From ce01537fe6507aad6ef51d421c6e3b45ee8ec663 Mon Sep 17 00:00:00 2001
From: sean-brydon <55134778+sean-brydon@users.noreply.github.com>
Date: Fri, 17 Feb 2023 11:15:42 +0000
Subject: [PATCH] Fix errors (#7134)

---
 .../ee/impersonation/lib/ImpersonationProvider.ts        | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/packages/features/ee/impersonation/lib/ImpersonationProvider.ts b/packages/features/ee/impersonation/lib/ImpersonationProvider.ts
index 407ad41311..f06ee2bf9a 100644
--- a/packages/features/ee/impersonation/lib/ImpersonationProvider.ts
+++ b/packages/features/ee/impersonation/lib/ImpersonationProvider.ts
@@ -91,6 +91,7 @@ const ImpersonationProvider = CredentialsProvider({
           select: {
             teamId: true,
             disableImpersonation: true,
+            role: true,
           },
         },
       },
@@ -135,6 +136,9 @@ const ImpersonationProvider = CredentialsProvider({
               },
             ],
           },
+          select: {
+            role: true,
+          },
         },
       },
     });
@@ -143,6 +147,11 @@ const ImpersonationProvider = CredentialsProvider({
       throw new Error("You do not have permission to do this.");
     }
 
+    // We find team by ID so we know there is only one team in the array
+    if (sessionUserFromDb?.teams[0].role === "ADMIN" && impersonatedUser.teams[0].role === "OWNER") {
+      throw new Error("You do not have permission to do this.");
+    }
+
     return auditAndReturnNextUser(
       impersonatedUser,
       session?.user.id as number,