harden admin api authorization and add authz regression tests

apps/admin/src/app/api/trainer-client/[id]/route.ts

@@ -35,36 +35,37 @@ export async function DELETE(
 
     const { id } = await params;
 
-    // Try to find the assignment by checking trainer's assignments first
-    const trainerAssignments = await db.getTrainerClientAssignments(
-      currentUser.id,
-    );
-    let assignment = trainerAssignments.find((a) => a.id === id);
+    const allAssignments = await db.getAllTrainerClientAssignments();
+    const assignment = allAssignments.find((a) => a.id === id);
 
     if (!assignment) {
-      // Check all assignments to find the one with this ID
-      const allAssignments = await db.getAllTrainerClientAssignments();
-      assignment = allAssignments.find((a) => a.id === id);
+      return NextResponse.json(
+        { error: "Assignment not found" },
+        { status: 404 },
+      );
+    }
 
-      if (!assignment) {
-        return NextResponse.json(
-          { error: "Assignment not found" },
-          { status: 404 },
-        );
+    if (currentUser.role !== "superAdmin") {
+      if (!currentUser.gymId) {
+        return NextResponse.json({ error: "No gym assigned" }, { status: 403 });
       }
 
-      // Deactivate the assignment
-      await db.deactivateTrainerClientAssignment(id);
+      const [trainer, client] = await Promise.all([
+        db.getUserById(assignment.trainerId),
+        db.getUserById(assignment.clientId),
+      ]);
 
-      log.info("Trainer-client assignment deactivated", {
-        assignmentId: id,
-        deactivatedBy: currentUser.id,
-      });
-
-      return NextResponse.json({
-        success: true,
-        message: "Assignment deactivated successfully",
-      });
+      if (
+        !trainer ||
+        !client ||
+        trainer.gymId !== currentUser.gymId ||
+        client.gymId !== currentUser.gymId
+      ) {
+        return NextResponse.json(
+          { error: "Cannot modify assignments from other gyms" },
+          { status: 403 },
+        );
+      }
     }
 
     // Deactivate the assignment

apps/admin/src/app/api/trainer-client/__tests__/route-authz.test.ts

@@ -0,0 +1,89 @@
+/**
+ * @jest-environment node
+ */
+
+import { NextRequest } from "next/server";
+import { GET, POST } from "../route";
+
+jest.mock("@clerk/nextjs/server", () => ({
+  auth: jest.fn(),
+}));
+
+jest.mock("@/lib/database", () => ({
+  getDatabase: jest.fn(),
+}));
+
+jest.mock("@/lib/sync-user", () => ({
+  ensureUserSynced: jest.fn(),
+}));
+
+jest.mock("@/lib/logger", () => ({
+  info: jest.fn(),
+  warn: jest.fn(),
+  error: jest.fn(),
+  debug: jest.fn(),
+}));
+
+describe("/api/trainer-client authz", () => {
+  const mockAuth = require("@clerk/nextjs/server").auth as jest.Mock;
+  const mockGetDatabase = require("@/lib/database").getDatabase as jest.Mock;
+  const mockEnsureUserSynced = require("@/lib/sync-user")
+    .ensureUserSynced as jest.Mock;
+
+  const mockDb = {
+    getUserById: jest.fn(),
+    getTrainerClientAssignments: jest.fn(),
+    getAllTrainerClientAssignments: jest.fn(),
+    createTrainerClientAssignment: jest.fn(),
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockGetDatabase.mockResolvedValue(mockDb);
+  });
+
+  it("blocks non-admin users from listing assignments", async () => {
+    mockAuth.mockResolvedValue({ userId: "trainer_1" });
+    mockEnsureUserSynced.mockResolvedValue({
+      id: "trainer_1",
+      role: "trainer",
+      gymId: "gym_a",
+    });
+
+    const request = new NextRequest("http://localhost/api/trainer-client");
+    const response = await GET(request);
+
+    expect(response.status).toBe(403);
+  });
+
+  it("blocks admins from creating assignments across gyms", async () => {
+    mockAuth.mockResolvedValue({ userId: "admin_1" });
+    mockEnsureUserSynced.mockResolvedValue({
+      id: "admin_1",
+      role: "admin",
+      gymId: "gym_a",
+    });
+
+    mockDb.getUserById
+      .mockResolvedValueOnce({
+        id: "trainer_2",
+        role: "trainer",
+        gymId: "gym_b",
+      })
+      .mockResolvedValueOnce({
+        id: "client_2",
+        role: "client",
+        gymId: "gym_b",
+      });
+
+    const request = new NextRequest("http://localhost/api/trainer-client", {
+      method: "POST",
+      body: JSON.stringify({ trainerId: "trainer_2", clientId: "client_2" }),
+    });
+
+    const response = await POST(request);
+
+    expect(response.status).toBe(403);
+    expect(mockDb.createTrainerClientAssignment).not.toHaveBeenCalled();
+  });
+});

apps/admin/src/app/api/trainer-client/route.ts

@@ -38,17 +38,110 @@ export async function GET(request: NextRequest) {
     const trainerId = searchParams.get("trainerId");
     const clientId = searchParams.get("clientId");
 
