diff --git a/app/(main)/team/[teamId]/members/route.js b/app/(main)/team/[teamId]/members/route.js index 82bfe29..eaae3c9 100644 --- a/app/(main)/team/[teamId]/members/route.js +++ b/app/(main)/team/[teamId]/members/route.js @@ -1,7 +1,7 @@ // app/api/teams/[teamId]/members/route.js import { query } from '../../../../../lib/db'; import { getServerSession } from 'next-auth/next'; -import { authOptions } from '../../../auth/[...nextauth]/route'; +import { authOptions } from '../../../api/auth/[...nextauth]/route'; export async function GET(request, { params }) { const session = await getServerSession(authOptions); @@ -13,14 +13,18 @@ export async function GET(request, { params }) { try { const { teamId } = params; + // Convert teamId to number for proper comparison + const requestedTeamId = parseInt(teamId, 10); + const userTeamId = parseInt(session.user.teamId, 10); + // Ensure the user is requesting their own team or is an admin - if (session.user.teamId != teamId && session.user.role !== 'admin') { + if (userTeamId !== requestedTeamId && session.user.role !== 'admin') { return Response.json({ error: 'Not authorized to view this team' }, { status: 403 }); } const members = await query( 'SELECT id, username FROM users WHERE team_id = ?', - [teamId] + [requestedTeamId] ); return Response.json(members); diff --git a/app/(main)/team/[teamId]/route.js b/app/(main)/team/[teamId]/route.js new file mode 100644 index 0000000..59ac8b2 --- /dev/null +++ b/app/(main)/team/[teamId]/route.js @@ -0,0 +1,41 @@ +// app/api/teams/[teamId]/route.js +import { queryOne } from '../../../../lib/db'; +import { getServerSession } from 'next-auth/next'; +import { authOptions } from '../../../api/auth/[...nextauth]/route'; + +export async function GET(request, { params }) { + const session = await getServerSession(authOptions); + + if (!session) { + return Response.json({ error: 'Unauthorised' }, { status: 401 }); + } + + try { + const { teamId } = params; + + // Convert teamId to number for proper comparison + const requestedTeamId = parseInt(teamId, 10); + const userTeamId = parseInt(session.user.teamId, 10); + + // Log for debugging + console.log('Requested team:', requestedTeamId); + console.log('User team:', userTeamId); + console.log('User role:', session.user.role); + + // Ensure the user is requesting their own team or is an admin + if (userTeamId !== requestedTeamId && session.user.role !== 'admin') { + return Response.json({ error: 'Not authorized to view this team' }, { status: 403 }); + } + + const team = await queryOne('SELECT * FROM teams WHERE id = ?', [requestedTeamId]); + + if (!team) { + return Response.json({ error: 'Team not found' }, { status: 404 }); + } + + return Response.json(team); + } catch (error) { + console.error('Team fetch error:', error); + return Response.json({ error: 'Failed to fetch team details' }, { status: 500 }); + } +} \ No newline at end of file