cfd54385b3
- /expenses/suppliers: terms (cash / 30 / 60 days), PO + petty cash totals per supplier, period filters, add/edit/delete, due dates - POs and slips resolve to a supplier by code then folded name; new PO suppliers start with terms unset, new slip suppliers as cash - Full-user guard on cash-float and job-card write routes Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
14 lines
696 B
TypeScript
14 lines
696 B
TypeScript
import "server-only";
|
|
import { getSession } from "./auth";
|
|
|
|
/**
|
|
* Belt and braces for main-app write routes: the proxy already keeps Office, Mechanic and
|
|
* Clock-in users out of every non-clock path, but a destructive route should not depend on that
|
|
* alone. Returns a Response to send back when the caller is not a Full user, otherwise null.
|
|
*/
|
|
export async function refuseUnlessFull(): Promise<Response | null> {
|
|
const session = await getSession();
|
|
if (!session) return Response.json({ ok: false, error: "Please sign in." }, { status: 401 });
|
|
if (session.access !== "full") return Response.json({ ok: false, error: "Only full users can do this." }, { status: 403 });
|
|
return null;
|
|
}
|