fix: don't add write perms, users can only delete objects

2025-11-10 04:22:09 +10:00 · 2025-04-10 19:50:04 -04:00
parent 35a2d98790
commit ca03be7f43
1 changed files with 1 additions and 1 deletions
--- a/server/api/v1/auth/signup/simple.post.ts
+++ b/server/api/v1/auth/signup/simple.post.ts
@ -64,7 +64,7 @@ export default defineEventHandler(async (h3) => {
    profilePictureId,
    async () => jdenticon.toPng(user.username, 256),
    {},
-    [`internal:read`, `${userId}:write`]
+    [`internal:read`, `${userId}:delete`]
  );
  const [linkMec] = await prisma.$transaction([
    prisma.linkedAuthMec.create({