Add team ownership verification to /injury set-new #17

New Issue

cal · 2026-02-20T04:22:08Z

cal commented

2026-02-20 04:22:08 +00:00

Found in commands/injuries/management.py:418:

# Check if player is on user's team
# Note: This assumes you have a function to get team by owner
# For now, we'll skip this check - you can add it if needed
# TODO: Add team ownership verification

Currently any user with the SBA Players role can set injuries on any team's players. The command should verify that the player belongs to a team owned by the command invoker before allowing the injury to be recorded.

This would require looking up the user's team (via Discord user ID → team owner mapping) and comparing it to the player's team_id.

Found in `commands/injuries/management.py:418`: ```python # Check if player is on user's team # Note: This assumes you have a function to get team by owner # For now, we'll skip this check - you can add it if needed # TODO: Add team ownership verification ``` Currently any user with the SBA Players role can set injuries on any team's players. The command should verify that the player belongs to a team owned by the command invoker before allowing the injury to be recorded. This would require looking up the user's team (via Discord user ID → team owner mapping) and comparing it to the player's `team_id`.

cal commented

2026-03-01 22:10:20 +00:00

Closing as duplicate of #18.

cal closed this issue

2026-03-01 22:10:21 +00:00

Sign in to join this conversation.