File tree Expand file tree Collapse file tree 2 files changed +20
-3
lines changed
Expand file tree Collapse file tree 2 files changed +20
-3
lines changed Original file line number Diff line number Diff line change @@ -23,7 +23,10 @@ export const apiFetch = (
2323 } else {
2424 token = ctx . req . cookies ?. [ 'auth-token' ] ;
2525 }
26- headers = { Authorization : `Bearer ${ token } ` , ...init ?. headers } ;
26+ // Only add Authorization header if token exists
27+ if ( token ) {
28+ headers = { Authorization : `Bearer ${ token } ` , ...init ?. headers } ;
29+ }
2730 }
2831 // Use server-side URL when we have server context (SSR), client-side URL otherwise
2932 const apiBase = getApiBase ( ! ! ctx ) ;
Original file line number Diff line number Diff line change @@ -438,9 +438,23 @@ const Page: NextPage<PageProps> = ({
438438export const getServerSideProps : GetServerSideProps < PageProps > = async (
439439 ctx : GetServerSidePropsContext
440440) => {
441+ // First check if user is authenticated and is an admin
442+ const userResponse = await apiFetch ( '/api/me' , undefined , ctx ) ;
443+ const user = userResponse . ok ? await userResponse . json ( ) : null ;
444+
445+ // Redirect to login if not authenticated or not an admin
446+ if ( ! user || ! user . isAdmin ) {
447+ return {
448+ redirect : {
449+ destination : '/login' ,
450+ permanent : false
451+ }
452+ } ;
453+ }
454+
455+ // Only fetch admin-protected data after confirming admin status
441456 const data = await serverSideGetRequests (
442457 {
443- user : '/api/me' ,
444458 event : '/public/event' ,
445459 initMembers : '/api/events/members' , // Fetches non-MM members
446460 initMMMembers : '/api/events/mm-members' , // Fetches MM members
@@ -452,7 +466,7 @@ export const getServerSideProps: GetServerSideProps<PageProps> = async (
452466
453467 return {
454468 props : {
455- user : data . user ,
469+ user : user ,
456470 event : data . event ?? null ,
457471 initMembers : data . initMembers ?? [ ] ,
458472 initMMMembers : data . initMMMembers ?? [ ] , // Ensure this is correctly populated
You can’t perform that action at this time.
0 commit comments