feat(auth): restrict system role config reads to admins

2026-03-30 09:46:32 +02:00
parent 98502e6cf8
commit a25635ee66
2 changed files with 85 additions and 2 deletions
@@ -1,10 +1,10 @@
 import { z } from "zod";
-import { adminProcedure, createTRPCRouter, invalidateRoleDefaultsCache, protectedProcedure } from "../trpc.js";
+import { adminProcedure, createTRPCRouter, invalidateRoleDefaultsCache } from "../trpc.js";
 import { createAuditEntry } from "../lib/audit.js";

 export const systemRoleConfigRouter = createTRPCRouter({
  /** List all role configs (sorted by sortOrder) */
-  list: protectedProcedure.query(async ({ ctx }) => {
+  list: adminProcedure.query(async ({ ctx }) => {
    return ctx.db.systemRoleConfig.findMany({
      orderBy: { sortOrder: "asc" },
    });