feat(it5): INSTRUTOR authorization hardening (#007)

[EmiyaKiritsugu3]

Summary

• Gates /dashboard/treinos with requireAnyRole(['INSTRUTOR', 'GERENTE']) — RECEPCIONISTA is silently redirected to /dashboard
• upsertTreinoAction now derives instrutorId from session (funcionarios.role) instead of trusting client payload — spoofing is no longer possible
• updateTreinoDayAction and deleteTreinoAction enforce ownership: INSTRUTOR can only mutate their own treinos; GERENTE bypasses the check
• instrutorId removed from TreinoBaseSchema (client input type); preserved in TreinoSchema (entity read type)
• instrutorId prop removed from TreinosManagementClient and TreinosPage; redundant getUser() call in page also removed
• Restores src/types/css.d.ts deleted in PR chore(deps): upgrade TypeScript 6 + @hookform/resolvers 5 #80 (TS6 upgrade) — fixes pre-existing TS2882 on globals.css

Test plan

• npm run typecheck — 0 errors
• npm run lint — 0 errors
• npm run test — 32/32 unit tests passing (+10 new auth/ownership tests for treinos.ts)
• npm run e2e — 20/20 scenarios passing (19 CRITICAL-PATHS entries; instrutor-auth-negative.spec.ts has 2 test cases)
• E2E scenario 🔒 [security fix] Replace insecure Math.random() with crypto.randomUUID() for ID generation #19: RECEPCIONISTA → /dashboard/treinos → redirected to /dashboard
• E2E scenario 🔒 [security fix] Replace insecure Math.random() with crypto.randomUUID() for ID generation #19: ALUNO → /dashboard/treinos → redirected away
• Existing 18 E2E scenarios — no regressions

Security impact (STRIDE)

Closes Elevation of Privilege gap: staff roles could previously forge instrutorId in the treino create payload, and any authenticated user could update/delete any treino. All three server actions are now fail-closed.

Commits

fix(it5): add requireAnyRole helper to auth.ts
fix(it5): add failing E2E negative auth test (TDD red)
fix(it5): gate /dashboard/treinos with requireAnyRole
fix(it5): add failing unit tests for treinos actions (TDD red)
fix(it5): remove instrutorId from TreinoBaseSchema (server-derived)
fix(it5): derive instrutorId from session in upsertTreinoAction
fix(it5): remove instrutorId prop from TreinosManagementClient
fix(it5): remove redundant getUser and instrutorId prop from TreinosPage
fix(it5): add ownership check to updateTreinoDayAction
fix(it5): add ownership check to deleteTreinoAction
chore(it5): update CRITICAL-PATHS.md 18 → 19 scenarios

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Role-based authorization expanded with a guard accepting multiple roles; instructor assignment now derived from user role.

• Bug Fixes

  • Added TypeScript CSS module declaration to prevent type/build errors.
  • Improved unauthenticated/permission responses to return structured errors.

• Tests

  • Added unit tests for action permissions/ownership and a new E2E negative auth spec.

• Documentation

  • Updated project state, progress to It5, tech notes and recent changes.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
smartmanagementsystem	Ready	Preview, Comment	Apr 22, 2026 3:31am

[coderabbitai]

Warning

.coderabbit.yaml has a parsing error

The CodeRabbit configuration file in this repository has a parsing error and default settings were used instead. Please fix the error(s) in the configuration file. You can initialize chat with CodeRabbit to get help with the configuration file.

💥 Parsing errors (1)

