From 9c9d7fe0c394c17879aba3a8bead39eda17a967b Mon Sep 17 00:00:00 2001
From: Kartik Saini <41051387+kart1ka@users.noreply.github.com>
Date: Tue, 10 Dec 2024 05:09:56 +0530
Subject: [PATCH] fix: can't edit ooo (#18020)

* fix: can't edit ooo

* fix: unauthorized users can edit ooo
---
 apps/web/public/static/locales/en/common.json              | 1 +
 .../server/routers/loggedInViewer/outOfOffice.handler.ts   | 7 ++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/apps/web/public/static/locales/en/common.json b/apps/web/public/static/locales/en/common.json
index fe250db493..7330fb2f5d 100644
--- a/apps/web/public/static/locales/en/common.json
+++ b/apps/web/public/static/locales/en/common.json
@@ -2453,6 +2453,7 @@
   "start_date_must_be_before_end_date": "Start date must be before end date",
   "start_date_must_be_in_the_future": "Start date must be in the future",
   "user_not_found": "User not found",
+  "cannot_redirect_to_self": "Cannot redirect to self",
   "out_of_office_entry_already_exists": "Out of office entry already exists",
   "out_of_office_id_required": "Out of office entry id required",
   "booking_redirect_infinite_not_allowed": "There is already a booking redirect from that user to you.",
diff --git a/packages/trpc/server/routers/loggedInViewer/outOfOffice.handler.ts b/packages/trpc/server/routers/loggedInViewer/outOfOffice.handler.ts
index c24f9a1dbd..ecd80a9954 100644
--- a/packages/trpc/server/routers/loggedInViewer/outOfOffice.handler.ts
+++ b/packages/trpc/server/routers/loggedInViewer/outOfOffice.handler.ts
@@ -40,6 +40,10 @@ export const outOfOfficeCreateOrUpdate = async ({ ctx, input }: TBookingRedirect
 
   let toUserId: number | null = null;
 
+  if (input.toTeamUserId === ctx.user.id) {
+    throw new TRPCError({ code: "BAD_REQUEST", message: "cannot_redirect_to_self" });
+  }
+
   if (input.toTeamUserId) {
     const user = await prisma.user.findUnique({
       where: {
@@ -108,7 +112,7 @@ export const outOfOfficeCreateOrUpdate = async ({ ctx, input }: TBookingRedirect
     },
   });
 
-  if (isDuplicateOutOfOfficeEntry) {
+  if (isDuplicateOutOfOfficeEntry && isDuplicateOutOfOfficeEntry?.uuid !== input.uuid) {
     throw new TRPCError({ code: "CONFLICT", message: "out_of_office_entry_already_exists" });
   }
 
@@ -132,6 +136,7 @@ export const outOfOfficeCreateOrUpdate = async ({ ctx, input }: TBookingRedirect
   const createdOrUpdatedOutOfOffice = await prisma.outOfOfficeEntry.upsert({
     where: {
       uuid: input.uuid ?? "",
+      userId: ctx.user.id,
     },
     create: {
       uuid: uuidv4(),