feat: Add authorization checks to admin and player actions

2026-03-27 13:10:29 -07:00
parent 36d7b311f7
commit 54fb92d1a1
4 changed files with 49 additions and 3 deletions
@@ -16,6 +16,14 @@ module EuchreCamp
          def handle(request, response)
            tournament_id = request.params[:id]
            tournament = events_repo.by_id(tournament_id)
+            user = current_user(request)
+
+            # Check authorization - tournament admin can manage their tournaments
+            unless user && EuchreCamp::Services::Authorization.can?(user, :manage_tournament, tournament)
+              response.flash[:error] = 'Access denied'
+              response.redirect_to '/rankings'
+              return
+            end

            # Get all registered participants for this tournament
            participants = participants_repo.by_event(tournament_id)