From 4118a86c0db70c9b48b5bedc28dbb3864fea22d3 Mon Sep 17 00:00:00 2001
From: Benny Joo <sldisek783@gmail.com>
Date: Tue, 30 Sep 2025 09:30:12 -0400
Subject: [PATCH] refactor: do a permission check in removeHostsFromEventTypes
 trpc handler (#24176)

---
 .../removeHostsFromEventTypes.handler.ts      | 20 ++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/packages/trpc/server/routers/viewer/organizations/removeHostsFromEventTypes.handler.ts b/packages/trpc/server/routers/viewer/organizations/removeHostsFromEventTypes.handler.ts
index 15df1afda2..995883a1b9 100644
--- a/packages/trpc/server/routers/viewer/organizations/removeHostsFromEventTypes.handler.ts
+++ b/packages/trpc/server/routers/viewer/organizations/removeHostsFromEventTypes.handler.ts
@@ -1,5 +1,6 @@
-import { isOrganisationAdmin } from "@calcom/lib/server/queries/organisations";
+import { PermissionCheckService } from "@calcom/features/pbac/services/permission-check.service";
 import prisma from "@calcom/prisma";
+import { MembershipRole } from "@calcom/prisma/enums";
 
 import { TRPCError } from "@trpc/server";
 
@@ -16,8 +17,21 @@ type RemoveHostsFromEventTypes = {
 export async function removeHostsFromEventTypesHandler({ ctx, input }: RemoveHostsFromEventTypes) {
   if (!ctx.user.organizationId) throw new TRPCError({ code: "UNAUTHORIZED" });
 
-  if (!(await isOrganisationAdmin(ctx.user?.id, ctx.user.organizationId)))
-    throw new TRPCError({ code: "UNAUTHORIZED" });
+  // Check if user has permission to manage event types in the organization
+  const permissionCheckService = new PermissionCheckService();
+  const hasPermission = await permissionCheckService.checkPermission({
+    userId: ctx.user.id,
+    teamId: ctx.user.organizationId,
+    permission: "eventType.update",
+    fallbackRoles: [MembershipRole.OWNER, MembershipRole.ADMIN],
+  });
+
+  if (!hasPermission) {
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "You are not authorized to manage event types in this organization",
+    });
+  }
 
   const { userIds, eventTypeIds } = input;