chrisp/brackt
1
1
Fork 0
Code Issues 42 Pull requests Projects Releases Packages Wiki Activity Actions

Fix draft room to respect isPublicDraftBoard setting for unauthenticated access (#32)

Browse source 
When a league has the "Make draft board publicly accessible" setting enabled,
unauthenticated users could view the draft-board route but were incorrectly
blocked from the draft room route with a 401. Restructure the loader to check
isPublicDraftBoard before enforcing auth/membership requirements, matching the
behaviour already implemented in the draft-board route.

https://claude.ai/code/session_016JiVAG2FrPYjAvSJi3daGD

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Chris Parsons 2026-02-23 12:00:04 -08:00 • committed by GitHub
parent acc78db86e
commit da70bf36f1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 26 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
app/routes/leagues/$leagueId.draft.$seasonId.tsx
View file

@ -45,12 +45,6 @@ export async function loader(args: Route.LoaderArgs) {
throw new Response("Season ID is required", { status: 400 }); throw new Response("Season ID is required", { status: 400 });
} }
if (!userId) {
throw new Response("You must be logged in to view the draft room", {
status: 401,
});
}
const db = database(); const db = database();
// Get season details // Get season details
@ -66,19 +60,32 @@ export async function loader(args: Route.LoaderArgs) {
throw new Response("Season not found", { status: 404 }); throw new Response("Season not found", { status: 404 });
} }
// Verify user access: must be team owner or commissioner // Resolve user's team and commissioner status (null userId means neither)
const userTeam = season.teams.find((team: any) => team.ownerId === userId); const userTeam = userId
const isCommissioner = await db.query.commissioners.findFirst({ ? season.teams.find((team: any) => team.ownerId === userId)
where: and( : undefined;
eq(schema.commissioners.leagueId, leagueId),
eq(schema.commissioners.userId, userId)
),
});
if (!userTeam && !isCommissioner) { const isCommissioner = userId
throw new Response("You do not have access to this draft room", { ? await db.query.commissioners.findFirst({
status: 403, where: and(
}); eq(schema.commissioners.leagueId, leagueId),
eq(schema.commissioners.userId, userId)
),
})
: null;
// Access control: if draft board is not public, require authentication and membership
if (!season.league.isPublicDraftBoard) {
if (!userId) {
throw new Response("You must be logged in to view the draft room", {
status: 401,
});
}
if (!userTeam && !isCommissioner) {
throw new Response("You do not have access to this draft room", {
status: 403,
});
}
} }
// Get draft slots (draft order) - using select instead of query builder // Get draft slots (draft order) - using select instead of query builder
@ -220,7 +227,7 @@ export default function DraftRoom() {
mode: notificationsMode, mode: notificationsMode,
setMode: setNotificationsMode, setMode: setNotificationsMode,
sendNotification, sendNotification,
} = useDraftNotifications(season.id, currentUserId); } = useDraftNotifications(season.id, currentUserId ?? "");
// Use refs so the socket effect doesn't re-register all handlers when the user // Use refs so the socket effect doesn't re-register all handlers when the user
// changes notification settings (which would change the sendNotification reference). // changes notification settings (which would change the sendNotification reference).