fix: tighten route permission guards

2026-05-06 20:06:41 +08:00
parent 8fcd79b608
commit e7bac9a33f
8 changed files with 409 additions and 70 deletions
@@ -18,6 +18,11 @@ export const handle = {

 export async function loader({ request }: LoaderFunctionArgs) {
  const url = new URL(request.url);
+  const { getUserSession } = await import("~/api/login/auth.server");
+  const { frontendJWT, userInfo } = await getUserSession(request);
+  const { requireRoutePermission } = await import("~/api/auth/check-route-permission.server");
+
+  await requireRoutePermission("/rules", userInfo?.role || "", frontendJWT || undefined);

  if (url.pathname === '/rules') {
    const query = url.searchParams.toString();