From 54fb92d1a1f57c106cb6bdb909acc0ad89cf3a9e Mon Sep 17 00:00:00 2001
From: David Gwilliam <dhgwilliam@gmail.com>
Date: Fri, 27 Mar 2026 13:10:29 -0700
Subject: [PATCH] feat: Add authorization checks to admin and player actions

---
 app/actions/admin/matches/index.rb    | 29 +++++++++++++++++++++++++--
 app/actions/admin/players/edit.rb     | 13 ++++++++++++
 app/actions/admin/tournaments/show.rb |  8 ++++++++
 app/actions/players/profile.rb        |  2 +-
 4 files changed, 49 insertions(+), 3 deletions(-)

diff --git a/app/actions/admin/matches/index.rb b/app/actions/admin/matches/index.rb
index ab7412b..e7c822e 100644
--- a/app/actions/admin/matches/index.rb
+++ b/app/actions/admin/matches/index.rb
@@ -7,9 +7,34 @@ module EuchreCamp
         class Index < EuchreCamp::Action
           include Deps[repo: 'repositories.matches']
 
-          def handle(_request, response)
+          def handle(request, response)
+            # Check authorization - view all matches
+            user = current_user(request)
+            unless user && EuchreCamp::Services::Authorization.can?(user, :view_all)
+              response.flash[:error] = 'Access denied'
+              response.redirect_to '/rankings'
+              return
+            end
+
             matches = repo.all
-            response.render(view, matches: matches)
+            enhanced_matches = enhance_matches_with_player_names(matches)
+            response.render(view, matches: enhanced_matches)
+          end
+
+          private
+
+          def enhance_matches_with_player_names(matches)
+            rom = EuchreCamp::App["persistence.rom"]
+            all_players = rom.relations[:players].to_a.to_h { |p| [p[:id], p] }
+
+            matches.map do |match|
+              match.to_h.merge(
+                team_1_p1_name: all_players[match.team_1_p1_id]&.[](:name) || 'Unknown',
+                team_1_p2_name: all_players[match.team_1_p2_id]&.[](:name) || 'Unknown',
+                team_2_p1_name: all_players[match.team_2_p1_id]&.[](:name) || 'Unknown',
+                team_2_p2_name: all_players[match.team_2_p2_id]&.[](:name) || 'Unknown'
+              )
+            end
           end
         end
       end
diff --git a/app/actions/admin/players/edit.rb b/app/actions/admin/players/edit.rb
index 72fc879..a33bd55 100644
--- a/app/actions/admin/players/edit.rb
+++ b/app/actions/admin/players/edit.rb
@@ -5,7 +5,20 @@ module EuchreCamp
     module Admin
       module Players
         class Edit < EuchreCamp::Action
+          include Deps[players_repo: 'repositories.players']
+
           def handle(request, response)
+            player_id = request.params[:id]
+            player = players_repo.by_id(player_id)
+            user = current_user(request)
+
+            # Authorization: User can edit own profile, or admin can edit any
+            unless authorize(request, response, :edit_own_profile, { id: player_id }) ||
+                   authorize(request, response, :edit_any_record)
+              return
+            end
+
+            render_with_player(request, response, player: player)
           end
         end
       end
diff --git a/app/actions/admin/tournaments/show.rb b/app/actions/admin/tournaments/show.rb
index b279bc5..6896e24 100644
--- a/app/actions/admin/tournaments/show.rb
+++ b/app/actions/admin/tournaments/show.rb
@@ -16,6 +16,14 @@ module EuchreCamp
           def handle(request, response)
             tournament_id = request.params[:id]
             tournament = events_repo.by_id(tournament_id)
+            user = current_user(request)
+
+            # Check authorization - tournament admin can manage their tournaments
+            unless user && EuchreCamp::Services::Authorization.can?(user, :manage_tournament, tournament)
+              response.flash[:error] = 'Access denied'
+              response.redirect_to '/rankings'
+              return
+            end
 
             # Get all registered participants for this tournament
             participants = participants_repo.by_event(tournament_id)
diff --git a/app/actions/players/profile.rb b/app/actions/players/profile.rb
index 302fc6f..b3219f8 100644
--- a/app/actions/players/profile.rb
+++ b/app/actions/players/profile.rb
@@ -60,7 +60,7 @@ module EuchreCamp
             won = player_on_team_1 ? (match[:team_1_score] > match[:team_2_score]) : (match[:team_2_score] > match[:team_1_score])
 
             {
-              date: match[:played_at] || match[:created_at],
+              date: match[:played_at],
               team_1: team_1_players,
               team_2: team_2_players,
               score: "#{match[:team_1_score]}-#{match[:team_2_score]}",