check that input teamId equals webhook team (#9434)

Co-authored-by: CarinaWolli <wollencarina@gmail.com>
2023-06-09 11:18:59 +00:00
parent 7a71a5ddd4
commit 91962cc90b
1 changed files with 12 additions and 0 deletions
@@ -45,6 +45,18 @@ export const webhookProcedure = authedProcedure
      });

      if (webhook) {
+        if (teamId && teamId !== webhook.teamId) {
+          throw new TRPCError({
+            code: "UNAUTHORIZED",
+          });
+        }
+
+        if (eventTypeId && eventTypeId !== webhook.eventTypeId) {
+          throw new TRPCError({
+            code: "UNAUTHORIZED",
+          });
+        }
+
        if (webhook.teamId) {
          const user = await prisma.user.findFirst({
            where: {