From d2d42af495ae7a4f41ed743f2f17677af9e8f782 Mon Sep 17 00:00:00 2001
From: Deploy <deploy@arcg.at>
Date: Thu, 2 Apr 2026 23:45:13 +0200
Subject: [PATCH] fix missing OpenWebRX active-session authorization helper

---
 server/index.js | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/server/index.js b/server/index.js
index af92d18..31f4f23 100644
--- a/server/index.js
+++ b/server/index.js
@@ -5437,6 +5437,20 @@ async function requireOpenWebRxTicketUser(req, res, url) {
   }
 }
 
+function canAuthorizeOpenWebRxByActiveSession() {
+  if (!runtime.station || !runtime.station.isInUse || !runtime.station.activeByUserId) {
+    return false;
+  }
+  if (!isOpenWebRxSessionActive()) {
+    return false;
+  }
+  const sessionOwner = String(runtime.openWebRxSession && runtime.openWebRxSession.activeOwnerUserId
+    ? runtime.openWebRxSession.activeOwnerUserId
+    : "");
+  const stationOwner = String(runtime.station.activeByUserId || "");
+  return Boolean(sessionOwner && stationOwner && sessionOwner === stationOwner);
+}
+
 async function resolveOpenWebRxTicketAccess(req, url) {
   if (canAuthorizeOpenWebRxByActiveSession()) {
     const activeUser = runtime.users.find((entry) => String(entry.id) === String(runtime.station.activeByUserId || ""));