Spaces:
Running
Running
Commit History
-
fix(auth): gate admin routes on the decoded path and in the actions themselves
The hooks gate tested the raw `event.url.pathname`, but SvelteKit matches routes on the decoded path, so a logged-in member could reach /admin (and reset the admin's password) via /%61dmin. Decode the pathname the same way before every check, and stop relying on the route gate alone: each admin load and action now calls requireAdmin, and the mutating actions require a member target so the admin account can never be renamed, reset, or deactivated from /admin.857fbc2