diff --git a/frontend/src/lib/admin/codes.ts b/frontend/src/lib/admin/codes.ts index 3fc448ef..184b6958 100644 --- a/frontend/src/lib/admin/codes.ts +++ b/frontend/src/lib/admin/codes.ts @@ -91,14 +91,14 @@ export function mapCode(row: RpcCodeRow): RedemptionCodeRecord { export async function runCodeRpc( functionName: T, - session: Pick, + session: Pick, id: string, args: CodeRpcArgs[T], ): Promise { const common = [ session.user.id, session.user.email, - session.roles[0] ?? "admin", + "admin", id, ]; let rows: RpcCodeRow[] = []; diff --git a/frontend/tests/high-risk-billing-routes-contract.test.ts b/frontend/tests/high-risk-billing-routes-contract.test.ts index 54b1606c..b3398eb1 100644 --- a/frontend/tests/high-risk-billing-routes-contract.test.ts +++ b/frontend/tests/high-risk-billing-routes-contract.test.ts @@ -106,6 +106,8 @@ test("redemption-code writes generate server audit reasons and encode JSONB for assert.match(codeRoute, /p_reason:\s*"admin_console_update_redemption_code"/); assert.match(codeRoute, /p_reason:\s*"admin_console_revoke_redemption_code"/); assert.match(codesHelper, /JSON\.stringify\(input\.p_codes\)/); + assert.match(codesHelper, /session\.user\.email,[\s\S]*"admin",/); + assert.doesNotMatch(codesHelper, /session\.roles\[0\]/); assert.match(codesHelper, /queryAdminRows/); assert.match(codesHelper, /public\.admin_create_redemption_codes\(/); assert.match(codesHelper, /public\.admin_update_redemption_code\(/);