Bugfixing

server/api/membership/applications.get.js

@@ -1,15 +1,11 @@
 import fs from 'fs/promises'
 import path from 'path'
+import { requireUserWithAnyRole } from '../../utils/auth.js'
 import { decryptObject } from '../../utils/encryption.js'
 
 export default defineEventHandler(async (event) => {
   try {
-    // Nur Vorstand oder Admin darf Mitgliedschaftsantraege lesen
-    const token = getCookie(event, 'auth_token')
-    const currentUser = token ? await getUserFromToken(token) : null
-    if (!currentUser || !hasAnyRole(currentUser, 'admin', 'vorstand')) {
-      throw createError({ statusCode: 403, statusMessage: 'Zugriff verweigert' })
-    }
+    await requireUserWithAnyRole(event, 'admin', 'vorstand')
 
     const config = useRuntimeConfig()
     const encryptionKey = config.encryptionKey || 'local_development_encryption_key_change_in_production'

server/api/membership/update-status.put.js

@@ -1,10 +1,13 @@
 import fs from 'fs/promises'
 import path from 'path'
+import { requireUserWithAnyRole } from '../../utils/auth.js'
 import { decryptObject } from '../../utils/encryption.js'
 import { saveMember } from '../../utils/members.js'
 
 export default defineEventHandler(async (event) => {
   try {
+    await requireUserWithAnyRole(event, 'admin', 'vorstand')
+
     const { id, status, notes } = await readBody(event)
     
     if (!id || !status) {