diff --git a/public/erd.svg b/public/erd.svg
index c0563d1..2404231 100644
--- a/public/erd.svg
+++ b/public/erd.svg
@@ -1 +1 @@
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/src/app/api/admin/categories/[id]/route.ts b/src/app/api/admin/categories/[id]/route.ts
index 515ae88..8324408 100644
--- a/src/app/api/admin/categories/[id]/route.ts
+++ b/src/app/api/admin/categories/[id]/route.ts
@@ -6,7 +6,11 @@ import { requirePermission } from "@/lib/rbac";
export async function PATCH(req: Request, context: { params: Promise<{ id: string }> }) {
const { id } = await context.params;
const userId = getUserIdFromRequest(req);
- await requirePermission({ userId, resource: "ADMIN", action: "MODERATE" });
+ try {
+ await requirePermission({ userId, resource: "ADMIN", action: "MODERATE" });
+ } catch (e) {
+ return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+ }
const body = await req.json().catch(() => ({}));
const data: any = {};
for (const k of ["name", "slug", "sortOrder", "status"]) {
@@ -19,7 +23,11 @@ export async function PATCH(req: Request, context: { params: Promise<{ id: strin
export async function DELETE(req: Request, context: { params: Promise<{ id: string }> }) {
const { id } = await context.params;
const userId = getUserIdFromRequest(req);
- await requirePermission({ userId, resource: "ADMIN", action: "MODERATE" });
+ try {
+ await requirePermission({ userId, resource: "ADMIN", action: "MODERATE" });
+ } catch (e) {
+ return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+ }
await prisma.boardCategory.delete({ where: { id } });
return NextResponse.json({ ok: true });
}
diff --git a/src/app/api/admin/categories/route.ts b/src/app/api/admin/categories/route.ts
index 16cbff4..94fb774 100644
--- a/src/app/api/admin/categories/route.ts
+++ b/src/app/api/admin/categories/route.ts
@@ -20,7 +20,11 @@ const createSchema = z.object({
export async function POST(req: Request) {
const userId = getUserIdFromRequest(req);
- await requirePermission({ userId, resource: "ADMIN", action: "MODERATE" });
+ try {
+ await requirePermission({ userId, resource: "ADMIN", action: "MODERATE" });
+ } catch (e) {
+ return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+ }
const body = await req.json().catch(() => ({}));
const parsed = createSchema.safeParse(body);
if (!parsed.success) return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
diff --git a/src/app/api/posts/[id]/route.ts b/src/app/api/posts/[id]/route.ts
index a2fbc77..6085d36 100644
--- a/src/app/api/posts/[id]/route.ts
+++ b/src/app/api/posts/[id]/route.ts
@@ -24,7 +24,11 @@ const updateSchema = z.object({
export async function PATCH(req: Request, context: { params: Promise<{ id: string }> }) {
const { id } = await context.params;
const userId = getUserIdFromRequest(req);
- await requirePermission({ userId, resource: "POST", action: "UPDATE" });
+ try {
+ await requirePermission({ userId, resource: "POST", action: "UPDATE" });
+ } catch (e) {
+ return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+ }
const body = await req.json();
const parsed = updateSchema.safeParse(body);
if (!parsed.success) return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
@@ -35,7 +39,11 @@ export async function PATCH(req: Request, context: { params: Promise<{ id: strin
export async function DELETE(req: Request, context: { params: Promise<{ id: string }> }) {
const { id } = await context.params;
const userId = getUserIdFromRequest(req);
- await requirePermission({ userId, resource: "POST", action: "DELETE" });
+ try {
+ await requirePermission({ userId, resource: "POST", action: "DELETE" });
+ } catch (e) {
+ return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+ }
const post = await prisma.post.update({ where: { id }, data: { status: "deleted" } });
return NextResponse.json({ post });
}