fix: Permissions on Admin pages (#3959)

cds-snc · Jul 5, 2024 · 9e129b3 · 9e129b3
1 parent 349d4aa
commit 9e129b3
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 8 deletions.
diff --git a/app/(gcforms)/[locale]/(app administration)/admin/(no nav)/upload/page.tsx b/app/(gcforms)/[locale]/(app administration)/admin/(no nav)/upload/page.tsx
@@ -20,9 +20,13 @@ export default async function Page() {
 
   const { ability } = await authCheckAndRedirect();
 
-  checkPrivilegesAsBoolean(ability, [{ action: "create", subject: "FormRecord" }], {
-    redirect: true,
-  });
+  checkPrivilegesAsBoolean(
+    ability,
+    [{ action: "update", subject: { type: "FormRecord", object: {} } }],
+    {
+      redirect: true,
+    }
+  );
   return (
     <>
       <h1>{t("upload.title")}</h1>

diff --git a/app/(gcforms)/[locale]/(app administration)/admin/(no nav)/view-templates/page.tsx b/app/(gcforms)/[locale]/(app administration)/admin/(no nav)/view-templates/page.tsx
@@ -21,11 +21,8 @@ export default async function Page() {
 
   checkPrivilegesAsBoolean(
     ability,
-    [
-      { action: "view", subject: "FormRecord" },
-      { action: "update", subject: "FormRecord" },
-    ],
-    { logic: "one", redirect: true }
+    [{ action: "update", subject: { type: "FormRecord", object: {} } }],
+    { redirect: true }
   );
 
   const templates = (await getAllTemplates(ability)).map((template) => {