Moheeb Zara
8bbe99d34f
- migration 028: drop global UNIQUE(forms.slug), add
UNIQUE(space_id, slug); schema.sql mirrored. Form slugs are now
unique per space (fixes cross-tenant slug squatting)
- getPublicForm now takes { space, slug }: resolves the space by its
slug then the form by space_id + slug (maybeSingle)
- route moved app/f/[slug] -> app/f/[space]/[slug]; the public client
submits by formId (slug is no longer globally unambiguous) and the
sign-in link round-trips the full /f/space/slug path
- forms-guard returns the space slug; the builder + forms list show
the full /f/<space>/<slug> share URL; new/edit pass it through
- middleware /f allowlist already covers /f/<space>/<slug>
- getPublicFormSchema + tests updated (333 pass)
build verified (Compiled successfully, exit 0; new route present). No deploy.
34 lines
1.2 KiB
TypeScript
34 lines
1.2 KiB
TypeScript
import { redirect } from 'next/navigation'
|
|
import { createClient } from '@/lib/supabase/server'
|
|
|
|
// Server-component guard for the /forms management pages. Mirrors the
|
|
// /settings server gate: resolve the member, check forms.manage via the
|
|
// same RPC the forms RLS uses, and redirect non-managers before any data
|
|
// is fetched. The forms RLS independently enforces this; the redirect is
|
|
// for UX, not the security boundary.
|
|
export async function requireFormsManagerPage() {
|
|
const supabase = await createClient()
|
|
const {
|
|
data: { user },
|
|
} = await supabase.auth.getUser()
|
|
if (!user) redirect('/login')
|
|
|
|
const { data: member } = await supabase
|
|
.from('space_members')
|
|
.select('id, space_id, role, user_id, display_name, spaces(slug)')
|
|
.eq('user_id', user.id)
|
|
.in('status', ['current', 'unverified', 'late'])
|
|
.single()
|
|
if (!member) redirect('/login')
|
|
|
|
const { data: allowed } = await supabase.rpc('user_has_permission', {
|
|
uid: user.id,
|
|
sid: member.space_id,
|
|
perm: 'forms.manage',
|
|
})
|
|
if (!allowed) redirect('/dashboard')
|
|
|
|
const spaceSlug = (member.spaces as { slug?: string } | null)?.slug ?? ''
|
|
return { supabase, member, spaceSlug }
|
|
}
|