diff --git a/apps/api/pages/api/event-types/_post.ts b/apps/api/pages/api/event-types/_post.ts index 20b138f158..6e748a1bc2 100644 --- a/apps/api/pages/api/event-types/_post.ts +++ b/apps/api/pages/api/event-types/_post.ts @@ -3,8 +3,10 @@ import type { NextApiRequest } from "next"; import { HttpError } from "@calcom/lib/http-error"; import { defaultResponder } from "@calcom/lib/server"; +import { MembershipRole } from "@calcom/prisma/client"; import { schemaEventTypeCreateBodyParams, schemaEventTypeReadPublic } from "~/lib/validations/event-type"; +import { canUserAccessTeamWithRole } from "~/pages/api/teams/[teamId]/_auth-middleware"; import checkParentEventOwnership from "./_utils/checkParentEventOwnership"; import checkTeamEventEditPermission from "./_utils/checkTeamEventEditPermission"; @@ -316,7 +318,13 @@ async function checkPermissions(req: NextApiRequest) { statusCode: 401, message: "ADMIN required for `userId`", }); - if (!isAdmin && body.teamId) + if ( + body.teamId && + !isAdmin && + !(await canUserAccessTeamWithRole(req.prisma, req.userId, isAdmin, body.teamId, { + in: [MembershipRole.OWNER, MembershipRole.ADMIN], + })) + ) throw new HttpError({ statusCode: 401, message: "ADMIN required for `teamId`", diff --git a/apps/api/pages/api/teams/[teamId]/_auth-middleware.ts b/apps/api/pages/api/teams/[teamId]/_auth-middleware.ts index 48ade69952..ec172679c2 100644 --- a/apps/api/pages/api/teams/[teamId]/_auth-middleware.ts +++ b/apps/api/pages/api/teams/[teamId]/_auth-middleware.ts @@ -27,6 +27,16 @@ export async function checkPermissions( version: req.query.version, apiKey: req.query.apiKey, }); + return canUserAccessTeamWithRole(prisma, userId, isAdmin, teamId, role); +} + +export async function canUserAccessTeamWithRole( + prisma: NextApiRequest["prisma"], + userId: number, + isAdmin: boolean, + teamId: number, + role: Prisma.MembershipWhereInput["role"] = MembershipRole.OWNER +) { const args: Prisma.TeamFindFirstArgs = { where: { id: teamId } }; /** If not ADMIN then we check if the actual user belongs to team and matches the required role */ if (!isAdmin) args.where = { ...args.where, members: { some: { userId, role } } };