update

backend/src/controllers/incident.controller.ts

@@ -2,7 +2,7 @@ import { Request, Response } from 'express';
 import incidentService from '../services/incident.service';
 import logger from '../utils/logger';
 import { AppError } from '../middleware/error.middleware';
-import { AppRole, hasPermission } from '../middleware/rbac.middleware';
+import { AppRole, hasPermission, resolveRequestRole } from '../middleware/rbac.middleware';
 import {
   CreateEinsatzSchema,
   UpdateEinsatzSchema,
@@ -75,16 +75,22 @@ class IncidentController {
   async getIncident(req: AuthenticatedRequest, res: Response): Promise<void> {
     try {
       const { id } = req.params as Record<string, string>;
+
+      // UUID validation
+      if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) {
+        res.status(400).json({ success: false, message: 'Ungültige Einsatz-ID' });
+        return;
+      }
+
       const incident = await incidentService.getIncidentById(id);
 
       if (!incident) {
         throw new AppError('Einsatz nicht gefunden', 404);
       }
 
-      // Role-based redaction: only Kommandant+ can see full bericht_text
-      const canReadBerichtText =
-        req.userRole !== undefined &&
-        hasPermission(req.userRole, 'incidents:read_bericht_text');
+      // Role-based redaction: self-contained role resolution (no middleware dependency)
+      const role = resolveRequestRole(req);
+      const canReadBerichtText = hasPermission(role, 'incidents:read_bericht_text');
 
       const responseData = {
         ...incident,