From f9dcbaaa42b24b0044ab266d635d5db818e59235 Mon Sep 17 00:00:00 2001
From: Matt Nicolls <2540582+nicolls1@users.noreply.github.com>
Date: Thu, 14 Dec 2023 13:14:12 +0100
Subject: [PATCH] fix: create event type for a team that you are an owner or
 admin of (#12564)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: allow API access to creating a team that you are a member of

* update roles allowed to create event types

* add back comment

* revert yarn.lock

---------

Co-authored-by: Omar López <zomars@me.com>
Co-authored-by: Peer Richelsen <peeroke@gmail.com>
---
 apps/api/pages/api/event-types/_post.ts               | 10 +++++++++-
 apps/api/pages/api/teams/[teamId]/_auth-middleware.ts | 10 ++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/apps/api/pages/api/event-types/_post.ts b/apps/api/pages/api/event-types/_post.ts
index 20b138f158..6e748a1bc2 100644
--- a/apps/api/pages/api/event-types/_post.ts
+++ b/apps/api/pages/api/event-types/_post.ts
@@ -3,8 +3,10 @@ import type { NextApiRequest } from "next";
 
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
+import { MembershipRole } from "@calcom/prisma/client";
 
 import { schemaEventTypeCreateBodyParams, schemaEventTypeReadPublic } from "~/lib/validations/event-type";
+import { canUserAccessTeamWithRole } from "~/pages/api/teams/[teamId]/_auth-middleware";
 
 import checkParentEventOwnership from "./_utils/checkParentEventOwnership";
 import checkTeamEventEditPermission from "./_utils/checkTeamEventEditPermission";
@@ -316,7 +318,13 @@ async function checkPermissions(req: NextApiRequest) {
       statusCode: 401,
       message: "ADMIN required for `userId`",
     });
-  if (!isAdmin && body.teamId)
+  if (
+    body.teamId &&
+    !isAdmin &&
+    !(await canUserAccessTeamWithRole(req.prisma, req.userId, isAdmin, body.teamId, {
+      in: [MembershipRole.OWNER, MembershipRole.ADMIN],
+    }))
+  )
     throw new HttpError({
       statusCode: 401,
       message: "ADMIN required for `teamId`",
diff --git a/apps/api/pages/api/teams/[teamId]/_auth-middleware.ts b/apps/api/pages/api/teams/[teamId]/_auth-middleware.ts
index 48ade69952..ec172679c2 100644
--- a/apps/api/pages/api/teams/[teamId]/_auth-middleware.ts
+++ b/apps/api/pages/api/teams/[teamId]/_auth-middleware.ts
@@ -27,6 +27,16 @@ export async function checkPermissions(
     version: req.query.version,
     apiKey: req.query.apiKey,
   });
+  return canUserAccessTeamWithRole(prisma, userId, isAdmin, teamId, role);
+}
+
+export async function canUserAccessTeamWithRole(
+  prisma: NextApiRequest["prisma"],
+  userId: number,
+  isAdmin: boolean,
+  teamId: number,
+  role: Prisma.MembershipWhereInput["role"] = MembershipRole.OWNER
+) {
   const args: Prisma.TeamFindFirstArgs = { where: { id: teamId } };
   /** If not ADMIN then we check if the actual user belongs to team and matches the required role */
   if (!isAdmin) args.where = { ...args.where, members: { some: { userId, role } } };