42 lines
1.4 KiB
TypeScript
42 lines
1.4 KiB
TypeScript
import { requireAuth } from '~/server/utils/auth'
|
|
import { prisma } from '~/server/utils/prisma'
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
const adminUser = requireAuth(event)
|
|
const groupId = getRouterParam(event, 'id')
|
|
const body = await readBody(event)
|
|
const { userId, role } = body
|
|
|
|
if (!groupId || !userId || !role) {
|
|
throw createError({ statusCode: 400, message: 'Missing required fields' })
|
|
}
|
|
|
|
// 1. Проверяем права: только владелец группы или глобальный админ может менять роли
|
|
const group = await prisma.group.findUnique({
|
|
where: { id: groupId }
|
|
})
|
|
|
|
if (!group || (group.ownerId !== adminUser.id && adminUser.role !== 'admin')) {
|
|
throw createError({ statusCode: 403, message: 'Permission denied' })
|
|
}
|
|
|
|
// 2. Нельзя менять роль самому владельцу (он всегда админ)
|
|
if (userId === group.ownerId) {
|
|
throw createError({ statusCode: 400, message: 'Cannot change owner role' })
|
|
}
|
|
|
|
// 3. Обновляем роль
|
|
try {
|
|
const updated = await prisma.groupMember.update({
|
|
where: {
|
|
userId_groupId: { userId, groupId }
|
|
},
|
|
data: { role }
|
|
})
|
|
|
|
return { success: true, updated }
|
|
} catch (e) {
|
|
throw createError({ statusCode: 500, message: 'Failed to update member role' })
|
|
}
|
|
})
|