matthias/dashboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix permissions

Browse Source
This commit is contained in:
Matthias Hochmeister
2026-03-25 08:42:45 +01:00
parent 43b7093996
commit eb92dfcc96
10 changed files with 26 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
backend/src/controllers/booking.controller.ts
View File

@@ -226,8 +226,8 @@ class BookingController {
const isOwner = booking.gebucht_von === req.user!.id;
const groups: string[] = req.user?.groups ?? [];
const isAdmin = groups.includes('dashboard_admin');
const canCancelOwn = isAdmin || permissionService.hasPermission(groups, 'kalender:cancel_own_bookings');
const canCancelAny = isAdmin || permissionService.hasPermission(groups, 'kalender:delete_bookings');
const canCancelOwn = isAdmin || permissionService.hasPermission(groups, 'kalender:manage_bookings');
const canCancelAny = isAdmin || permissionService.hasPermission(groups, 'kalender:manage_bookings');
if (!(isOwner && canCancelOwn) && !canCancelAny) {
res.status(403).json({ success: false, message: 'Keine Berechtigung' });