Verifying abilities for admin panel access instead of relying on user role.

2026-06-17 00:23:03 +02:00
parent d7964f6fc2
commit d1e8ff48c5
4 changed files with 13 additions and 4 deletions
--- a/pages/admin/actors/+onBeforeRender.js
+++ b/pages/admin/actors/+onBeforeRender.js
@@ -1,6 +1,13 @@
+import { render } from 'vike/abort'; /* eslint-disable-line import/extensions */
+
 import { fetchActors } from '#/src/actors.js';
+import verifyAbility from '#/utils/verify-ability.js';

 export default async function onBeforeRender(pageContext) {
+	if (!pageContext.user || !verifyAbility(pageContext.user, 'actor', 'merge')) {
+		throw render(404);
+	}
+
 	const { actors } = await fetchActors({
 		query: pageContext.urlParsed.search.q,
 	}, {