maronato/cal
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add check for parentId (#13078)

This commit is contained in:
Riddhesh Mahajan 2024-01-09 16:46:44 +05:30 committed by GitHub
parent 7dc7f949cf
commit 6dbf372ab0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
apps/api/pages/api/teams/[teamId]/_patch.ts
View File

@ -64,6 +64,25 @@ export async function patchHandler(req: NextApiRequest) {
where: { id: teamId, members: { some: { userId, role: { in: ["OWNER", "ADMIN"] } } } },
});
if (!_team) throw new HttpError({ statusCode: 401, message: "Unauthorized: OWNER or ADMIN required" });
// Check if parentId is related to this user
if (data.parentId && data.parentId === teamId) {
throw new HttpError({
statusCode: 400,
message: "Bad request: Parent id cannot be the same as the team id.",
});
}
if (data.parentId) {
const parentTeam = await prisma.team.findFirst({
where: { id: data.parentId, members: { some: { userId, role: { in: ["OWNER", "ADMIN"] } } } },
});
if (!parentTeam)
throw new HttpError({
statusCode: 401,
message: "Unauthorized: Invalid parent id. You can only use parent id of your own teams.",
});
}
let paymentUrl;
if (_team.slug === null && data.slug) {
data.metadata = {

12
apps/api/pages/api/teams/_post.ts
View File

@ -68,6 +68,18 @@ async function postHandler(req: NextApiRequest) {
}
}
// Check if parentId is related to this user
if (data.parentId) {
const parentTeam = await prisma.team.findFirst({
where: { id: data.parentId, members: { some: { userId, role: { in: ["OWNER", "ADMIN"] } } } },
});
if (!parentTeam)
throw new HttpError({
statusCode: 401,
message: "Unauthorized: Invalid parent id. You can only use parent id of your own teams.",
});
}
// TODO: Perhaps there is a better fix for this?
const cloneData: typeof data & {
metadata: NonNullable<typeof data.metadata> | undefined;