Xor290/projet_gestion_commande
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): modify law for create users and clients

Browse Source
This commit is contained in:
Xor290
2026-05-18 12:30:36 +02:00
parent e69403043d
commit a8e22e63bc
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/gestion/handlers/auth.go
+7 -2
View File
@@ -181,6 +181,11 @@ func RegisterClient(c *gin.Context) {
// AdminCreateClient crée un client depuis l'interface admin (sans session ni token) // AdminCreateClient crée un client depuis l'interface admin (sans session ni token)
func AdminCreateClient(c *gin.Context) { func AdminCreateClient(c *gin.Context) {
if userRole := c.GetString("role"); userRole != "admin" {
c.JSON(http.StatusForbidden, gin.H{"error": "Seul un administrateur peut créer des clients"})
return
}
var req models.RegisterClientRequest var req models.RegisterClientRequest
if err := c.ShouldBindJSON(&req); err != nil { if err := c.ShouldBindJSON(&req); err != nil {
log.Printf("❌ [ADMIN_CREATE_CLIENT] Binding error: %v | body: username=%q nom=%q prenom=%q tel=%q", err, req.Username, req.Nom, req.Prenom, req.Telephone) log.Printf("❌ [ADMIN_CREATE_CLIENT] Binding error: %v | body: username=%q nom=%q prenom=%q tel=%q", err, req.Username, req.Nom, req.Prenom, req.Telephone)
@@ -821,8 +826,8 @@ func CreateUser(c *gin.Context) {
return return
} }
userRole := c.GetString("role") userRole := c.GetString("role")
if userRole != "cabine" && userRole != "admin" { if userRole != "admin" {
c.JSON(http.StatusForbidden, gin.H{"error": "Accès réservé aux livreurs et aux administrateurs"}) c.JSON(http.StatusForbidden, gin.H{"error": "Seul un administrateur peut créer des utilisateurs"})
return return
} }
err := database.CreateUser(&user) err := database.CreateUser(&user)