Adriano/InsanityLab-web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: regex percorsi editor senza bypass prefisso

Browse Source
This commit is contained in:
AdrianoDev
2026-07-05 15:36:38 +02:00
parent 77041f9d5a
commit 274a6c7600
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/auth.ts
+1 -1
View File
@@ -50,7 +50,7 @@ export function logout(db: Database.Database, token: string): void {
}
// Percorsi admin consentiti anche al ruolo editor.
const EDITOR_ALLOWED = [/^\/admin\/content(\/|$)?/, /^\/api\/admin\/content(\/|$)/, /^\/admin\/logout$/];
const EDITOR_ALLOWED = [/^\/admin\/content(\/|$)/, /^\/api\/admin\/content(\/|$)/, /^\/admin\/logout$/];
export function canAccessAdminPath(role: string, pathname: string): boolean {
if (role === 'admin') return true;
tests/roles.test.ts
+4
View File
@@ -29,5 +29,9 @@ describe('ruoli', () => {
expect(canAccessAdminPath('editor', '/admin/new')).toBe(false);
expect(canAccessAdminPath('editor', '/api/admin/posts')).toBe(false);
expect(canAccessAdminPath('editor', '/api/admin/upload')).toBe(false);
expect(canAccessAdminPath('editor', '/admin/contentious')).toBe(false);
expect(canAccessAdminPath('editor', '/admin/content-x')).toBe(false);
expect(canAccessAdminPath('editor', '/admin/content')).toBe(true);
expect(canAccessAdminPath('editor', '/admin/content/')).toBe(true);
});
});