Secure actor-owned game API routes

2026-07-25 08:50:41 +00:00
parent 6889c463fd
commit a9d6541c18
13 changed files with 301 additions and 118 deletions
@@ -99,10 +99,14 @@ export const appRouter = router({
                    password: input.password,
                    displayName: input.displayName,
                });
-                await ctx.users.updateRoles(created.id, ['superuser']);
-                const session = await ctx.sessions.createSession(created);
+                const bootstrappedUser = {
+                    ...created,
+                    roles: ['superuser'],
+                };
+                await ctx.users.updateRoles(created.id, bootstrappedUser.roles);
+                const session = await ctx.sessions.createSession(bootstrappedUser);
                return {
-                    user: toPublicUser(created),
+                    user: toPublicUser(bootstrappedUser),
                    sessionToken: session.sessionToken,
                    issuedAt: session.issuedAt,
                };