From 9f8530df6e651c636ae5f6f4c9981131c46a377a Mon Sep 17 00:00:00 2001
From: averel10 <achille.huenenberger@gmail.com>
Date: Thu, 12 Mar 2026 14:31:16 +0100
Subject: [PATCH] added require-admin checks

---
 src/app/actions/datasets.ts | 11 +++++++++++
 src/app/actions/upload.ts   |  6 ++++++
 2 files changed, 17 insertions(+)

diff --git a/src/app/actions/datasets.ts b/src/app/actions/datasets.ts
index 12843d4..2887422 100644
--- a/src/app/actions/datasets.ts
+++ b/src/app/actions/datasets.ts
@@ -4,8 +4,14 @@ import db from '@/lib/db';
 import { dataset } from '@/lib/model/dataset';
 import { eq } from 'drizzle-orm';
 import { revalidatePath } from 'next/cache';
+import { requireAdmin } from '@/lib/auth';
 
 export async function createDataset({ name }: { name: string }) {
+  const result = await requireAdmin();
+  if (!result.authenticated || !result.admin) {
+    throw new Error('Unauthorized');
+  }
+
   if (!name || !name.trim()) {
     throw new Error('Dataset name is required');
   }
@@ -24,6 +30,11 @@ export async function updateDataset(
   id: number,
   updates: { name?: string }
 ) {
+  const result = await requireAdmin();
+  if (!result.authenticated || !result.admin) {
+    throw new Error('Unauthorized');
+  }
+
   if (updates.name !== undefined && !updates.name.trim()) {
     throw new Error('Dataset name cannot be empty');
   }
diff --git a/src/app/actions/upload.ts b/src/app/actions/upload.ts
index 2569618..5429f9e 100644
--- a/src/app/actions/upload.ts
+++ b/src/app/actions/upload.ts
@@ -9,6 +9,7 @@ import { join } from 'path';
 import { existsSync } from 'fs';
 import extract from 'extract-zip';
 import { line } from 'drizzle-orm/pg-core';
+import { requireAdmin } from '@/lib/auth';
 
 interface DatasetEntryInput {
   id: string;
@@ -24,6 +25,11 @@ export async function uploadDatasetEntries(
   datasetId: number,
   formData: FormData
 ) {
+  const result = await requireAdmin();
+  if (!result.authenticated || !result.admin) {
+    throw new Error('Unauthorized');
+  }
+
   const file = formData.get('file') as File;
 
   if (!file) {