Function checkPermissions

server/api/UpdateRunRoute.js:11–26

()

  const teamController = new TeamController();

  const checkPermissions = () => {
    return async (req, res, next) => {
      const { team_id } = req.params;
      const teamRole = await teamController.getTeamRole(team_id, req.user.id);

      if (!teamRole) {
        return res.status(403).json({ message: "Access denied" });
      }

      if (!ALLOWED_AUDIT_ROLES.includes(teamRole.role)) {
        return res.status(403).json({ message: "Access denied" });
      }

      return next();
    };
  };

  app.get("/team/:team_id/update-runs", verifyToken, checkPermissions(), (req, res) => {
    return updateRunController.findByTeam(req.params.team_id, req.query)