1.0.36

src/routes/api/registries/[id]/default/+server.ts

@@ -1,8 +1,14 @@
 import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { setDefaultRegistry, getRegistry } from '$lib/server/db';
+import { authorize } from '$lib/server/authorize';
+
+export const POST: RequestHandler = async ({ params, cookies }) => {
+	const auth = await authorize(cookies);
+	if (auth.authEnabled && !await auth.can('settings', 'edit')) {
+		return json({ error: 'Permission denied' }, { status: 403 });
+	}
 
-export const POST: RequestHandler = async ({ params }) => {
 	try {
 		const id = parseInt(params.id);
 		if (isNaN(id)) {