u

src/api/routes/company.js

@@ -4,6 +4,7 @@ import multer from 'multer';
 import JSZip from 'jszip';
 import env from '../../config/env.js';
 import * as db from '../../db/company.js';
+import { requireCompanyAdmin } from '../../db/companyuser.js';
 import * as googleAuth from '../../db/googleAuth.js';
 import { clearCachedUser } from '../middleware/auth.js';
 import { emit } from '../sse.js';
@@ -499,13 +500,25 @@ export function register(app, basePath = '') {
 
     app.post(
         `${basePath}/company/import`,
+        async (req, res, next) => {
+            try {
+                const companyId = requireSelectedCompany(req);
+                await requireCompanyAdmin(req.user.id, companyId);
+                next();
+            } catch (error) {
+                const status = companyErrorStatus(error);
+                return res.status(status).json({ error: error.message });
+            }
+        },
         uploadCompanyImportFile,
         async (req, res) => {
             let companyId;
             try {
                 companyId = requireSelectedCompany(req);
+                await requireCompanyAdmin(req.user.id, companyId);
             } catch (error) {
-                return res.status(error.statusCode || 400).json({ error: error.message });
+                const status = companyErrorStatus(error);
+                return res.status(status).json({ error: error.message });
             }
 
             if (activeImportsByCompany.has(companyId)) {
@@ -968,7 +981,7 @@ export function register(app, basePath = '') {
         }
 
         try {
-            const company = await db.updateCompany(parsedId.companyId, body);
+            const company = await db.updateCompany(parsedId.companyId, body, req.user.id);
             emit('company', { companyId: parsedId.companyId, data: { companyId: parsedId.companyId } });
             res.status(200).json({ company });
         } catch (error) {
@@ -989,10 +1002,14 @@ export function register(app, basePath = '') {
         }
 
         try {
-            await db.deleteCompany(parsedId.companyId);
+            await db.deleteCompany(parsedId.companyId, req.user.id);
             clearCompanyPrinters(parsedId.companyId);
             res.sendStatus(204);
         } catch (error) {
+            const status = companyErrorStatus(error);
+            if (status !== 500) {
+                return res.status(status).json({ error: error.message });
+            }
             console.error('Delete company failed:', error);
             res.status(500).json({ error: 'Failed to delete company' });
         }