diff --git a/backend/routes/clubRoutes.js b/backend/routes/clubRoutes.js index e3febc99..6ea54b34 100644 --- a/backend/routes/clubRoutes.js +++ b/backend/routes/clubRoutes.js @@ -7,11 +7,12 @@ const router = express.Router(); router.get('/', authenticate, getClubs); router.post('/', authenticate, addClub); -router.put('/:clubid/settings', authenticate, updateClubSettings); -router.get('/:clubid', authenticate, getClub); +// Spezifische Routen VOR generischem /:clubid router.get('/request/:clubid', authenticate, requestClubAccess); router.get('/pending/:clubid', authenticate, authorize('approvals', 'read'), getPendingApprovals); router.post('/approve', authenticate, authorize('approvals', 'write'), approveClubAccess); -router.post('/reject', authenticate, authorize('approvals', 'write'), rejectClubAccess); +router.post('/reject', authenticate, authorize('approvals', 'write'), rejectClubAccess); +router.put('/:clubid/settings', authenticate, updateClubSettings); +router.get('/:clubid', authenticate, getClub); export default router; diff --git a/frontend/src/store.js b/frontend/src/store.js index 63523305..60d6c770 100644 --- a/frontend/src/store.js +++ b/frontend/src/store.js @@ -54,6 +54,9 @@ const store = createStore({ } state.currentClub = null; safeSessionStorage.removeItem('currentClub'); + // Permissions sind user-spezifisch -> immer zurücksetzen, wenn Token gesetzt wird + state.permissions = {}; + safeLocalStorage.removeItem('clubPermissions'); }, setUsername(state, username) { state.username = username; @@ -145,6 +148,7 @@ const store = createStore({ async login({ commit }, { token, username }) { commit('setToken', token); commit('setUsername', username); + commit('clearPermissions'); const response = await apiClient.get('/clubs'); commit('setClubsMutation', response.data); }, diff --git a/frontend/src/views/ClubView.vue b/frontend/src/views/ClubView.vue index b1755485..cf272ad7 100644 --- a/frontend/src/views/ClubView.vue +++ b/frontend/src/views/ClubView.vue @@ -124,9 +124,16 @@ export default { async loadClub() { try { const clubId = this.getClubId(); + // Wenn keine Berechtigung: Clubnamen aus der Liste verwenden, kein /clubs/:id Request + if (!this.canAccessClub()) { + const club = this.clubs.find(c => String(c.id) === String(clubId)); + this.club = club || { name: '' }; + this.accessAllowed = false; + return; + } const response = await apiClient.get(`/clubs/${clubId}`); this.club = response.data || { name: '' }; - this.accessAllowed = this.canAccessClub(); + this.accessAllowed = true; } catch (error) { this.accessAllowed = false; const message = safeErrorMessage(error, this.$t('club.accessDenied'));