse.json({ error: 'User not found' }, { status: 404 });
}
if (!canManageUser(session.user?.role, existing.role, id === session.userId)) {
return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
}
// School admins can only delete users from their own school
if (
session.user?.role === 'SCHOOL_ADMIN' &&
src/app/api/users/route.ts
+6 -11
View File
@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server';
import { z } from 'zod';
import { db } from '@/lib/db';
import { getSession, hashPassword } from '@/lib/auth';
import { isAdministrator } from '@/lib/role-access';
const createUserSchema = z.object({
schoolId: z.string().nullable().optional(),
@@ -31,8 +32,7 @@ export async function GET(request: Request) {
if (
session.user?.role !== 'SUPER_ADMIN' &&
session.user?.role !== 'SCHOOL_ADMIN' &&
session.user?.role !== 'TEACHER'
session.user?.role !== 'SCHOOL_ADMIN'
) {
return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
}
@@ -113,8 +113,7 @@ export async function POST(request: Request) {
if (body.action === 'bulkCreateStudents') {
if (
session.user?.role !== 'SUPER_ADMIN' &&
session.user?.role !== 'SCHOOL_ADMIN' &&
session.user?.role !== 'TEACHER'
session.user?.role !== 'SCHOOL_ADMIN'
) {
return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
}
@@ -212,8 +211,7 @@ export async function POST(request: Request) {
// ── Single user creation ──
if (
session.user?.role !== 'SUPER_ADMIN' &&
session.user?.role !== 'SCHOOL_ADMIN' &&
session.user?.role !== 'TEACHER'
session.user?.role !== 'SCHOOL_ADMIN'
) {
return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
}
@@ -228,7 +226,7 @@ export async function POST(request: Request) {
const { password, studentId, ...userData } = parsed.data;
// School admins can only create users in their own school
// Administrators can only create users in their own school.
if (
session.user?.role === 'SCHOOL_ADMIN' &&
session.user?.schoolId &&
@@ -242,10 +240,7 @@ export async function POST(request: Request) {
}
// School admins cannot create super admin accounts
if (
session.user?.role === 'SCHOOL_ADMIN' &&
userData.role === 'SUPER_ADMIN'
) {
if (session.user?.role === 'SCHOOL_ADMIN' && userData.role === 'SUPER_ADMIN') {
return NextResponse.json(
{ error: 'Cannot create super admin accounts' },
{ status: 403 }