From 4ac6225a3579f14fed5595b8063f319eed8a3166 Mon Sep 17 00:00:00 2001 From: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com> Date: Fri, 1 Sep 2023 19:32:58 +0530 Subject: [PATCH] fix: unauthorized error in organization (#11039) * fix: unauthorized error in organization Signed-off-by: Udit Takkar * chore Signed-off-by: Udit Takkar * fix: allow instance admin to update Signed-off-by: Udit Takkar --------- Signed-off-by: Udit Takkar --- packages/features/auth/lib/next-auth-options.ts | 2 +- .../routers/viewer/organizations/update.handler.ts | 9 +++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/packages/features/auth/lib/next-auth-options.ts b/packages/features/auth/lib/next-auth-options.ts index 7fd3ffbcaf..3c7ab80d80 100644 --- a/packages/features/auth/lib/next-auth-options.ts +++ b/packages/features/auth/lib/next-auth-options.ts @@ -387,7 +387,7 @@ export const AUTH_OPTIONS: AuthOptions = { if (trigger === "update") { return { ...token, - locale: session?.locale ?? token.locale, + locale: session?.locale ?? token.locale ?? "en", name: session?.name ?? token.name, username: session?.username ?? token.username, email: session?.email ?? token.email, diff --git a/packages/trpc/server/routers/viewer/organizations/update.handler.ts b/packages/trpc/server/routers/viewer/organizations/update.handler.ts index ec8d1fad92..85cf437a47 100644 --- a/packages/trpc/server/routers/viewer/organizations/update.handler.ts +++ b/packages/trpc/server/routers/viewer/organizations/update.handler.ts @@ -24,11 +24,12 @@ export const updateHandler = async ({ ctx, input }: UpdateOptions) => { // A user can only have one org so we pass in their currentOrgId here const currentOrgId = ctx.user?.organization?.id || input.orgId; - if (!currentOrgId || ctx.user.role !== UserPermissionRole.ADMIN) - throw new TRPCError({ code: "UNAUTHORIZED" }); + const isUserOrganizationAdmin = currentOrgId && (await isOrganisationAdmin(ctx.user?.id, currentOrgId)); + const isUserRoleAdmin = ctx.user.role === UserPermissionRole.ADMIN; - if (!(await isOrganisationAdmin(ctx.user?.id, currentOrgId)) || ctx.user.role !== UserPermissionRole.ADMIN) - throw new TRPCError({ code: "UNAUTHORIZED" }); + const isUserAuthorizedToUpdate = !!(isUserOrganizationAdmin || isUserRoleAdmin); + + if (!currentOrgId || !isUserAuthorizedToUpdate) throw new TRPCError({ code: "UNAUTHORIZED" }); if (input.slug) { const userConflict = await prisma.team.findMany({