diff --git a/src/lib/action.ts b/src/lib/action.ts index 18ed681..92ec121 100644 --- a/src/lib/action.ts +++ b/src/lib/action.ts @@ -89,8 +89,8 @@ export const protectedAction = authActionClient.use(async ({ next, ctx, parsedIn } }); - if (!projectMember || !hasProjectPermission(projectMember.role, requiredRoles)) { - throw new Error('Not authorized to perform this action on this project.'); + if (!projectMember || hasProjectPermission(projectMember.role, requiredRoles).success === false) { + throw new Error('Permission denied: Not authorized to perform this action on this project.'); } return next({ diff --git a/src/lib/permissions.ts b/src/lib/permissions.ts index cd2b58f..c58f307 100644 --- a/src/lib/permissions.ts +++ b/src/lib/permissions.ts @@ -1,13 +1,23 @@ import { Role } from '@/generated/prisma/client'; +import { Result, success, error, ErrorCodes } from '@/lib/result'; -export function hasProjectPermission(userRole: Role, requiredRoles: Role[]): boolean { - return requiredRoles.includes(userRole); +export function hasProjectPermission(userRole: Role, requiredRoles: Role[]): Result { + if (requiredRoles.includes(userRole)) { + return success(true); + } + return error("Permission denied", ErrorCodes.FORBIDDEN); } -export function isProjectAdmin(userRole: Role): boolean { - return userRole === Role.ADMIN; +export function isProjectAdmin(userRole: Role): Result { + if (userRole === Role.ADMIN) { + return success(true); + } + return error("Permission denied", ErrorCodes.FORBIDDEN); } -export function isProjectMember(userRole: Role): boolean { - return userRole === Role.USER || userRole === Role.ADMIN; +export function isProjectMember(userRole: Role): Result { + if (userRole === Role.USER || userRole === Role.ADMIN) { + return success(true); + } + return error("Permission denied", ErrorCodes.FORBIDDEN); }