Validation error: Invalid enum value. Expected 'de' | 'de-DE' | 'de-AT' | 'de-CH' | 'en' | 'en-US' | 'en-AU' | 'en-GB' | 'en-CA' | 'en-NZ' | 'en-ZA' | 'es' | 'es-AR' | 'fr' | 'fr-CA' | 'fr-CH' | 'fr-BE' | 'nl' | 'nl-BE' | 'pt-AO' | 'pt' | 'pt-BR' | 'pt-MZ' | 'pt-PT' | 'ar' | 'ast-ES' | 'ast' | 'be-BY' | 'be' | 'br-FR' | 'br' | 'ca-ES' | 'ca' | 'ca-ES-valencia' | 'ca-ES-balear' | 'da-DK' | 'da' | 'de-DE-x-simple-language' | 'el-GR' | 'el' | 'eo' | 'fa' | 'ga-IE' | 'ga' | 'gl-ES' | 'gl' | 'it' | 'ja-JP' | 'ja' | 'km-KH' | 'km' | 'ko-KR' | 'ko' | 'pl-PL' | 'pl' | 'ro-RO' | 'ro' | 'ru-RU' | 'ru' | 'sk-SK' | 'sk' | 'sl-SI' | 'sl' | 'sv' | 'ta-IN' | 'ta' | 'tl-PH' | 'tl' | 'tr' | 'uk-UA' | 'uk' | 'zh-CN' | 'zh' | 'crh-UA' | 'crh' | 'cs-CZ' | 'cs' | 'nb' | 'no' | 'nl-NL' | 'de-DE-x-simple-language-DE' | 'es-ES' | 'it-IT' | 'fa-IR' | 'sv-SE' | 'de-LU' | 'fr-FR' | 'bg-BG' | 'bg' | 'he-IL' | 'he' | 'hi-IN' | 'hi' | 'vi-VN' | 'vi' | 'th-TH' | 'th' | 'bn-BD' | 'bn', received 'typescript' at "code_generation.docstrings.language"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

📝 Walkthrough

Walkthrough

Implements server-side role-based authorization for treinos: removes client-provided instrutorId, derives instructor assignment from user role, adds ownership/role checks in treinos actions, introduces requireAnyRole() guard, and adds unit and E2E tests plus related docs/types updates.

Changes

Cohort / File(s)	Summary
Git & Docs /.gitignore, CLAUDE.md, docs/CURRENT-STATE.md, tests/e2e/CRITICAL-PATHS.md	Tightened .gitignore for /specs/; updated CLAUDE and CURRENT-STATE to It5/feat metadata; bumped E2E scenarios to 19 and updated critical-paths doc.
Type Declarations src/types/css.d.ts, src/lib/definitions.ts	Added ambient declare module '*.css'; removed instrutorId from client input schema and added optional/nullable instrutorId to entity schema.
Auth Helpers & Tests src/lib/auth.ts, src/lib/auth.test.ts	Added requireAnyRole(allowedRoles: Role[]), made requireRole a wrapper, unified redirect/error handling, and added tests covering allowed/denied/fail-closed cases.
Server Actions & Tests src/lib/actions/treinos.ts, src/lib/actions/treinos.test.ts	Changed actions to return {success:false,error} instead of throwing for auth failures; enforce role checks and ownership rules; derive instrutorId server-side; added comprehensive Vitest suite for role/ownership branches.
Client Pages & Components src/app/dashboard/treinos/page.tsx, src/app/dashboard/treinos/treinos-client.tsx, src/app/aluno/meus-treinos/meus-treinos-client.tsx	Replaced Supabase lookup with requireAnyRole(['INSTRUTOR','GERENTE']); removed instrutorId prop/payloads from components; narrowed TreinosManagementClient props to { initialAlunos }.
E2E Tests tests/e2e/specs/instrutor-auth-negative.spec.ts	Added Playwright negative auth spec asserting RECEPCIONISTA and ALUNO are blocked from /dashboard/treinos and redirected appropriately.

Sequence Diagram(s)

sequenceDiagram
    participant Client as Client Component
    participant ServerAction as upsertTreinoAction
    participant Auth as Supabase Auth
    participant DB as Prisma DB

    Client->>ServerAction: upsertTreinoAction(treinoData) (no instrutorId)
    ServerAction->>Auth: supabase.auth.getUser()
    alt Unauthenticated
        Auth-->>ServerAction: user = null
        ServerAction-->>Client: { success: false, error: 'Usuário não autenticado' }
    else Authenticated
        Auth-->>ServerAction: user { id }
        ServerAction->>DB: SELECT role FROM funcionarios WHERE id = user.id (.maybeSingle)
        DB-->>ServerAction: role
        alt role == "RECEPCIONISTA"
            ServerAction-->>Client: { success: false, error: 'Acesso não autorizado' }
        else role == "INSTRUTOR"
            ServerAction->>DB: treino.create(data WITH instrutorId = user.id)
            DB-->>ServerAction: created treino
            ServerAction-->>Client: { success: true, data: treino }
        else role == "GERENTE"
            ServerAction->>DB: treino.create(data WITH instrutorId = null)
            DB-->>ServerAction: created treino
            ServerAction-->>Client: { success: true, data: treino }
        end
    end

