From 6feada4fd82aa1a879dc4691b4153bd5137a7349 Mon Sep 17 00:00:00 2001
From: David Gwilliam <dhgwilliam@gmail.com>
Date: Mon, 30 Mar 2026 21:30:50 -0700
Subject: [PATCH] refactor: use permission system instead of direct session
 checks in admin pages

---
 src/app/admin/tournaments/[id]/page.tsx | 23 +++++--------
 src/app/admin/tournaments/page.tsx      | 45 +++++++++----------------
 2 files changed, 24 insertions(+), 44 deletions(-)

diff --git a/src/app/admin/tournaments/[id]/page.tsx b/src/app/admin/tournaments/[id]/page.tsx
index 3ab8325..20754a7 100644
--- a/src/app/admin/tournaments/[id]/page.tsx
+++ b/src/app/admin/tournaments/[id]/page.tsx
@@ -2,7 +2,7 @@ import { prisma } from "@/lib/prisma"
 import Navigation from "@/components/Navigation"
 import Link from "next/link"
 import { notFound, redirect } from "next/navigation"
-import { getSession } from "@/lib/auth-simple"
+import { canManageTournament, hasRole } from "@/lib/permissions"
 import { getTournamentStatus } from "@/lib/tournamentUtils"
 
 interface PageProps {
@@ -12,21 +12,16 @@ interface PageProps {
 }
 
 export default async function TournamentDetailPage({ params }: PageProps) {
-  const session = await getSession()
-
-  if (!session) {
+  const tournamentId = parseInt(params.id)
+  
+  // Check if user can manage this tournament
+  const permission = await canManageTournament(tournamentId)
+  if (!permission.allowed) {
     redirect("/auth/login")
   }
 
-  // Fetch user role from database
-  const user = await prisma.user.findUnique({
-    where: { id: session.user.id },
-    select: { role: true },
-  });
-
-  const isAdmin = user?.role === "club_admin"
-
-  const tournamentId = parseInt(params.id)
+  // Check if user can create tournaments (tournament_admin or club_admin)
+  const canCreate = await hasRole('tournament_admin')
 
   let tournament = await prisma.event.findUnique({
     where: { id: tournamentId },
@@ -158,7 +153,7 @@ export default async function TournamentDetailPage({ params }: PageProps) {
                 )}
               </div>
               <div className="flex space-x-2">
-                {isAdmin && (
+                {permission.allowed && (
                   <>
                     <Link
                       href={`/admin/tournaments/${tournament.id}/edit`}
diff --git a/src/app/admin/tournaments/page.tsx b/src/app/admin/tournaments/page.tsx
index bfbdcd0..c47efdf 100644
--- a/src/app/admin/tournaments/page.tsx
+++ b/src/app/admin/tournaments/page.tsx
@@ -4,6 +4,7 @@ import Link from "next/link"
 import { getSession } from "@/lib/auth-simple"
 import { redirect } from "next/navigation"
 import { getTournamentStatus } from "@/lib/tournamentUtils"
+import { hasRole, getManageableTournaments } from "@/lib/permissions"
 
 export default async function AdminTournamentsPage() {
   const session = await getSession()
@@ -12,26 +13,12 @@ export default async function AdminTournamentsPage() {
     redirect("/auth/login")
   }
 
-  // Fetch user role from database
-  const user = await prisma.user.findUnique({
-    where: { id: session.user.id },
-    select: { role: true },
-  });
+  // Check if user can create tournaments (tournament_admin or club_admin)
+  const canCreateResult = await hasRole('tournament_admin')
+  const canCreate = canCreateResult.allowed
 
-  const isAdmin = user?.role === "club_admin"
-
-  const tournaments = await prisma.event.findMany({
-    orderBy: { createdAt: "desc" },
-    include: {
-      participants: true,
-      teams: {
-        include: {
-          player1: true,
-          player2: true,
-        },
-      },
-    },
-  })
+  // Get tournaments manageable by the current user
+  const tournaments = await getManageableTournaments()
 
   // Update tournament statuses based on event date
   const updatedTournaments = await Promise.all(
@@ -59,9 +46,9 @@ export default async function AdminTournamentsPage() {
         <div className="px-4 py-6 sm:px-0">
           <div className="flex justify-between items-center mb-6">
             <h1 className="text-3xl font-bold text-gray-900">
-              {isAdmin ? 'Tournament Management' : 'Tournaments'}
+              {canCreate ? 'Tournament Management' : 'Tournaments'}
             </h1>
-            {isAdmin && (
+            {canCreate && (
               <Link
                 href="/admin/tournaments/new"
                 className="inline-flex items-center px-4 py-2 border border-transparent text-sm font-medium rounded-md shadow-sm text-white bg-green-600 hover:bg-green-700"
@@ -132,14 +119,12 @@ export default async function AdminTournamentsPage() {
                       >
                         View
                       </Link>
-                      {isAdmin && (
-                        <Link
-                          href={`/admin/tournaments/${tournament.id}/edit`}
-                          className="text-blue-600 hover:text-blue-900"
-                        >
-                          Edit
-                        </Link>
-                      )}
+                      <Link
+                        href={`/admin/tournaments/${tournament.id}/edit`}
+                        className="text-blue-600 hover:text-blue-900"
+                      >
+                        Edit
+                      </Link>
                     </td>
                   </tr>
                 ))}
@@ -149,7 +134,7 @@ export default async function AdminTournamentsPage() {
             {updatedTournaments.length === 0 && (
               <div className="text-center py-12">
                 <p className="text-gray-500">No tournaments found.</p>
-                {isAdmin && (
+                {canCreate && (
                   <Link
                     href="/admin/tournaments/new"
                     className="text-green-600 hover:text-green-900 mt-2 inline-block"