Repository navigation
Implement Admin Page - #133
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
| validate({ params: OrganizationParams, body: UpdateOrganizationAuthorizedBody }), | ||
| authenticate, | ||
| authorizeAdmin, |
There was a problem hiding this comment.
Reorder the middleware to authenticate, authorizeAdmin, validate to match the other routes and prevent unauthenticated callers from inspecting the body schema.
On the authorize route validate ran ahead of authenticate, so an unauthenticated caller got a 400 schema error instead of a 401 and could probe the body shape. Moves it behind both auth middlewares. ADMIN_EMAILS grants access by address, so authorizeAdmin now also requires email_confirmed_at. Without it, anyone able to register an admin's address on a project that allows unverified signup would inherit admin.
|
|
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
Adds a platform admin page at /admin for approving organizations. A new backend admin module provides API endpoints (GET /admin/verify, GET /admin/organizations, POST /admin/organizations/:id/authorize) gated by an authorizeAdmin middleware that checks the authenticated user's email with ADMIN_EMAILS env variable. The frontend admin page displays organizations in a table (Pending/Approved/All) with approve and revoke buttons. Non-admin users are redirected away from the page.