fix: team availability shows only to the member owning it (#10738)

Co-authored-by: SMLukwiya <sundaymorganl@gmail.com>

apps/web/components/eventtype/EventAvailabilityTab.tsx

@@ -138,7 +138,7 @@ const EventTypeScheduleDetails = memo(
             <Globe className="h-3.5 w-3.5 ltr:mr-2 rtl:ml-2" />
             {schedule?.timeZone || <SkeletonText className="block h-5 w-32" />}
           </span>
-          {!!schedule?.id && !schedule.isManaged && (
+          {!!schedule?.id && !schedule.isManaged && !schedule.readOnly && (
             <Button
               href={`/availability/${schedule.id}`}
               disabled={isLoading}
@@ -202,6 +202,15 @@ const EventTypeSchedule = ({ eventType }: { eventType: EventTypeSetup }) => {
           isManaged: false,
         });
       }
+      // We push the selected schedule from the event type if it's not part of the list response. This happens if the user is an admin but not the schedule owner.
+      else if (eventType.schedule && !schedules.find((schedule) => schedule.id === eventType.schedule)) {
+        options.push({
+          value: eventType.schedule,
+          label: eventType.scheduleName ?? t("default_schedule_name"),
+          isDefault: false,
+          isManaged: false,
+        });
+      }
 
       setOptions(options);
 

packages/trpc/server/routers/viewer/availability/schedule/get.handler.ts

@@ -30,13 +30,31 @@ export const getHandler = async ({ ctx, input }: GetOptions) => {
       name: true,
       availability: true,
       timeZone: true,
+      eventType: {
+        select: {
+          _count: true,
+          id: true,
+          eventName: true,
+          team: {
+            select: { members: { select: { userId: true } } },
+          },
+        },
+      },
     },
   });
-  if (!schedule || (schedule.userId !== user.id && !input.isManagedEventType)) {
+
+  const isCurrentUserPartOfTeam = schedule?.eventType.some((eventType) =>
+    eventType.team?.members.some((teamMember) => teamMember.userId === user.id)
+  );
+
+  const isCurrentUserOwner = schedule?.userId === user.id;
+
+  if (!schedule || (!isCurrentUserOwner && !isCurrentUserPartOfTeam)) {
     throw new TRPCError({
       code: "UNAUTHORIZED",
     });
   }
+
   const timeZone = schedule.timeZone || user.timeZone;
 
   const schedulesCount = await prisma.schedule.count({
@@ -93,5 +111,6 @@ export const getHandler = async ({ ctx, input }: GetOptions) => {
     }, [] as { ranges: TimeRange[] }[]),
     isDefault: !input.scheduleId || user.defaultScheduleId === schedule.id,
     isLastSchedule: schedulesCount <= 1,
+    readOnly: schedule.userId !== user.id && !input.isManagedEventType,
   };
 };