Loading

sequenceDiagram
    participant Page as Page Component
    participant AuthGuard as requireAnyRole()
    participant Auth as Supabase Auth
    participant DB as Prisma DB

    Page->>AuthGuard: requireAnyRole(['INSTRUTOR','GERENTE'])
    AuthGuard->>Auth: supabase.auth.getUser()
    alt Unauthenticated
        Auth-->>AuthGuard: null
        AuthGuard-->>Page: redirect('/login')
    else Authenticated
        Auth-->>AuthGuard: user{id}
        AuthGuard->>DB: SELECT role FROM funcionarios WHERE id = user.id (.maybeSingle)
        alt DB error or role missing or not allowed
            DB-->>AuthGuard: error or role
            AuthGuard-->>Page: redirect('/dashboard') (fail-closed)
        else role allowed
            AuthGuard-->>Page: allow render
        end
    end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related issues

• [T004] Write failing unit test for requireRole in src/lib/auth.test.ts #46 — Adds unit-test coverage requests for role-guard behavior; this PR implements requireAnyRole and expands auth tests addressing that objective.

Possibly related PRs

• #80 — Adds the same src/types/css.d.ts ambient declaration; overlaps with this PR's type addition.
• #58 — Introduces a requireRole() auth helper; closely related to the requireAnyRole() refactor here.
• #57 — Modifies auth guards and tests in src/lib/auth.ts; shares overlapping changes to authorization helpers.

Poem

🐰 I hopped through guards with tiny paws,
Server keeps IDs safe from curious claws.
Roles decide who edits the plan,
Tests pat the burrow — all works as planned.
Hooray — carrots for the team! 🎉

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: authorization hardening for INSTRUTOR role in iteration 5.
Description check	✅ Passed	The description provides a comprehensive summary, test plan with checkmarks, security impact analysis, and detailed commits. All required template sections are addressed.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/007-it5-instrutor-auth

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 5

🧹 Nitpick comments (1)

src/lib/auth.ts (1)

11-37: Consolidate duplicated role-resolution logic to reduce security drift risk.

Line 11-37 duplicates the same user/role fetch flow already present in requireRole (Line 44-70). A shared helper (or implementing requireRole via requireAnyRole([allowedRole])) will keep fail-closed behavior consistent as auth rules evolve.

♻️ Suggested refactor

+async function getCurrentUserRole(): Promise<Role> {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+
+  if (!user) redirect('/login');
+
+  const { data, error } = await supabase
+    .from('funcionarios')
+    .select('role')
+    .eq('id', user.id)
+    .maybeSingle();
+
+  if (error) {
+    Logger.error(`[auth] DB error fetching role: ${error.message}`, error);
+    redirect('/dashboard');
+  }
+
+  if (!data) redirect('/dashboard');
+  return data.role;
+}
+
 export async function requireAnyRole(allowedRoles: Role[]): Promise<void> {
-  const supabase = await createClient();
-  const {
-    data: { user },
-  } = await supabase.auth.getUser();
-  if (!user) {
-    redirect('/login');
-    return;
-  }
-  const { data, error } = await supabase
-    .from('funcionarios')
-    .select('role')
-    .eq('id', user.id)
-    .maybeSingle();
-  if (error) {
-    Logger.error(`[requireAnyRole] DB error fetching role: ${error.message}`, error);
-    redirect('/dashboard');
-  }
-  if (!data || !allowedRoles.includes(data.role)) {
-    redirect('/dashboard');
-  }
+  const role = await getCurrentUserRole();
+  if (!allowedRoles.includes(role)) redirect('/dashboard');
 }
 
