only allow to add steps of user's workflow (#4637)

Co-authored-by: CarinaWolli <wollencarina@gmail.com>

apps/web/public/static/locales/de/common.json

@@ -465,7 +465,7 @@
   "host_phone_number": "Ihre Telefonnummer",
   "enter_phone_number": "Telefonnummer eingeben",
   "reschedule": "Neuplanen",
-  "reschedule_this": "Stattdessen verschie",
+  "reschedule_this": "Stattdessen verschieben",
   "book_a_team_member": "Teammitglied stattdessen buchen",
   "or": "ODER",
   "go_back": "Zurück",

packages/trpc/server/routers/viewer/workflows.tsx

@@ -616,9 +616,11 @@ export const workflowsRouter = createProtectedRouter()
       //added steps
       const addedSteps = steps.map((s) => {
         if (s.id <= 0) {
-          const { id, ...stepToAdd } = s;
-          if (stepToAdd) {
+          const { id: stepId, ...stepToAdd } = s;
+          if (stepToAdd.workflowId === id) {
             return stepToAdd;
+          } else {
+            throw new TRPCError({ code: "UNAUTHORIZED" });
           }
         }
       });