From d3ddbf418fb98ebf86994374c93208ad88af8a03 Mon Sep 17 00:00:00 2001 From: Matt Nicolls <2540582+nicolls1@users.noreply.github.com> Date: Tue, 28 Nov 2023 07:14:59 +0100 Subject: [PATCH] fix: fetch event type with a team permissions (#12448) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Omar López --- apps/api/pages/api/event-types/[id]/_get.ts | 5 ++++- apps/api/pages/api/teams/[teamId]/_auth-middleware.ts | 6 +++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/apps/api/pages/api/event-types/[id]/_get.ts b/apps/api/pages/api/event-types/[id]/_get.ts index 105b271078..83119feb20 100644 --- a/apps/api/pages/api/event-types/[id]/_get.ts +++ b/apps/api/pages/api/event-types/[id]/_get.ts @@ -2,6 +2,7 @@ import type { NextApiRequest } from "next"; import { HttpError } from "@calcom/lib/http-error"; import { defaultResponder } from "@calcom/lib/server"; +import { MembershipRole } from "@calcom/prisma/enums"; import { schemaEventTypeReadPublic } from "~/lib/validations/event-type"; import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransformParseInt"; @@ -89,7 +90,9 @@ async function checkPermissions( if (req.isAdmin) return true; if (eventType?.teamId) { req.query.teamId = String(eventType.teamId); - await canAccessTeamEventOrThrow(req, "MEMBER"); + await canAccessTeamEventOrThrow(req, { + in: [MembershipRole.OWNER, MembershipRole.ADMIN, MembershipRole.MEMBER], + }); } if (eventType?.userId === req.userId) return true; // is owner. throw new HttpError({ statusCode: 403, message: "Forbidden" }); diff --git a/apps/api/pages/api/teams/[teamId]/_auth-middleware.ts b/apps/api/pages/api/teams/[teamId]/_auth-middleware.ts index bde11bb75c..48ade69952 100644 --- a/apps/api/pages/api/teams/[teamId]/_auth-middleware.ts +++ b/apps/api/pages/api/teams/[teamId]/_auth-middleware.ts @@ -22,7 +22,11 @@ export async function checkPermissions( role: Prisma.MembershipWhereInput["role"] = MembershipRole.OWNER ) { const { userId, prisma, isAdmin } = req; - const { teamId } = schemaQueryTeamId.parse(req.query); + const { teamId } = schemaQueryTeamId.parse({ + teamId: req.query.teamId, + version: req.query.version, + apiKey: req.query.apiKey, + }); const args: Prisma.TeamFindFirstArgs = { where: { id: teamId } }; /** If not ADMIN then we check if the actual user belongs to team and matches the required role */ if (!isAdmin) args.where = { ...args.where, members: { some: { userId, role } } };