 export async function requireRole(allowedRole: Role): Promise<void> {
-  // duplicated logic...
+  await requireAnyRole([allowedRole]);
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/lib/auth.ts` around lines 11 - 37, The requireAnyRole function duplicates
the user/role fetch and error handling present in requireRole; refactor by
extracting the shared logic into a helper (e.g., getUserRole or
fetchCurrentUserRole) that uses createClient(), supabase.auth.getUser(), and the
.from('funcionarios').select('role').eq('id', user.id).maybeSingle() call and
returns the resolved role or throws/returns a consistent error, then have both
requireAnyRole and requireRole call that helper (or implement requireRole as
requireAnyRole([role]) after calling the helper) so the DB error handling and
redirect/fail-closed behavior are identical across requireAnyRole and
requireRole.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docs/CURRENT-STATE.md`:
- Around line 3-5: Update the CURRENT-STATE.md entries that are stale: open the
document and change the "**Last Updated**" date to the PR's current date, update
the "**Branch**" and "**Version**" lines if needed, and refresh the E2E scenario
counts/status text to reflect 20/20 scenarios passing and remove the pending
"npm run e2e" note; also propagate the same corrections to the other occurrences
mentioned (around lines showing E2E counts at sections 23-29 and 65-68) so the
handoff doc accurately matches the PR status.

In `@src/lib/actions/treinos.test.ts`:
- Around line 63-222: Add tests covering two missing auth-sensitive cases for
upsertTreinoAction: (1) an update path when payload includes an id — create a
test that supplies BASE_PAYLOAD with an id (simulate mockTreino.update) and a
session (INSTRUTOR or GERENTE as appropriate) to verify ownership logic runs for
updates; (2) an ALUNO role attempting to upsert with alunoId that is not their
own — build a Supabase mock with role 'ALUNO' and a different alunoId in
BASE_PAYLOAD and assert the result is { success: false, error: 'Acesso não
autorizado' } and that neither mockTreino.create nor mockTreino.update were
called. Ensure tests reference upsertTreinoAction, mockCreateClient,
mockTreino.create/update, and the session-building helper (buildSupabaseMock).

In `@src/lib/actions/treinos.ts`:
- Around line 114-127: The current guard only allows GERENTE or the treino's
instrutor to modify treinos, which blocks ALUNO actions from the aluno portal;
update the authorization logic in the block that queries funcionarios
(funcData?.role) and treino (prisma.treino.findUnique) to also allow the request
if the user is an ALUNO assigned to that treino by checking the treino-aluno
relationship (e.g., query the join table like treinoAlunos or participants for a
record where treinoId === treinoId and alunoId === user.id); permit the action
when that membership exists, otherwise return the existing unauthorized error.
- Around line 24-38: The upsertTreinoAction still trusts client-provided alunoId
and id: enforce server-side ownership by ignoring a supplied alunoId when
funcData is null (ALUNO) and instead set alunoId = user.id, and when an id is
provided (update path) fetch the existing treino via
supabase.from('treinos').select(...).eq('id', id).maybeSingle() and verify
ownership—allow update only if the current user is the treino.alunoId (for
ALUNO) or is the instrutor (derivedInstrutorId) responsible; reject otherwise.
Also ensure creation path never lets an ALUNO create a treino for another aluno
and strip/override any client-sent instrutorId/alunoId fields before writing.

In `@tests/e2e/specs/instrutor-auth-negative.spec.ts`:
- Around line 16-23: The test "ALUNO cannot access /dashboard/treinos —
redirected away" currently only checks that the URL no longer contains
'/dashboard/treinos'; change the assertion to verify the middleware's expected
destination by waiting for and asserting the user is redirected to '/aluno'
instead. Use the existing helpers (loginAs and page.goto) and replace the
negative assertion (expect(page.url()).not.toContain('/dashboard/treinos')) with
an explicit check that the final URL matches or starts with '/aluno' (e.g., via
page.waitForURL or expect on page.url()) to lock the contract.

---

Nitpick comments:
In `@src/lib/auth.ts`:
- Around line 11-37: The requireAnyRole function duplicates the user/role fetch
and error handling present in requireRole; refactor by extracting the shared
logic into a helper (e.g., getUserRole or fetchCurrentUserRole) that uses
createClient(), supabase.auth.getUser(), and the
.from('funcionarios').select('role').eq('id', user.id).maybeSingle() call and
returns the resolved role or throws/returns a consistent error, then have both
requireAnyRole and requireRole call that helper (or implement requireRole as
requireAnyRole([role]) after calling the helper) so the DB error handling and
redirect/fail-closed behavior are identical across requireAnyRole and
requireRole.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2f7aff56-be6d-48c7-ba47-1787cf09d374

📥 Commits

Reviewing files that changed from the base of the PR and between 2dc556b and 8bff4a2.

