From 06348982a3c4841df9208e42194e6f142170396a Mon Sep 17 00:00:00 2001
From: Rajiv Sahal <sahalrajiv-extc@atharvacoe.ac.in>
Date: Fri, 21 Nov 2025 18:44:51 +0000
Subject: [PATCH] fix: make sure only admins and owners are authorized for team
 (#25333)

---
 .../server/routers/viewer/eventTypes/util.ts  | 28 ++++++-------------
 1 file changed, 8 insertions(+), 20 deletions(-)

diff --git a/packages/trpc/server/routers/viewer/eventTypes/util.ts b/packages/trpc/server/routers/viewer/eventTypes/util.ts
index 13f5d6308c..2197323ec6 100644
--- a/packages/trpc/server/routers/viewer/eventTypes/util.ts
+++ b/packages/trpc/server/routers/viewer/eventTypes/util.ts
@@ -61,7 +61,10 @@ export const eventOwnerProcedure = authedProcedure
 
     const isAuthorized = (function () {
       if (event.team) {
-        return event.team.members.map((member) => member.userId).includes(ctx.user.id);
+        const teamMember = event.team.members.find((member) => member.userId === ctx.user.id);
+        const isOwnerOrAdmin = teamMember?.role === "ADMIN" || teamMember?.role === "OWNER";
+
+        return isOwnerOrAdmin;
       }
       return event.userId === ctx.user.id || event.users.find((user) => user.id === ctx.user.id);
     })();
@@ -297,29 +300,14 @@ export function ensureEmailOrPhoneNumberIsPresent(fields: TUpdateInputSchema["bo
   }
 }
 
-type Host = {
-  userId: number;
-  isFixed?: boolean | undefined;
-  priority?: number | null | undefined;
-  weight?: number | null | undefined;
-  scheduleId?: number | null | undefined;
-  groupId: string | null;
-};
-
-type User = {
-  id: number;
-  email: string;
-};
-
 export const mapEventType = async (eventType: EventType) => ({
   ...eventType,
   safeDescription: eventType?.description ? markdownToSafeHTML(eventType.description) : undefined,
   users: await Promise.all(
-    (eventType?.hosts?.length ? eventType?.hosts.map((host) => host.user) : eventType.users).map(
-      async (u) =>
-        await new UserRepository(prisma).enrichUserWithItsProfile({
-          user: u,
-        })
+    (eventType?.hosts?.length ? eventType.hosts.map((host) => host.user) : eventType.users).map(async (u) =>
+      new UserRepository(prisma).enrichUserWithItsProfile({
+        user: u,
+      })
     )
   ),
   metadata: eventType.metadata ? EventTypeMetaDataSchema.parse(eventType.metadata) : null,