8fc360a596
Fixes IDOR: the endpoint was publicly accessible to any authenticated user. Now requires ADMIN_USER permission, matching all other user management endpoints. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
9 lines
286 B
TypeScript
9 lines
286 B
TypeScript
import { createApiClient } from '$lib/api.server';
|
|
import type { LayoutServerLoad } from './$types';
|
|
|
|
export const load: LayoutServerLoad = async ({ fetch }) => {
|
|
const api = createApiClient(fetch);
|
|
const result = await api.GET('/api/users');
|
|
return { users: result.data ?? [] };
|
|
};
|