Moheeb Zara
2732269d5f
classes.ts: class/session CRUD (classes.manage; delete refused once sessions/signups exist, archive instead), member signUpForClass / cancelMySignup as validated service-client writes enforcing eligibility, capacity vs waitlist, de-dupe and earliest-waitlist promotion on cancel, listUpcomingSessions (service-client counts so members see spots-left without seeing who signed up), instructor markAttendance and completeSession. completeSession awards a class's certification via the normal grantCertification path, so it only issues when the acting instructor also holds certifications.grant; otherwise completion still succeeds and reports certificatesSkipped. classes-guard mirrors the forms/certifications guards. Barrel + API_REFERENCE updated.
32 lines
1.0 KiB
TypeScript
32 lines
1.0 KiB
TypeScript
import { redirect } from 'next/navigation'
|
|
import { createClient } from '@/lib/supabase/server'
|
|
|
|
// Server-component guard for the /classes management surface. Mirrors the
|
|
// forms/certifications guards: resolve the member, check classes.manage via
|
|
// the same RPC the RLS uses, redirect non-managers before any data is
|
|
// fetched. The RLS independently enforces this; the redirect is UX only.
|
|
export async function requireClassesManagerPage() {
|
|
const supabase = await createClient()
|
|
const {
|
|
data: { user },
|
|
} = await supabase.auth.getUser()
|
|
if (!user) redirect('/login')
|
|
|
|
const { data: member } = await supabase
|
|
.from('space_members')
|
|
.select('id, space_id, role, user_id, display_name')
|
|
.eq('user_id', user.id)
|
|
.in('status', ['current', 'unverified', 'late'])
|
|
.single()
|
|
if (!member) redirect('/login')
|
|
|
|
const { data: allowed } = await supabase.rpc('user_has_permission', {
|
|
uid: user.id,
|
|
sid: member.space_id,
|
|
perm: 'classes.manage',
|
|
})
|
|
if (!allowed) redirect('/dashboard')
|
|
|
|
return { supabase, member }
|
|
}
|