Benutzer, Ticketzuweißungen

server/routes/api/events.js

@@ -1,5 +1,6 @@
 import { randomUUID } from 'crypto';
 import db from '../../db.js';
+import { requireCrmEdit } from '../../middleware/auth.js';
 import { badRequest } from '../../lib/http.js';
 import { mapEvent } from '../../lib/mappers.js';
 import { computeRemoteDurationSeconds } from '../../teamviewer.js';
@@ -7,7 +8,7 @@ import { computeRemoteDurationSeconds } from '../../teamviewer.js';
 const EVENT_TYPES_USER = new Set(['NOTE', 'CALL', 'REMOTE', 'PART']);
 
 export function registerEventRoutes(api) {
-  api.post('/events', (req, res) => {
+  api.post('/events', requireCrmEdit, (req, res) => {
     const b = req.body || {};
     const ticketId = b.ticketId;
     const type = b.type;