fix: extend role-based access control in Quiz schema
- Updated authorization logic to allow both CENTER_MENTOR and CENTER_OWNER roles access to Quiz queries and mutations. - Enhanced security by refining user role checks to ensure proper access control.
This commit is contained in:
@@ -159,7 +159,7 @@ export class QuizSchema extends PothosSchema {
|
||||
if (!ctx.http.me) {
|
||||
throw new Error('Unauthorized')
|
||||
}
|
||||
if (ctx.http.me.role !== Role.CENTER_MENTOR) {
|
||||
if (ctx.http.me.role !== Role.CENTER_MENTOR && ctx.http.me.role !== Role.CENTER_OWNER) {
|
||||
throw new Error('Unauthorized')
|
||||
}
|
||||
const centerMentor = await this.prisma.centerMentor.findUnique({
|
||||
|
||||
Reference in New Issue
Block a user