fixed a bit

This commit is contained in:
bobbert committed 2025-03-11 20:25:40 +00:00
1 parent 22119dbf6f
commit e9d831c0a2
2 files changed
+48 -3

No files matched your search

+7 -3
View File
@@ -1,7 +1,7 @@
// app/api/teams/[teamId]/members/route.js
import { query } from '../../../../../lib/db';
import { getServerSession } from 'next-auth/next';
import { authOptions } from '../../../auth/[...nextauth]/route';
import { authOptions } from '../../../api/auth/[...nextauth]/route';
export async function GET(request, { params }) {
const session = await getServerSession(authOptions);
@@ -13,14 +13,18 @@ export async function GET(request, { params }) {
try {
const { teamId } = params;
// Convert teamId to number for proper comparison
const requestedTeamId = parseInt(teamId, 10);
const userTeamId = parseInt(session.user.teamId, 10);
// Ensure the user is requesting their own team or is an admin
if (session.user.teamId != teamId && session.user.role !== 'admin') {
if (userTeamId !== requestedTeamId && session.user.role !== 'admin') {
return Response.json({ error: 'Not authorized to view this team' }, { status: 403 });
}
const members = await query(
'SELECT id, username FROM users WHERE team_id = ?',
[teamId]
[requestedTeamId]
);
return Response.json(members);