fix: Gebietseroberung - Admin sieht alle Nutzer
This commit is contained in:
@@ -97,7 +97,10 @@ router.get('/', authenticate, (req, res) => {
|
||||
// ── Alle User (für Einladen) ──────────────────────────────────────────────────
|
||||
router.get('/users', authenticate, (req, res) => {
|
||||
const me = uid(req);
|
||||
const users = db.prepare('SELECT id, username FROM users WHERE id != ? AND hidden != 1 ORDER BY username').all(me);
|
||||
const isAdmin = req.user?.role === 'admin';
|
||||
const users = isAdmin
|
||||
? db.prepare('SELECT id, username FROM users WHERE id != ? ORDER BY username').all(me)
|
||||
: db.prepare('SELECT id, username FROM users WHERE id != ? AND hidden != 1 ORDER BY username').all(me);
|
||||
res.json(users);
|
||||
});
|
||||
|
||||
|
||||
Reference in New Issue
Block a user