-    let assignments;
+    if (trainerId && clientId) {
+      const [trainer, client] = await Promise.all([
+        db.getUserById(trainerId),
+        db.getUserById(clientId),
+      ]);
 
-    if (trainerId) {
-      assignments = await db.getTrainerClientAssignments(trainerId);
-      // Filter by clientId if provided
-      if (clientId) {
-        assignments = assignments.filter((a) => a.clientId === clientId);
+      if (!trainer || !client) {
+        return NextResponse.json({ error: "User not found" }, { status: 404 });
       }
-    } else {
-      // Get all assignments (for admins, filtered by gym)
-      assignments = await db.getAllTrainerClientAssignments();
+
+      if (
+        currentUser.role !== "superAdmin" &&
+        (!currentUser.gymId ||
+          trainer.gymId !== currentUser.gymId ||
+          client.gymId !== currentUser.gymId)
+      ) {
+        return NextResponse.json(
+          { error: "Cannot access assignments from other gyms" },
+          { status: 403 },
+        );
+      }
+    }
+
+    if (trainerId && !clientId) {
+      const trainer = await db.getUserById(trainerId);
+      if (!trainer) {
+        return NextResponse.json(
+          { error: "Trainer not found" },
+          { status: 404 },
+        );
+      }
+
+      if (
+        currentUser.role !== "superAdmin" &&
+        (!currentUser.gymId || trainer.gymId !== currentUser.gymId)
+      ) {
+        return NextResponse.json(
+          { error: "Cannot access assignments from other gyms" },
+          { status: 403 },
+        );
+      }
+    }
+
+    if (!trainerId && clientId) {
+      const client = await db.getUserById(clientId);
+      if (!client) {
+        return NextResponse.json(
+          { error: "Client not found" },
+          { status: 404 },
+        );
+      }
+
+      if (
+        currentUser.role !== "superAdmin" &&
+        (!currentUser.gymId || client.gymId !== currentUser.gymId)
+      ) {
+        return NextResponse.json(
+          { error: "Cannot access assignments from other gyms" },
+          { status: 403 },
+        );
+      }
+    }
+
+    let assignments = trainerId
+      ? await db.getTrainerClientAssignments(trainerId)
+      : await db.getAllTrainerClientAssignments();
+
+    if (clientId) {
+      assignments = assignments.filter((a) => a.clientId === clientId);
+    }
+
+    if (currentUser.role !== "superAdmin") {
+      if (!currentUser.gymId) {
+        return NextResponse.json({ error: "No gym assigned" }, { status: 403 });
+      }
+
+      const involvedUserIds = Array.from(
+        new Set(
+          assignments.flatMap((assignment) => [
+            assignment.trainerId,
+            assignment.clientId,
+          ]),
+        ),
+      );
+
+      const users = await Promise.all(
+        involvedUserIds.map((userId) => db.getUserById(userId)),
+      );
+
+      const gymByUserId = new Map(
+        users
+          .filter((user): user is NonNullable<typeof user> => !!user)
+          .map((user) => [user.id, user.gymId]),
+      );
+
+      assignments = assignments.filter((assignment) => {
+        const trainerGymId = gymByUserId.get(assignment.trainerId);
+        const clientGymId = gymByUserId.get(assignment.clientId);
+
+        return (
+          trainerGymId === currentUser.gymId &&
+          clientGymId === currentUser.gymId
+        );
+      });
     }
 
     return NextResponse.json({ assignments });
@@ -121,6 +214,18 @@ export async function POST(request: NextRequest) {
       );
     }
 
+    if (
+      currentUser.role !== "superAdmin" &&
+      (!currentUser.gymId ||
+        trainer.gymId !== currentUser.gymId ||
+        client.gymId !== currentUser.gymId)
+    ) {
+      return NextResponse.json(
+        { error: "Cannot assign users from other gyms" },
+        { status: 403 },
+      );
+    }
+
     // Check if assignment already exists
     const existingAssignments = await db.getTrainerClientAssignments(trainerId);
     const existingAssignment = existingAssignments.find(