25 lines
1.0 KiB
TypeScript
25 lines
1.0 KiB
TypeScript
import { requireAuth } from '~/server/utils/auth'
|
|
import { prisma } from '~/server/utils/prisma'
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
const user = requireAuth(event)
|
|
const id = getRouterParam(event, 'id')
|
|
if (!id) throw createError({ statusCode: 400, message: 'Canvas ID is required' })
|
|
|
|
const canvas = await prisma.canvas.findUnique({ where: { id } })
|
|
if (!canvas) throw createError({ statusCode: 404, message: 'Canvas not found' })
|
|
|
|
// Allow deletion if owner OR if user is admin
|
|
const isOwner = canvas.ownerId === user.id
|
|
const isAdmin = user.role === 'admin'
|
|
|
|
if (!isOwner && !isAdmin) {
|
|
console.warn(`[Delete Access Denied] User ${user.id} (${user.role}) tried to delete canvas ${id} owned by ${canvas.ownerId}`)
|
|
throw createError({ statusCode: 403, message: 'У вас нет прав на удаление этой карты. Она принадлежит другому пользователю.' })
|
|
}
|
|
|
|
await prisma.canvas.delete({ where: { id } })
|
|
|
|
return { success: true, message: 'Canvas deleted' }
|
|
})
|