Don't allow standard et to access strike api routes

regalijan · Dec 6, 2024 · cae9af5 · cae9af5
1 parent 2f200f8
commit cae9af5
Showing 1 changed file with 1 addition and 7 deletions.
diff --git a/functions/api/events-team/strikes/_middleware.ts b/functions/api/events-team/strikes/_middleware.ts
@@ -5,13 +5,7 @@ export async function onRequest(context: RequestContext) {
 
   if (!user) return jsonError("Not logged in", 401);
 
-  if (![1 << 3, 1 << 4, 1 << 12].find((p) => user.permissions & p))
-    return jsonError("Not part of Events Team", 403);
-
-  if (
-    context.request.method !== "GET" &&
-    ![1 << 4, 1 << 12].find((p) => user.permissions & p)
-  )
+  if (![1 << 4, 1 << 12].find((p) => user.permissions & p))
     return jsonError("Cannot manage strikes", 403);
 
   return await context.next();