@acms-subir/core 0.3.20 → 0.3.21

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @acms-subir/core
 
+## 0.3.21
+
+### Patch Changes
+
+- 6096e7c: Fix the Live video, Mobile app and Email admin pages refusing owners who opened them from a link on another site or app. These pages ran the API's cross-site check and then reported every failure as a missing "Connected services" permission (Email: "Only owners can manage email"). They now check only the person's role, like the other admin pages. The admin APIs still refuse cross-site calls.
+
 ## 0.3.20
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "publishConfig": {
     "access": "public"
   },

package/src/pages/admin/email.astro

@@ -2,10 +2,10 @@
 import Admin from '../../layouts/Admin.astro';
 import EmailSettings from '../../components/EmailSettings';
 import { getRepo } from '../../lib/repo';
-import { requirePermission } from '../../lib/permissions/access';
+import { forbiddenUnless } from '../../lib/permissions/access';
 const repo=await getRepo(Astro.locals);
-try { await requirePermission(Astro.request, Astro.cookies, repo, 'services.manage'); }
-catch { return new Response('Only owners can manage email.',{status:403}); }
+const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'services.manage');
+if (denied) return denied;
 ---
 <Admin title="Email" section="settings">
   <div class="page-head"><h1>Email</h1><a class="btn ghost" href="/admin/settings">Site settings</a></div>

package/src/pages/admin/live.astro

@@ -2,10 +2,10 @@
 import Admin from '../../layouts/Admin.astro';
 import LiveManager from '../../components/LiveManager';
 import { getRepo } from '../../lib/repo';
-import { requirePermission } from '../../lib/permissions/access';
+import { forbiddenUnless } from '../../lib/permissions/access';
 const repo = await getRepo(Astro.locals);
-try { await requirePermission(Astro.request, Astro.cookies, repo, 'services.manage'); }
-catch { return new Response('Your role doesn’t include “Connected services”.', { status: 403 }); }
+const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'services.manage');
+if (denied) return denied;
 ---
 <Admin title="Live video" section="integrations">
   <LiveManager client:only="react" />

package/src/pages/admin/mobile.astro

@@ -3,11 +3,11 @@ import Admin from '../../layouts/Admin.astro';
 import AppAccess from '../../components/AppAccess';
 import MobileApp from '../../components/MobileApp';
 import { getRepo } from '../../lib/repo';
-import { requirePermission } from '../../lib/permissions/access';
+import { forbiddenUnless } from '../../lib/permissions/access';
 import { PUSH } from '../../lib/push/config';
 const repo = await getRepo(Astro.locals);
-try { await requirePermission(Astro.request, Astro.cookies, repo, 'services.manage'); }
-catch { return new Response('Your role doesn’t include “Connected services”.', { status: 403 }); }
+const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'services.manage');
+if (denied) return denied;
 ---
 <Admin title="Mobile app" section="mobile">
   <div class="page-head">