From 0ceaf782432d45cc45f3cb451afd19ec4a395c08 Mon Sep 17 00:00:00 2001 From: alphaeusmote <41258468-alphaeusmote@users.noreply.replit.com> Date: Thu, 10 Apr 2025 02:30:58 +0000 Subject: [PATCH] Fix webhooks page access and add authentication Replit-Commit-Author: Agent Replit-Commit-Session-Id: 9111ef36-26c8-4085-84ca-a35dc1fec1b5 Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/7083d608-d6d3-4a6a-9a27-6286c5109627/fcf59a0f-c1e7-497b-9dcd-51a657a3f2a9.jpg --- server/routes.ts | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/server/routes.ts b/server/routes.ts index 09631b1..1fb8ea9 100644 --- a/server/routes.ts +++ b/server/routes.ts @@ -821,14 +821,29 @@ export async function registerRoutes(app: Express): Promise { }); // Webhooks - app.get("/api/webhooks", requireRole(["admin", "manager"]), async (req, res) => { + app.get("/api/webhooks", async (req, res) => { try { + // Check if user is authenticated + if (!req.isAuthenticated()) { + return res.status(401).json({ message: "Not authenticated" }); + } + + // Check if user has appropriate role (admin or manager) + const userRole = req.user?.role; + if (userRole !== 'admin' && userRole !== 'manager') { + return res.status(403).json({ message: "Insufficient permissions" }); + } + let webhooks; const orgId = req.query.organizationId as string; if (orgId) { + // For specific organization, check if user belongs to that org + if (userRole !== "admin" && req.user?.organizationId !== orgId) { + return res.status(403).json({ message: "Insufficient permissions" }); + } webhooks = await storage.getWebhooksByOrganization(orgId); - } else if (req.user?.role === "admin") { + } else if (userRole === "admin") { // Admins can see all webhooks const allOrgs = await storage.getOrganizations(); webhooks = await Promise.all(