diff --git a/pages/api/users/[userId]/_delete.ts b/pages/api/users/[userId]/_delete.ts index d03c569709..391e341244 100644 --- a/pages/api/users/[userId]/_delete.ts +++ b/pages/api/users/[userId]/_delete.ts @@ -3,7 +3,6 @@ import type { NextApiRequest } from "next"; import { HttpError } from "@calcom/lib/http-error"; import { defaultResponder } from "@calcom/lib/server"; -import { isAdminGuard } from "@lib/utils/isAdmin"; import { schemaQueryUserId } from "@lib/validations/shared/queryUserId"; /** @@ -31,9 +30,8 @@ import { schemaQueryUserId } from "@lib/validations/shared/queryUserId"; * description: Authorization information is missing or invalid. */ export async function deleteHandler(req: NextApiRequest) { - const { prisma } = req; + const { prisma, isAdmin } = req; const query = schemaQueryUserId.parse(req.query); - const isAdmin = await isAdminGuard(req); // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user if (!isAdmin && query.userId !== req.userId) throw new HttpError({ statusCode: 401, message: "Unauthorized" }); diff --git a/pages/api/users/[userId]/_get.ts b/pages/api/users/[userId]/_get.ts index 36320e1636..e379c5fbf1 100644 --- a/pages/api/users/[userId]/_get.ts +++ b/pages/api/users/[userId]/_get.ts @@ -3,7 +3,6 @@ import type { NextApiRequest } from "next"; import { HttpError } from "@calcom/lib/http-error"; import { defaultResponder } from "@calcom/lib/server"; -import { isAdminGuard } from "@lib/utils/isAdmin"; import { schemaQueryUserId } from "@lib/validations/shared/queryUserId"; import { schemaUserReadPublic } from "@lib/validations/user"; @@ -32,10 +31,9 @@ import { schemaUserReadPublic } from "@lib/validations/user"; * description: User was not found */ export async function getHandler(req: NextApiRequest) { - const { prisma } = req; + const { prisma, isAdmin } = req; const query = schemaQueryUserId.parse(req.query); - const isAdmin = await isAdminGuard(req); // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user if (!isAdmin && query.userId !== req.userId) throw new HttpError({ statusCode: 401, message: "Unauthorized" }); diff --git a/pages/api/users/[userId]/_patch.ts b/pages/api/users/[userId]/_patch.ts index 9d12d178bc..9e6fee7f91 100644 --- a/pages/api/users/[userId]/_patch.ts +++ b/pages/api/users/[userId]/_patch.ts @@ -3,7 +3,6 @@ import type { NextApiRequest } from "next"; import { HttpError } from "@calcom/lib/http-error"; import { defaultResponder } from "@calcom/lib/server"; -import { isAdminGuard } from "@lib/utils/isAdmin"; import { schemaQueryUserId } from "@lib/validations/shared/queryUserId"; import { schemaUserEditBodyParams, schemaUserReadPublic } from "@lib/validations/user"; @@ -53,9 +52,8 @@ import { schemaUserEditBodyParams, schemaUserReadPublic } from "@lib/validations * description: Authorization information is missing or invalid. */ export async function patchHandler(req: NextApiRequest) { - const { prisma } = req; + const { prisma, isAdmin } = req; const query = schemaQueryUserId.parse(req.query); - const isAdmin = await isAdminGuard(req); // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user if (!isAdmin && query.userId !== req.userId) throw new HttpError({ statusCode: 401, message: "Unauthorized" }); diff --git a/pages/api/users/_get.ts b/pages/api/users/_get.ts index 703760adb5..67bb53e2d1 100644 --- a/pages/api/users/_get.ts +++ b/pages/api/users/_get.ts @@ -2,7 +2,6 @@ import type { NextApiRequest } from "next"; import { defaultResponder } from "@calcom/lib/server"; -import { isAdminGuard } from "@lib/utils/isAdmin"; import { schemaUsersReadPublic } from "@lib/validations/user"; import { Prisma } from ".prisma/client"; @@ -24,8 +23,7 @@ import { Prisma } from ".prisma/client"; * description: No users were found */ async function getHandler(req: NextApiRequest) { - const { userId, prisma } = req; - const isAdmin = await isAdminGuard(req); + const { userId, prisma, isAdmin } = req; const where: Prisma.UserWhereInput = {}; // If user is not ADMIN, return only his data. if (!isAdmin) where.id = userId; diff --git a/pages/api/users/_post.ts b/pages/api/users/_post.ts index 4ff41bde62..03ab696e96 100644 --- a/pages/api/users/_post.ts +++ b/pages/api/users/_post.ts @@ -3,12 +3,10 @@ import type { NextApiRequest } from "next"; import { HttpError } from "@calcom/lib/http-error"; import { defaultResponder } from "@calcom/lib/server"; -import { isAdminGuard } from "@lib/utils/isAdmin"; import { schemaUserCreateBodyParams } from "@lib/validations/user"; async function postHandler(req: NextApiRequest) { - const { prisma } = req; - const isAdmin = await isAdminGuard(req); + const { prisma, isAdmin } = req; // If user is not ADMIN, return unauthorized. if (!isAdmin) throw new HttpError({ statusCode: 401, message: "You are not authorized" }); const data = schemaUserCreateBodyParams.parse(req.body);