feat: visual access control in FlowEditor (read-only mode for viewers)

app/server/api/canvas/[id].delete.ts

@@ -9,13 +9,23 @@ export default defineEventHandler(async (event) => {
   const canvas = await prisma.canvas.findUnique({ where: { id } })
   if (!canvas) throw createError({ statusCode: 404, message: 'Canvas not found' })
   
-  // Allow deletion if owner OR if user is admin
-  const isOwner = canvas.ownerId === user.id
-  const isAdmin = user.role === 'admin'
+  // 1. Проверка прав
+  let canDelete = canvas.ownerId === user.id || user.role === 'admin'
 
-  if (!isOwner && !isAdmin) {
-    console.warn(`[Delete Access Denied] User ${user.id} (${user.role}) tried to delete canvas ${id} owned by ${canvas.ownerId}`)
-    throw createError({ statusCode: 403, message: 'У вас нет прав на удаление этой карты. Она принадлежит другому пользователю.' })
+  if (!canDelete && canvas.groupId) {
+    const membership = await prisma.groupMember.findUnique({
+      where: {
+        userId_groupId: { userId: user.id, groupId: canvas.groupId }
+      }
+    })
+    // Только админ группы может удалять чужие карты внутри группы
+    if (membership && membership.role === 'admin') {
+      canDelete = true
+    }
+  }
+
+  if (!canDelete) {
+    throw createError({ statusCode: 403, message: 'Удалять карты может только владелец или администратор группы.' })
   }
 
   await prisma.canvas.delete({ where: { id } })

app/server/api/canvas/[id].get.ts

@@ -8,18 +8,21 @@ export default defineEventHandler(async (event) => {
   const canvas = await prisma.canvas.findUnique({ where: { id } })
   if (!canvas) throw createError({ statusCode: 404, message: 'Canvas not found' })
 
-  if (canvas.isPublic) return canvas
+  const user = tryLazyEventHandler(event, () => requireAuth(event)) || { id: null, role: 'guest' }
 
-  const user = requireAuth(event)
-
-  if (canvas.ownerId === user.id) return canvas
-
-  if (canvas.groupId) {
+  // Определение роли
+  let userRole = 'viewer'
+  if (user.id === canvas.ownerId) userRole = 'owner'
+  else if (user.role === 'admin') userRole = 'admin'
+  else if (canvas.groupId) {
     const membership = await prisma.groupMember.findUnique({
-      where: { userId_groupId: { userId: user.id, groupId: canvas.groupId } }
+      where: { userId_groupId: { userId: user.id as string, groupId: canvas.groupId } }
     })
-    if (membership) return canvas
+    if (membership) userRole = membership.role
+    else if (!canvas.isPublic) throw createError({ statusCode: 403, message: 'Access denied' })
+  } else if (!canvas.isPublic) {
+    throw createError({ statusCode: 403, message: 'Access denied' })
   }
 
-  throw createError({ statusCode: 403, message: 'Access denied' })
+  return { canvas, role: userRole }
 })

app/server/api/canvas/[id].put.ts

@@ -11,10 +11,23 @@ export default defineEventHandler(async (event) => {
   const existing = await prisma.canvas.findUnique({ where: { id } })
   if (!existing) throw createError({ statusCode: 404, message: 'Canvas not found' })
   
-  // Allow if owner, or if admin, or if canvas is public (for collaborative editing)
-  if (existing.ownerId !== user.id && user.role !== 'admin' && !existing.isPublic) {
-    console.log('[DEBUG 403]', { ownerId: existing.ownerId, userId: user.id, userRole: user.role, isPublic: existing.isPublic })
-    throw createError({ statusCode: 403, message: 'Access denied' })
+  // 1. Проверка прав
+  let canEdit = existing.ownerId === user.id || user.role === 'admin' || existing.isPublic
+
+  if (!canEdit && existing.groupId) {
+    const membership = await prisma.groupMember.findUnique({
+      where: {
+        userId_groupId: { userId: user.id, groupId: existing.groupId }
+      }
+    })
+    // Редакторы и админы группы могут править
+    if (membership && (membership.role === 'admin' || membership.role === 'editor')) {
+      canEdit = true
+    }
+  }
+
+  if (!canEdit) {
+    throw createError({ statusCode: 403, message: 'У вас недостаточно прав для редактирования этой карты' })
   }
 
   const { name, nodes, edges, isPublic, groupId } = body