fix: Allows team owners and team admins to query team availability (#9245)

* allows team owners and team admins to query team availability

* code imp

* add type for memberRoles

* further type adjustments

* \_(o.o)_/

* type

* type..

apps/api/pages/api/availability/_get.ts

@@ -5,6 +5,7 @@ import { getUserAvailability } from "@calcom/core/getUserAvailability";
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server";
 import { availabilityUserSelect } from "@calcom/prisma";
+import { MembershipRole } from "@calcom/prisma/enums";
 import { stringOrNumber } from "@calcom/prisma/zod-utils";
 
 /**
@@ -97,6 +98,9 @@ import { stringOrNumber } from "@calcom/prisma/zod-utils";
  *       404:
  *         description: User not found | Team not found | Team has no members
  */
+interface MemberRoles {
+  [userId: number | string]: MembershipRole;
+}
 
 const availabilitySchema = z
   .object({
@@ -113,7 +117,7 @@ const availabilitySchema = z
   );
 
 async function handler(req: NextApiRequest) {
-  const { prisma, isAdmin } = req;
+  const { prisma, isAdmin, userId: reqUserId } = req;
   const { username, userId, eventTypeId, dateTo, dateFrom, teamId } = availabilitySchema.parse(req.query);
   if (!teamId)
     return getUserAvailability({
@@ -134,7 +138,16 @@ async function handler(req: NextApiRequest) {
     where: { id: { in: allMemberIds } },
     select: availabilityUserSelect,
   });
-  if (!isAdmin) throw new HttpError({ statusCode: 403, message: "Forbidden" });
+  const memberRoles: MemberRoles = team.members.reduce((acc: MemberRoles, membership) => {
+    acc[membership.userId] = membership.role;
+    return acc;
+  }, {} as MemberRoles);
+  // check if the user is a team Admin or Owner, if it is a team request, or a system Admin
+  const isUserAdminOrOwner =
+    memberRoles[reqUserId] == MembershipRole.ADMIN ||
+    memberRoles[reqUserId] == MembershipRole.OWNER ||
+    isAdmin;
+  if (!isUserAdminOrOwner) throw new HttpError({ statusCode: 403, message: "Forbidden" });
   const availabilities = members.map(async (user) => {
     return {
       userId: user.id,