57b32debeb
This commit introduces role-based access control for user contact information in the CMS. It updates the user list display to show email and phone details only to users with the 'vorstand' role, while masking this information for others. Additionally, it modifies the API endpoints to ensure that contact data is only returned for authorized users, improving data privacy and security.
49 lines
1.3 KiB
JavaScript
49 lines
1.3 KiB
JavaScript
import { getUserFromToken, readUsers, hasAnyRole, hasRole, migrateUserRoles } from '../../../utils/auth.js'
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
try {
|
|
const token = getCookie(event, 'auth_token')
|
|
const currentUser = await getUserFromToken(token)
|
|
|
|
if (!currentUser || !hasAnyRole(currentUser, 'admin')) {
|
|
throw createError({
|
|
statusCode: 403,
|
|
message: 'Zugriff verweigert'
|
|
})
|
|
}
|
|
|
|
const users = await readUsers()
|
|
|
|
const isVorstand = hasRole(currentUser, 'vorstand')
|
|
|
|
// Return users without Passwörter; Kontaktdaten nur für Vorstand
|
|
const safeUsers = users.map(u => {
|
|
const migrated = migrateUserRoles({ ...u })
|
|
const roles = Array.isArray(migrated.roles) ? migrated.roles : (migrated.role ? [migrated.role] : ['mitglied'])
|
|
|
|
const email = isVorstand ? u.email : undefined
|
|
const phone = isVorstand ? (u.phone || '') : undefined
|
|
|
|
return {
|
|
id: u.id,
|
|
email,
|
|
name: u.name,
|
|
roles: roles,
|
|
role: roles[0] || 'mitglied', // Rückwärtskompatibilität
|
|
phone,
|
|
active: u.active,
|
|
created: u.created,
|
|
lastLogin: u.lastLogin
|
|
}
|
|
})
|
|
|
|
return {
|
|
users: safeUsers
|
|
}
|
|
} catch (error) {
|
|
console.error('Fehler beim Laden der Benutzer:', error)
|
|
throw error
|
|
}
|
|
})
|
|
|