From 782a9687e29ea29bba2079d84d9d8ddba408e709 Mon Sep 17 00:00:00 2001 From: weeihan Date: Mon, 13 Jul 2026 10:04:32 +0800 Subject: [PATCH] fix: allow admin role to submit triage and investigation API routes API routes were hse-only, blocking admin from saving triage/investigation forms even after the page-level guards were fixed. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ --- app/api/incidents/[id]/investigation/route.ts | 4 ++-- app/api/incidents/[id]/triage/route.ts | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/app/api/incidents/[id]/investigation/route.ts b/app/api/incidents/[id]/investigation/route.ts index a2adba2..bfb9d3d 100644 --- a/app/api/incidents/[id]/investigation/route.ts +++ b/app/api/incidents/[id]/investigation/route.ts @@ -15,7 +15,7 @@ export async function POST( const { data: profile } = await supabase .from('users').select('role').eq('id', user.id).single() - if (!profile || profile.role !== 'hse') + if (!profile || !['hse', 'admin'].includes(profile.role)) return NextResponse.json({ error: 'Forbidden' }, { status: 403 }) const { data: incident } = await supabase @@ -79,7 +79,7 @@ export async function PATCH( const { data: profile } = await supabase .from('users').select('role').eq('id', user.id).single() - if (!profile || profile.role !== 'hse') + if (!profile || !['hse', 'admin'].includes(profile.role)) return NextResponse.json({ error: 'Forbidden' }, { status: 403 }) const body = await request.json() diff --git a/app/api/incidents/[id]/triage/route.ts b/app/api/incidents/[id]/triage/route.ts index 3cf98a4..1f1abbc 100644 --- a/app/api/incidents/[id]/triage/route.ts +++ b/app/api/incidents/[id]/triage/route.ts @@ -24,7 +24,7 @@ export async function PATCH( const { data: profile } = await supabase .from('users').select('role').eq('id', user.id).single() - if (!profile || profile.role !== 'hse') + if (!profile || !['hse', 'admin'].includes(profile.role)) return NextResponse.json({ error: 'Forbidden' }, { status: 403 }) const body: TriageBody = await request.json()