From 69bec42a66a84953a2546644234a789479cc47d8 Mon Sep 17 00:00:00 2001 From: Alex Holliday Date: Wed, 15 Apr 2026 13:53:55 -0700 Subject: [PATCH 1/2] restrict editing user routes to regular users --- server/src/routes/authRoute.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/src/routes/authRoute.ts b/server/src/routes/authRoute.ts index fd951c6b1..af6fd4266 100755 --- a/server/src/routes/authRoute.ts +++ b/server/src/routes/authRoute.ts @@ -32,8 +32,8 @@ class AuthRoutes { this.router.patch("/users/:userId/password", verifyJWT, isAllowed(["superadmin"]), this.authController.editUserPasswordById); this.router.delete("/users/:userId", verifyJWT, isAllowed(["admin", "superadmin"]), this.authController.deleteUserById); - this.router.patch("/user", verifyJWT, upload.single("profileImage"), this.authController.editUser); - this.router.delete("/user", verifyJWT, this.authController.deleteUser); + this.router.patch("/user", verifyJWT, upload.single("profileImage"), isAllowed(["admin", "superadmin", "user"]), this.authController.editUser); + this.router.delete("/user", verifyJWT, isAllowed(["admin", "superadmin", "user"]), this.authController.deleteUser); } getRouter() { From be3b7c2e86276a9292849dc223bb7009e80b04da Mon Sep 17 00:00:00 2001 From: Alex Holliday Date: Wed, 15 Apr 2026 13:54:05 -0700 Subject: [PATCH 2/2] add demo role to list of roles --- client/src/Pages/Account/components/AddTeamMemberDialog.tsx | 1 + client/src/Pages/Account/components/InviteTeamMemberDialog.tsx | 1 + 2 files changed, 2 insertions(+) diff --git a/client/src/Pages/Account/components/AddTeamMemberDialog.tsx b/client/src/Pages/Account/components/AddTeamMemberDialog.tsx index 14765eb79..e584d3235 100644 --- a/client/src/Pages/Account/components/AddTeamMemberDialog.tsx +++ b/client/src/Pages/Account/components/AddTeamMemberDialog.tsx @@ -43,6 +43,7 @@ export const AddTeamMemberDialog = ({ const roleOptions: { value: UserRole; label: string }[] = [ { value: "admin", label: t("common.auth.roles.admin") }, { value: "user", label: t("common.auth.roles.user") }, + { value: "demo", label: t("common.auth.roles.demo") }, ]; const handleClose = () => { diff --git a/client/src/Pages/Account/components/InviteTeamMemberDialog.tsx b/client/src/Pages/Account/components/InviteTeamMemberDialog.tsx index e7c42a1ac..cf72e3d24 100644 --- a/client/src/Pages/Account/components/InviteTeamMemberDialog.tsx +++ b/client/src/Pages/Account/components/InviteTeamMemberDialog.tsx @@ -48,6 +48,7 @@ export const InviteTeamMemberDialog = ({ const roleOptions: { value: UserRole; label: string }[] = [ { value: "admin", label: t("common.auth.roles.admin") }, { value: "user", label: t("common.auth.roles.user") }, + { value: "demo", label: t("common.auth.roles.demo") }, ]; const handleGenerateToken = async (data: InviteFormData) => {