diff --git a/apps/api/v1/pages/api/teams/_post.ts b/apps/api/v1/pages/api/teams/_post.ts index 32722a4602..4ecc3d3290 100644 --- a/apps/api/v1/pages/api/teams/_post.ts +++ b/apps/api/v1/pages/api/teams/_post.ts @@ -69,6 +69,9 @@ import { schemaTeamCreateBodyParams, schemaTeamReadPublic } from "~/lib/validati * ownerId: * type: number * description: ID of the team owner - only admins can set this. + * parentId: + * type: number + * description: ID of the parent organization. * tags: * - teams * responses: @@ -99,7 +102,7 @@ async function postHandler(req: NextApiRequest) { if (alreadyExist) throw new HttpError({ statusCode: 409, message: "Team slug already exists" }); } - // Check if parentId is related to this user + // Check if parentId is related to this user and is an organization if (data.parentId) { const parentTeam = await prisma.team.findFirst({ where: { id: data.parentId, members: { some: { userId, role: { in: ["OWNER", "ADMIN"] } } } }, @@ -107,7 +110,13 @@ async function postHandler(req: NextApiRequest) { if (!parentTeam) throw new HttpError({ statusCode: 401, - message: "Unauthorized: Invalid parent id. You can only use parent id of your own teams.", + message: "Unauthorized: Invalid parent id. You can only use parent id if you are org owner or admin.", + }); + + if (parentTeam.parentId) + throw new HttpError({ + statusCode: 400, + message: "parentId must be of an organization, not a team.", }); } @@ -119,7 +128,7 @@ async function postHandler(req: NextApiRequest) { metadata: data.metadata === null ? {} : data.metadata || undefined, }; - if (!IS_TEAM_BILLING_ENABLED) { + if (!IS_TEAM_BILLING_ENABLED || data.parentId) { const team = await prisma.team.create({ data: { ...cloneData, @@ -135,7 +144,7 @@ async function postHandler(req: NextApiRequest) { return { team: schemaTeamReadPublic.parse(team), owner: schemaMembershipPublic.parse(team.members[0]), - message: `Team created successfully. We also made user with ID=${ownerId} the owner of this team.`, + message: `Team created successfully. We also made user with ID=${effectiveUserId} the owner of this team.`, }; }