Benutzer, Ticketzuweißungen

server/routes/api/attachments.js

@@ -5,6 +5,7 @@ import { randomUUID } from 'crypto';
 import { fileURLToPath } from 'url';
 import multer from 'multer';
 import db from '../../db.js';
+import { requireCrmEdit } from '../../middleware/auth.js';
 import { badRequest, UUID } from '../../lib/http.js';
 import { mapEvent } from '../../lib/mappers.js';
 
@@ -106,6 +107,7 @@ function discardIncomingFiles(files) {
 export function registerAttachmentRoutes(api) {
   api.post(
     '/tickets/:ticketId/events/attachments',
+    requireCrmEdit,
     uploadMiddleware,
     async (req, res) => {
       const { ticketId } = req.params;