📒 Files selected for processing (13)

• .gitignore
• CLAUDE.md
• docs/CURRENT-STATE.md
• src/app/aluno/meus-treinos/meus-treinos-client.tsx
• src/app/dashboard/treinos/page.tsx
• src/app/dashboard/treinos/treinos-client.tsx
• src/lib/actions/treinos.test.ts
• src/lib/actions/treinos.ts
• src/lib/auth.ts
• src/lib/definitions.ts
• src/types/css.d.ts
• tests/e2e/CRITICAL-PATHS.md
• tests/e2e/specs/instrutor-auth-negative.spec.ts

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

CURRENT-STATE.md is already out of sync with this PR.

This file still reports 19 E2E scenarios and a pending npm run e2e, while the PR status here says 20/20 scenarios are passing and the PR is ready. Please refresh the counts/status here as well, or this handoff doc stops being trustworthy. Based on learnings, "Maintain and update docs/CURRENT-STATE.md at the start and end of every session to document progress and blockers".

Also applies to: 23-29, 65-68

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docs/CURRENT-STATE.md` around lines 3 - 5, Update the CURRENT-STATE.md
entries that are stale: open the document and change the "**Last Updated**" date
to the PR's current date, update the "**Branch**" and "**Version**" lines if
needed, and refresh the E2E scenario counts/status text to reflect 20/20
scenarios passing and remove the pending "npm run e2e" note; also propagate the
same corrections to the other occurrences mentioned (around lines showing E2E
counts at sections 23-29 and 65-68) so the handoff doc accurately matches the PR
status.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Coverage misses the remaining auth-sensitive cases.

This suite never exercises upsertTreinoAction with an id or an ALUNO session sending someone else’s alunoId, so it would still pass with the write-path bypass above. Please add those cases before treating this hardening as complete.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/lib/actions/treinos.test.ts` around lines 63 - 222, Add tests covering
two missing auth-sensitive cases for upsertTreinoAction: (1) an update path when
payload includes an id — create a test that supplies BASE_PAYLOAD with an id
(simulate mockTreino.update) and a session (INSTRUTOR or GERENTE as appropriate)
to verify ownership logic runs for updates; (2) an ALUNO role attempting to
upsert with alunoId that is not their own — build a Supabase mock with role
'ALUNO' and a different alunoId in BASE_PAYLOAD and assert the result is {
success: false, error: 'Acesso não autorizado' } and that neither
mockTreino.create nor mockTreino.update were called. Ensure tests reference
upsertTreinoAction, mockCreateClient, mockTreino.create/update, and the
session-building helper (buildSupabaseMock).

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

upsertTreinoAction still trusts client-controlled ownership.

Deriving instrutorId server-side is good, but this action still accepts arbitrary alunoId and optional id from any authenticated non-RECEPCIONISTA caller. An ALUNO can still create a treino for another student, and any authenticated caller can still update an existing treino they do not own by sending its id, so the main write path is not actually fail-closed yet.

Also applies to: 49-71

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/lib/actions/treinos.ts` around lines 24 - 38, The upsertTreinoAction
still trusts client-provided alunoId and id: enforce server-side ownership by
ignoring a supplied alunoId when funcData is null (ALUNO) and instead set
alunoId = user.id, and when an id is provided (update path) fetch the existing
treino via supabase.from('treinos').select(...).eq('id', id).maybeSingle() and
verify ownership—allow update only if the current user is the treino.alunoId
(for ALUNO) or is the instrutor (derivedInstrutorId) responsible; reject
otherwise. Also ensure creation path never lets an ALUNO create a treino for
another aluno and strip/override any client-sent instrutorId/alunoId fields
before writing.

[coderabbitai]

Actionable comments posted: 1

♻️ Duplicate comments (1)

src/lib/actions/treinos.ts (1)

55-73: ⚠️ Potential issue | 🔴 Critical

Keep the upsert update path fail-closed.

Line 55 still updates by primary key only. Any authenticated caller who knows a treino id can rewrite another user's treino contents, so the main write path remains open even after hardening the day/delete actions.

