Require user to be able to view organization to get it

This commit is contained in:
David Corbitt
2023-08-08 11:40:58 -07:00
parent b9396e63cc
commit ae7acbfdd4

View File

@@ -7,6 +7,7 @@ import { prisma } from "~/server/db";
import { generateApiKey } from "~/server/utils/generateApiKey"; import { generateApiKey } from "~/server/utils/generateApiKey";
import { import {
requireCanModifyOrganization, requireCanModifyOrganization,
requireCanViewOrganization,
requireIsOrgAdmin, requireIsOrgAdmin,
requireNothing, requireNothing,
} from "~/utils/accessControl"; } from "~/utils/accessControl";
@@ -61,7 +62,7 @@ export const organizationsRouter = createTRPCRouter({
return organizations; return organizations;
}), }),
get: protectedProcedure.input(z.object({ id: z.string() })).query(async ({ input, ctx }) => { get: protectedProcedure.input(z.object({ id: z.string() })).query(async ({ input, ctx }) => {
requireNothing(ctx); await requireCanViewOrganization(input.id, ctx);
const [org, userRole] = await prisma.$transaction([ const [org, userRole] = await prisma.$transaction([
prisma.organization.findUnique({ prisma.organization.findUnique({
where: { where: {