feat(recordings): only recorder can accept/reject suggestions in MVP

Backend changes:
- Restrict suggestion status updates to recorder only
- Dancers can now only view who is assigned to record them
- Return 403 error if non-recorder tries to update status

Frontend changes:
- Remove Accept/Reject buttons from dancer view (TO_BE_RECORDED)
- Add "Pending" status badge with clock icon for pending suggestions
- Keep Accept/Reject buttons for recorder view (TO_RECORD)
- Dancers see only status badge and optional chat button

UX flow:
- Dancer sees: "Recording you: @username [Pending]"
- Recorder sees: "You record: @username [Accept] [Reject]"
- Only recorder's action creates the Match
This commit is contained in:
Radosław Gierwiało
2025-11-30 14:54:09 +01:00
parent 560ff1edc1
commit 2e49fa5c62
2 changed files with 46 additions and 22 deletions

View File

@@ -1249,14 +1249,14 @@ router.put('/:slug/match-suggestions/:suggestionId/status', authenticate, async
});
}
// Check authorization: only dancer or recorder can update status
const isDancer = suggestion.heat.userId === userId;
// Check authorization: only recorder can update status (MVP decision)
// Dancer can only view who is assigned to record them
const isRecorder = suggestion.recorderId === userId;
if (!isDancer && !isRecorder) {
if (!isRecorder) {
return res.status(403).json({
success: false,
error: 'You are not authorized to update this suggestion',
error: 'Only the assigned recorder can accept or reject this suggestion',
});
}