k1nq/TREK
1
0
Fork 0
mirror of https://github.com/mauriceboe/TREK.git synced 2026-10-24 07:53:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(plugins): trips.getById returns the actual trip row, not the access check

Browse Source 
canAccessTrip only returns { id, user_id } (it's a membership check), but the
rpc-host's trips.getById returned it verbatim — so plugins saw a trip with no
title/start_date/etc. Fetch the real row after the access check. Also fix the
reference plugin to read t.title (the trips column is 'title', not 'name').
This commit is contained in:
mauriceboe
2026-07-03 19:01:23 +02:00
parent 2d492d4f4e
commit 1a7f7a9340
3 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/src/nest/plugins/host/rpc-host.ts
+3 -1
View File
@@ -71,7 +71,9 @@ export class PluginRpcHost {
}
if (has('db:read:trips')) {
this.methods.set('trips.getById', (p) => this.tripRead(p, () => deps.canAccessTrip(num(p.tripId, 'tripId'), num(p.asUserId, 'asUserId'))));
this.methods.set('trips.getById', (p) =>
this.tripRead(p, () => deps.db.prepare('SELECT * FROM trips WHERE id = ?').get(num(p.tripId, 'tripId'))),
);
this.methods.set('trips.getPlaces', (p) =>
this.tripRead(p, () => deps.db.prepare('SELECT * FROM places WHERE trip_id = ? ORDER BY day_id, position').all(num(p.tripId, 'tripId'))),
);