Merge pull request 'fix: project list uses RBAC filtering instead of ownerId' (#25) from fix/project-list-rbac into main
This commit is contained in:
@@ -2,9 +2,9 @@ import type { FastifyInstance } from 'fastify';
|
|||||||
import type { ProjectService } from '../services/project.service.js';
|
import type { ProjectService } from '../services/project.service.js';
|
||||||
|
|
||||||
export function registerProjectRoutes(app: FastifyInstance, service: ProjectService): void {
|
export function registerProjectRoutes(app: FastifyInstance, service: ProjectService): void {
|
||||||
app.get('/api/v1/projects', async (request) => {
|
app.get('/api/v1/projects', async () => {
|
||||||
// If authenticated, filter by owner; otherwise list all
|
// RBAC preSerialization hook handles access filtering
|
||||||
return service.list(request.userId);
|
return service.list();
|
||||||
});
|
});
|
||||||
|
|
||||||
app.get<{ Params: { id: string } }>('/api/v1/projects/:id', async (request) => {
|
app.get<{ Params: { id: string } }>('/api/v1/projects/:id', async (request) => {
|
||||||
|
|||||||
Reference in New Issue
Block a user