🔒 Proposed fix

     if (id) {
+      const existingTreino = await prisma.treino.findUnique({
+        where: { id },
+        select: { alunoId: true, instrutorId: true },
+      });
+
+      if (!existingTreino) {
+        return { success: false, error: 'Treino não encontrado' };
+      }
+
+      const canManage =
+        funcData?.role === 'GERENTE' ||
+        (funcData?.role === 'INSTRUTOR' && existingTreino.instrutorId === user.id) ||
+        (funcData === null && existingTreino.alunoId === user.id);
+
+      if (!canManage) {
+        return { success: false, error: 'Acesso não autorizado' };
+      }
+
       // Update
       await prisma.treino.update({
         where: { id },
         data: {
           objetivo,

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/lib/actions/treinos.ts` around lines 55 - 73, The update path uses
prisma.treino.update with only where: { id } which allows any caller who knows
an id to modify another user's treino; change the update to enforce ownership by
using a composite where that includes the current user's id (e.g., where: { id,
userId: currentUserId }) or first fetch the treino by id and verify
treino.userId === currentUserId before calling prisma.treino.update, and if the
ownership check fails throw/return an authorization error so the operation fails
closed; ensure this check is applied to the update branch that builds the
Exercicios payload.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/lib/actions/treinos.ts`:
- Around line 127-133: The authorization currently allows any non-GERENTE whose
user.id matches treino.instrutorId to act, which lets non-INSTRUTOR roles (e.g.,
RECEPCIONISTA) manipulate treinos; update the checks in both
updateTreinoDayAction and deleteTreinoAction so the instrutor branch requires
funcData.role === 'INSTRUTOR' in addition to treino.instrutorId === user.id
(i.e., only permit when the user is the treino's instrutor and their Funcionario
role is INSTRUTOR), leaving the GERENTE branch unchanged and returning the same
unauthorized response otherwise.

---

Duplicate comments:
In `@src/lib/actions/treinos.ts`:
- Around line 55-73: The update path uses prisma.treino.update with only where:
{ id } which allows any caller who knows an id to modify another user's treino;
change the update to enforce ownership by using a composite where that includes
the current user's id (e.g., where: { id, userId: currentUserId }) or first
fetch the treino by id and verify treino.userId === currentUserId before calling
prisma.treino.update, and if the ownership check fails throw/return an
authorization error so the operation fails closed; ensure this check is applied
to the update branch that builds the Exercicios payload.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3843c1fd-9b70-4a52-95d6-55ea305aa77e

📥 Commits

Reviewing files that changed from the base of the PR and between 7761e84 and b9035a3.

📒 Files selected for processing (3)

• src/lib/actions/treinos.ts
• src/lib/auth.ts
• tests/e2e/specs/instrutor-auth-negative.spec.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• tests/e2e/specs/instrutor-auth-negative.spec.ts
• src/lib/auth.ts

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Restrict the instrutor branch to actual INSTRUTORs.

Lines 127 and 167 currently authorize any non-manager whose user.id matches treino.instrutorId. Since Treino.instrutorId is just a Funcionario FK, a RECEPCIONISTA or downgraded staff account can still move/delete the treino if that row points to them.

🛡️ Proposed fix

-    if (
-      funcData?.role !== 'GERENTE' &&
-      treino?.instrutorId !== user.id &&
-      treino?.alunoId !== user.id
-    ) {
+    const canManage =
+      funcData?.role === 'GERENTE' ||
+      (funcData?.role === 'INSTRUTOR' && treino?.instrutorId === user.id) ||
+      (funcData === null && treino?.alunoId === user.id);
+
+    if (!canManage) {
       return { success: false, error: 'Acesso não autorizado' };
     }

Apply the same predicate in both updateTreinoDayAction and deleteTreinoAction.

Also applies to: 167-173

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/lib/actions/treinos.ts` around lines 127 - 133, The authorization
currently allows any non-GERENTE whose user.id matches treino.instrutorId to
act, which lets non-INSTRUTOR roles (e.g., RECEPCIONISTA) manipulate treinos;
update the checks in both updateTreinoDayAction and deleteTreinoAction so the
instrutor branch requires funcData.role === 'INSTRUTOR' in addition to
treino.instrutorId === user.id (i.e., only permit when the user is the treino's
instrutor and their Funcionario role is INSTRUTOR), leaving the GERENTE branch
unchanged and returning the same unauthorized response otherwise.