diff --git a/frontend/src/routes/@[username]/+error.svelte b/frontend/src/routes/@[username]/+error.svelte index 4f0292f..611f443 100644 --- a/frontend/src/routes/@[username]/+error.svelte +++ b/frontend/src/routes/@[username]/+error.svelte @@ -10,6 +10,9 @@ >log in again.

+{:else if $page.error?.code === ErrorCode.NotOwnMember} +

Not your member

+

You can only edit your own members.

{:else}

An error occurred ({$page.status})

diff --git a/frontend/src/routes/@[username]/[memberName]/edit/+layout.svelte b/frontend/src/routes/@[username]/[memberName]/edit/+layout.svelte index 2f8c259..b5e98a3 100644 --- a/frontend/src/routes/@[username]/[memberName]/edit/+layout.svelte +++ b/frontend/src/routes/@[username]/[memberName]/edit/+layout.svelte @@ -107,7 +107,9 @@ href="/@{$member.user.name}/{data.member.name}" tooltip="Back to member" /> - + @@ -119,30 +121,27 @@ {/if}
diff --git a/frontend/src/routes/@[username]/[memberName]/edit/+layout.ts b/frontend/src/routes/@[username]/[memberName]/edit/+layout.ts index 1520af7..faa5c7a 100644 --- a/frontend/src/routes/@[username]/[memberName]/edit/+layout.ts +++ b/frontend/src/routes/@[username]/[memberName]/edit/+layout.ts @@ -1,4 +1,11 @@ -import type { PrideFlag, MeUser, APIError, Member, PronounsJson } from "$lib/api/entities"; +import { + type PrideFlag, + type MeUser, + type APIError, + type Member, + type PronounsJson, + ErrorCode, +} from "$lib/api/entities"; import { apiFetchClient } from "$lib/api/fetch"; import { error, redirect } from "@sveltejs/kit"; @@ -11,11 +18,21 @@ export const ssr = false; export const load = (async ({ params }) => { try { const user = await apiFetchClient(`/users/@me`); - const member = await apiFetchClient(`/users/@me/members/${params.memberName}`); + const member = await apiFetchClient( + `/users/${params.username}/members/${params.memberName}`, + ); const flags = await apiFetchClient("/users/@me/flags"); - if (user.name !== params.username || member.user.name !== params.username || member.name !== params.memberName) { - throw redirect(303, `/@${user.name}/${member.name}`); + if (user.id !== member.user.id) { + throw { code: ErrorCode.NotOwnMember, message: "Can only edit your own members" } as APIError; + } + + if ( + user.name !== params.username || + member.user.name !== params.username || + member.name !== params.memberName + ) { + throw redirect(303, `/@${user.name}/${member.name}`); } return { diff --git a/frontend/src/routes/@[username]/[memberName]/edit/bio/+page.svelte b/frontend/src/routes/@[username]/[memberName]/edit/bio/+page.svelte new file mode 100644 index 0000000..76eb78b --- /dev/null +++ b/frontend/src/routes/@[username]/[memberName]/edit/bio/+page.svelte @@ -0,0 +1,29 @@ + + +
+