songtianlun/prmbr-image-mksaas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add session validation for admin access in getUsersAction

Browse Source
This commit is contained in:
javayhu 2025-08-16 22:03:01 +08:00
parent 57b92cfe85
commit 262228d6e9
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/actions/get-users.ts
View File

@ -3,6 +3,7 @@
import { getDb } from '@/db'; import { getDb } from '@/db';
import { user } from '@/db/schema'; import { user } from '@/db/schema';
import { isDemoWebsite } from '@/lib/demo'; import { isDemoWebsite } from '@/lib/demo';
import { getSession } from '@/lib/server';
import { asc, desc, ilike, or, sql } from 'drizzle-orm'; import { asc, desc, ilike, or, sql } from 'drizzle-orm';
import { createSafeActionClient } from 'next-safe-action'; import { createSafeActionClient } from 'next-safe-action';
import { z } from 'zod'; import { z } from 'zod';
@ -42,6 +43,14 @@ const sortFieldMap = {
export const getUsersAction = actionClient export const getUsersAction = actionClient
.schema(getUsersSchema) .schema(getUsersSchema)
.action(async ({ parsedInput }) => { .action(async ({ parsedInput }) => {
const session = await getSession();
if (!session || session.user.role !== 'admin') {
return {
success: false,
error: 'Unauthorized',
};
}
try { try {
const { pageIndex, pageSize, search, sorting } = parsedInput; const { pageIndex, pageSize, search, sorting } = parsedInput;