From ca03be7f43b41c52c9195fab8c23735c2ed35b4d Mon Sep 17 00:00:00 2001
From: Huskydog9988 <39809509+Huskydog9988@users.noreply.github.com>
Date: Thu, 10 Apr 2025 19:50:04 -0400
Subject: [PATCH] fix: don't add write perms, users can only delete objects

---
 server/api/v1/auth/signup/simple.post.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/api/v1/auth/signup/simple.post.ts b/server/api/v1/auth/signup/simple.post.ts
index 25a9ebd..1d909f3 100644
--- a/server/api/v1/auth/signup/simple.post.ts
+++ b/server/api/v1/auth/signup/simple.post.ts
@@ -64,7 +64,7 @@ export default defineEventHandler(async (h3) => {
     profilePictureId,
     async () => jdenticon.toPng(user.username, 256),
     {},
-    [`internal:read`, `${userId}:write`]
+    [`internal:read`, `${userId}:delete`]
   );
   const [linkMec] = await prisma.$transaction([
     prisma.linkedAuthMec.create({