Added permission to block non admins from seeing all users

2024-02-19 10:42:02 -05:00
parent 763e8af7a0
commit 2a6aaafa3d
2 changed files with 7 additions and 1 deletions
@@ -6,8 +6,9 @@ const permission = require('../utils/permission');

 router.get('/', async function(req, res, next){
 	try{
+		await permission.byGroup(req.user, ['app_sso_admin'])
 		return res.json({
-			results:  await User[req.query.detail ? "listDetail" : "list"]()
+			results:  await User[req.query.detail ? "listDetail" : "list"](),
 		});
 	}catch(error){
 		next(error);