Function checkPermissions

server/api/SavedQueryRoute.js:10–35

(actionType = "readAny")

  const teamController = new TeamController();

  const checkPermissions = (actionType = "readAny") => {
    return async (req, res, next) => {
      const { team_id } = req.params;

      // Fetch the TeamRole for the user
      const teamRole = await teamController.getTeamRole(team_id, req.user.id);

      if (!teamRole) {
        return res.status(403).json({ message: "Access denied" });
      }

      const permission = accessControl.can(teamRole.role)[actionType]("savedQuery");
      if (!permission.granted) {
        return res.status(403).json({ message: "Access denied" });
      }

      const { role } = teamRole;

      // Handle permissions for teamOwner and teamAdmin
      if (["teamOwner", "teamAdmin"].includes(role)) {
        req.user.isEditor = true;
      }

      return next();
    };
  };

  /**
   * [MASTER] Route to get all saved queries