Michilis/Spanglish
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 9 Wiki Activity

Merge pull request 'Assert partner and member route params in finance handlers.' (#40) from dev into main

Browse Source 
Reviewed-on: #40
This commit was merged in pull request #40.
This commit is contained in:
Michilis
2026-10-03 05:20:49 +00:00
parent 9087650e4c 33783d8712
commit 86f85369ec
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/routes/eventFinance.ts
+2 -2
View File
@@ -597,7 +597,7 @@ financeRouter.delete('/:id/partners/:partnerId', requireEventPermission('edit_ex
const eventId = c.req.param('id')!; const eventId = c.req.param('id')!;
const closed = await assertOpen(c, eventId); const closed = await assertOpen(c, eventId);
if (closed) return closed; if (closed) return closed;
const existing = await loadPartner(eventId, c.req.param('partnerId')); const existing = await loadPartner(eventId, c.req.param('partnerId')!);
if (!existing) return c.json({ error: 'Partner not found' }, 404); if (!existing) return c.json({ error: 'Partner not found' }, 404);
const fronted = await dbGet<any>( const fronted = await dbGet<any>(
(db as any).select({ id: (eventExpenses as any).id }).from(eventExpenses).where(eq((eventExpenses as any).paidByPartnerId, existing.id)) (db as any).select({ id: (eventExpenses as any).id }).from(eventExpenses).where(eq((eventExpenses as any).paidByPartnerId, existing.id))
@@ -922,7 +922,7 @@ financeRouter.put('/:id/members/:memberId', requireEventPermission('manage_team'
financeRouter.delete('/:id/members/:memberId', requireEventPermission('manage_team'), async (c) => { financeRouter.delete('/:id/members/:memberId', requireEventPermission('manage_team'), async (c) => {
const eventId = c.req.param('id')!; const eventId = c.req.param('id')!;
const existing = await loadMember(eventId, c.req.param('memberId')); const existing = await loadMember(eventId, c.req.param('memberId')!);
if (!existing) return c.json({ error: 'Member not found' }, 404); if (!existing) return c.json({ error: 'Member not found' }, 404);
const user = currentUser(c); const user = currentUser(c);
const target = await loadUser(existing.userId); const target = await loadUser(existing.userId);