diff --git a/client/src/components/Sidebar.tsx b/client/src/components/Sidebar.tsx index dedcede..f5b7acc 100644 --- a/client/src/components/Sidebar.tsx +++ b/client/src/components/Sidebar.tsx @@ -1208,7 +1208,7 @@ function MedScheduleNavItem({ collapsed }: { collapsed: boolean }) { const [location] = useLocation(); const isActive = location === '/med' || location.startsWith('/med/'); - if (user?.organization?.slug !== 'medschedule') return null; + if (user?.organization?.slug !== 'medschedule' && !isAdmin(user)) return null; if (collapsed) { return ( diff --git a/server/medschedule/routes.ts b/server/medschedule/routes.ts index 144440e..22b302c 100644 --- a/server/medschedule/routes.ts +++ b/server/medschedule/routes.ts @@ -2,7 +2,7 @@ import { Router } from "express"; import type { Express, Request, Response, NextFunction } from "express"; import type { Response as ExpressResponse } from "express"; import { authenticateToken, type AuthenticatedRequest } from "../middleware/auth.middleware"; -import { tenantIsolation } from "../middleware/tenant.middleware"; + import { medScheduleStorage } from "./storage"; interface MedRequest extends AuthenticatedRequest { @@ -17,24 +17,16 @@ async function resolveMedOrganizationId(): Promise { return cachedMedOrgId; } -function medOrgResolver() { - return async (_req: Request, _res: Response, next: NextFunction) => { - try { - await resolveMedOrganizationId(); - next(); - } catch (err) { - next(err as Error); - } - }; -} - function requireMedOrganization() { return async (req: MedRequest, res: Response, next: NextFunction) => { const medOrgId = await resolveMedOrganizationId(); req.medOrganizationId = medOrgId; - // Если запрос от аутентифицированного пользователя, убедимся, что он принадлежит к org MedSchedule - if (req.user && req.user.organizationId !== medOrgId) { + // MedSchedule API работает в контексте org medschedule, а не текущей org пользователя + req.organizationId = medOrgId; + + // Доступ разрешён либо членам org medschedule, либо администраторам приложения + if (req.user && req.user.organizationId !== medOrgId && req.user.appRole !== "admin") { return res.status(403).json({ success: false, error: "Этот раздел доступен только пользователям MedSchedule", @@ -55,8 +47,6 @@ function parseDate(value: unknown): Date | null { export function registerMedScheduleRoutes(app: Express) { const router = Router(); router.use(authenticateToken); - router.use(tenantIsolation); - router.use(medOrgResolver()); router.use(requireMedOrganization()); // =====================