Fixes permission errors

pages/api/attendees/[id]/_auth-middleware.ts

@@ -14,7 +14,7 @@ async function authMiddleware(req: NextApiRequest) {
     where: { id: query.id, booking: { userId } },
   });
   // Flatten and merge all the attendees in one array
-  if (!attendee) throw new HttpError({ statusCode: 401, message: "Unauthorized" });
+  if (!attendee) throw new HttpError({ statusCode: 403, message: "Forbidden" });
 }
 
 export default authMiddleware;

pages/api/attendees/_post.ts

@@ -56,7 +56,7 @@ async function postHandler(req: NextApiRequest) {
       select: { id: true },
     });
     // Here we make sure to only return attendee's of the user's own bookings.
-    if (!userBooking) throw new HttpError({ statusCode: 401, message: "Unauthorized" });
+    if (!userBooking) throw new HttpError({ statusCode: 403, message: "Forbidden" });
   }
 
   const data = await prisma.attendee.create({

pages/api/availability/_get.ts

@@ -43,7 +43,7 @@ async function handler(req: NextApiRequest) {
     where: { id: { in: allMemberIds } },
     select: availabilityUserSelect,
   });
-  if (!isAdmin) throw new HttpError({ statusCode: 401, message: "Unauthorized" });
+  if (!isAdmin) throw new HttpError({ statusCode: 403, message: "Forbidden" });
   const availabilities = members.map(async (user) => {
     return {
       userId: user.id,

pages/api/booking-references/[id]/_auth-middleware.ts

@@ -13,7 +13,7 @@ async function authMiddleware(req: NextApiRequest) {
   const bookingReference = await prisma.bookingReference.findFirst({
     where: { id, booking: { userId } },
   });
-  if (!bookingReference) throw new HttpError({ statusCode: 401, message: "Unauthorized" });
+  if (!bookingReference) throw new HttpError({ statusCode: 403, message: "Forbidden" });
 }
 
 export default authMiddleware;

pages/api/custom-inputs/[id]/_auth-middleware.ts

@@ -13,7 +13,7 @@ async function authMiddleware(req: NextApiRequest) {
   const eventTypeCustomInput = await prisma.eventTypeCustomInput.findFirst({
     where: { id, eventType: { userId } },
   });
-  if (!eventTypeCustomInput) throw new HttpError({ statusCode: 401, message: "Unauthorized" });
+  if (!eventTypeCustomInput) throw new HttpError({ statusCode: 403, message: "Forbidden" });
 }
 
 export default authMiddleware;

pages/api/custom-inputs/_post.ts

@@ -32,7 +32,7 @@ async function postHandler(req: NextApiRequest) {
     const eventType = await prisma.eventType.findFirst({
       where: { id: eventTypeId, userId },
     });
-    if (!eventType) throw new HttpError({ statusCode: 401, message: "Unauthorized" });
+    if (!eventType) throw new HttpError({ statusCode: 403, message: "Forbidden" });
   }
 
   const data = await prisma.eventTypeCustomInput.create({

pages/api/event-types/[id]/_auth-middleware.ts

@@ -11,7 +11,7 @@ async function authMiddleware(req: NextApiRequest) {
   const eventType = await prisma.eventType.findFirst({
     where: { id, users: { some: { id: userId } } },
   });
-  if (!eventType) throw new HttpError({ statusCode: 401, message: "Unauthorized" });
+  if (!eventType) throw new HttpError({ statusCode: 403, message: "Forbidden" });
 }
 
 export default authMiddleware;

pages/api/event-types/[id]/_delete.ts

@@ -46,7 +46,7 @@ async function checkPermissions(req: NextApiRequest) {
   if (isAdmin) return;
   /** Only event type owners can delete it */
   const eventType = await prisma.eventType.findFirst({ where: { id, userId } });
-  if (!eventType) throw new HttpError({ statusCode: 401, message: "Unauthorized" });
+  if (!eventType) throw new HttpError({ statusCode: 403, message: "Forbidden" });
 }
 
 export default defaultResponder(deleteHandler);

pages/api/event-types/[id]/_patch.ts

@@ -48,7 +48,7 @@ async function checkPermissions(req: NextApiRequest) {
   if (isAdmin) return;
   /** Only event type owners can modify it */
   const eventType = await prisma.eventType.findFirst({ where: { id, userId } });
-  if (!eventType) throw new HttpError({ statusCode: 401, message: "Unauthorized" });
+  if (!eventType) throw new HttpError({ statusCode: 403, message: "Forbidden" });
 }
 
 export default defaultResponder(patchHandler);

pages/api/schedules/[id]/_auth-middleware.ts

@@ -13,7 +13,7 @@ async function authMiddleware(req: NextApiRequest) {
   const schedule = await prisma.schedule.findFirst({
     where: { id, userId },
   });
-  if (!schedule) throw new HttpError({ statusCode: 401, message: "Unauthorized" });
+  if (!schedule) throw new HttpError({ statusCode: 403, message: "Forbidden" });
 }
 
 export default authMiddleware;

pages/api/users/[userId]/_delete.ts

@@ -34,7 +34,7 @@ export async function deleteHandler(req: NextApiRequest) {
   const query = schemaQueryUserId.parse(req.query);
   // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user
   if (!isAdmin && query.userId !== req.userId)
-    throw new HttpError({ statusCode: 401, message: "Unauthorized" });
+    throw new HttpError({ statusCode: 403, message: "Forbidden" });
 
   const user = await prisma.user.findUnique({ where: { id: query.userId } });
   if (!user) throw new HttpError({ statusCode: 404, message: "User not found" });

pages/api/users/[userId]/_get.ts

@@ -36,7 +36,7 @@ export async function getHandler(req: NextApiRequest) {
   const query = schemaQueryUserId.parse(req.query);
   // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user
   if (!isAdmin && query.userId !== req.userId)
-    throw new HttpError({ statusCode: 401, message: "Unauthorized" });
+    throw new HttpError({ statusCode: 403, message: "Forbidden" });
   const data = await prisma.user.findUnique({ where: { id: query.userId } });
   const user = schemaUserReadPublic.parse(data);
   return { user };

pages/api/users/[userId]/_patch.ts

@@ -56,7 +56,7 @@ export async function patchHandler(req: NextApiRequest) {
   const query = schemaQueryUserId.parse(req.query);
   // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user
   if (!isAdmin && query.userId !== req.userId)
-    throw new HttpError({ statusCode: 401, message: "Unauthorized" });
+    throw new HttpError({ statusCode: 403, message: "Forbidden" });
 
   const body = schemaUserEditBodyParams.parse(req.body);
   const userSchedules = await prisma.schedule.findMany({