setia/ims
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: allow admin role to submit triage and investigation API routes

Browse Source 
API routes were hse-only, blocking admin from saving triage/investigation
forms even after the page-level guards were fixed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ
This commit is contained in:
admin
2026-07-13 10:04:32 +08:00
co-authored by Claude Sonnet 4.6
parent e9fd29035a
commit 782a9687e2
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/incidents/[id]/investigation/route.ts
+2 -2
View File
@@ -15,7 +15,7 @@ export async function POST(
const { data: profile } = await supabase const { data: profile } = await supabase
.from('users').select('role').eq('id', user.id).single() .from('users').select('role').eq('id', user.id).single()
if (!profile || profile.role !== 'hse') if (!profile || !['hse', 'admin'].includes(profile.role))
return NextResponse.json({ error: 'Forbidden' }, { status: 403 }) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
const { data: incident } = await supabase const { data: incident } = await supabase
@@ -79,7 +79,7 @@ export async function PATCH(
const { data: profile } = await supabase const { data: profile } = await supabase
.from('users').select('role').eq('id', user.id).single() .from('users').select('role').eq('id', user.id).single()
if (!profile || profile.role !== 'hse') if (!profile || !['hse', 'admin'].includes(profile.role))
return NextResponse.json({ error: 'Forbidden' }, { status: 403 }) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
const body = await request.json() const body = await request.json()
app/api/incidents/[id]/triage/route.ts
+1 -1
View File
@@ -24,7 +24,7 @@ export async function PATCH(
const { data: profile } = await supabase const { data: profile } = await supabase
.from('users').select('role').eq('id', user.id).single() .from('users').select('role').eq('id', user.id).single()
if (!profile || profile.role !== 'hse') if (!profile || !['hse', 'admin'].includes(profile.role))
return NextResponse.json({ error: 'Forbidden' }, { status: 403 }) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
const body: TriageBody = await request.json() const body: TriageBody = await request.json()