feat: Add authorization checks to admin and player actions

2026-03-27 13:10:29 -07:00
parent 36d7b311f7
commit 54fb92d1a1
4 changed files with 49 additions and 3 deletions
@@ -5,7 +5,20 @@ module EuchreCamp
    module Admin
      module Players
        class Edit < EuchreCamp::Action
+          include Deps[players_repo: 'repositories.players']
+
          def handle(request, response)
+            player_id = request.params[:id]
+            player = players_repo.by_id(player_id)
+            user = current_user(request)
+
+            # Authorization: User can edit own profile, or admin can edit any
+            unless authorize(request, response, :edit_own_profile, { id: player_id }) ||
+                   authorize(request, response, :edit_any_record)
+              return
+            end
+
+            render_with_player(request, response, player: player)
          end
        end
      end