Files
9ea71d2ba5 refactor: migrate MembershipRole usages to PBAC permission checks (#26871)
* refactor: migrate MembershipRole usages to PBAC permission checks

- Refactor get.handler.ts to use PermissionCheckService for canUpdateTeams
- Refactor checkForInvalidAppCredentials.ts to use getTeamIdsWithPermission
- Refactor outOfOffice.utils.ts to use checkPermission for ooo.update
- Refactor checkIfOrgNeedsUpgrade.handler.ts to use organization.manageBilling
- Refactor getActiveOnOptions.handler.ts to use eventType.update permission
- Refactor WorkflowRepository.ts to use workflow.update permission
- Refactor organization.tsx to use team.update permission
- Refactor getEventTypesByViewer.ts to use eventType.update permission
- Refactor getPublicEvent.ts to use team.read permission for private teams
- Update CreateNewOutOfOfficeEntryButton.tsx to use canUpdateOOO prop

Co-Authored-By: sean@cal.com <Sean@brydon.io>

* fix: use organization.update permission instead of team.update for org management

Co-Authored-By: sean@cal.com <Sean@brydon.io>

* fix: rename teamsWithEventTypeManagePermission to teamsWithEventTypeUpdatePermission

Renamed variable to match the permission string being used (eventType.update)

Co-Authored-By: sean@cal.com <Sean@brydon.io>

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-15 15:59:00 +01:00

53 lines
1.6 KiB
TypeScript

import { PermissionCheckService } from "@calcom/features/pbac/services/permission-check.service";
import { IS_TEAM_BILLING_ENABLED } from "@calcom/lib/constants";
import { prisma } from "@calcom/prisma";
import { MembershipRole } from "@calcom/prisma/enums";
import { teamMetadataSchema } from "@calcom/prisma/zod-utils";
import type { TrpcSessionUser } from "../../../types";
type GetUpgradeableOptions = {
ctx: {
user: NonNullable<TrpcSessionUser>;
};
};
export async function checkIfOrgNeedsUpgradeHandler({ ctx }: GetUpgradeableOptions) {
if (!IS_TEAM_BILLING_ENABLED) return [];
const permissionCheckService = new PermissionCheckService();
const teamIdsWithBillingPermission = await permissionCheckService.getTeamIdsWithPermission({
userId: ctx.user.id,
permission: "organization.manageBilling",
fallbackRoles: [MembershipRole.OWNER],
});
if (teamIdsWithBillingPermission.length === 0) return [];
let teams = await prisma.membership.findMany({
where: {
userId: ctx.user.id,
teamId: { in: teamIdsWithBillingPermission },
team: {
isPlatform: false,
parentId: null,
},
},
include: {
team: true,
},
});
/** We only need to return teams that don't have a `subscriptionId` on their metadata */
teams = teams.filter((m) => {
const metadata = teamMetadataSchema.safeParse(m.team.metadata);
if (!m.team.isOrganization) return false;
if (metadata.success && metadata.data?.subscriptionId) return false;
return true;
});
return teams;
}
export default checkIfOrgNeedsUpgradeHandler;