fix: make isAdmin require req.prisma too

lib/helpers/verifyApiKey.ts

@@ -34,7 +34,7 @@ export const verifyApiKey: NextMiddleware = async (req, res, next) => {
   /* We save the user id in the request for later use */
   req.userId = apiKey.userId;
   /* We save the isAdmin boolean here for later use */
-  req.isAdmin = await isAdminGuard(req.userId);
+  req.isAdmin = await isAdminGuard(req.userId, prisma);
 
   await next();
 };

lib/utils/isAdmin.ts

@@ -1,8 +1,6 @@
-import { UserPermissionRole } from "@prisma/client";
+import { PrismaClient, UserPermissionRole } from "@prisma/client";
 
-import prisma from "@calcom/prisma";
-
-export const isAdminGuard = async (userId: number) => {
+export const isAdminGuard = async (userId: number, prisma: PrismaClient) => {
   const user = await prisma.user.findUnique({ where: { id: userId } });
   return user?.role === UserPermissionRole.ADMIN;
 };

lib/utils/webhookSubscriptions.ts

@@ -7,7 +7,7 @@ export type GetSubscriberOptions = {
   eventTypeId: number;
   triggerEvent: WebhookTriggerEvents;
 };
-
+/** @note will this not work with custom prisma? since we're importing prisma directly and not passing it from request here **/
 const getWebhooks = async (options: GetSubscriberOptions) => {
   const { userId, eventTypeId } = options;
   const allWebhooks = await prisma.webhook.findMany({

pages/api/users/[userId]/_delete.ts

@@ -33,7 +33,7 @@ import { schemaQueryUserId } from "@lib/validations/shared/queryUserId";
  */
 export async function deleteHandler(req: NextApiRequest) {
   const query = schemaQueryUserId.parse(req.query);
-  const isAdmin = await isAdminGuard(req.userId);
+  const isAdmin = await isAdminGuard(req.userId, req.prisma);
   // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user
   if (!isAdmin && query.userId !== req.userId)
     throw new HttpError({ statusCode: 401, message: "Unauthorized" });

pages/api/users/[userId]/_get.ts

@@ -34,7 +34,7 @@ import { schemaUserReadPublic } from "@lib/validations/user";
  */
 export async function getHandler(req: NextApiRequest) {
   const query = schemaQueryUserId.parse(req.query);
-  const isAdmin = await isAdminGuard(req.userId);
+  const isAdmin = await isAdminGuard(req.userId, req.prisma);
   // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user
   if (!isAdmin && query.userId !== req.userId)
     throw new HttpError({ statusCode: 401, message: "Unauthorized" });

pages/api/users/[userId]/_patch.ts

@@ -55,7 +55,7 @@ import { schemaUserEditBodyParams, schemaUserReadPublic } from "@lib/validations
  */
 export async function patchHandler(req: NextApiRequest) {
   const query = schemaQueryUserId.parse(req.query);
-  const isAdmin = await isAdminGuard(req.userId);
+  const isAdmin = await isAdminGuard(req.userId, req.prisma);
   // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user
   if (!isAdmin && query.userId !== req.userId)
     throw new HttpError({ statusCode: 401, message: "Unauthorized" });

pages/api/users/_get.ts

@@ -24,8 +24,8 @@ import { Prisma } from ".prisma/client";
  *       404:
  *         description: No users were found
  */
-async function getHandler({ userId }: NextApiRequest) {
-  const isAdmin = await isAdminGuard(userId);
+async function getHandler({ userId, prisma }: NextApiRequest) {
+  const isAdmin = await isAdminGuard(userId, prisma);
   const where: Prisma.UserWhereInput = {};
   // If user is not ADMIN, return only his data.
   if (!isAdmin) where.id = userId;

pages/api/users/_post.ts

@@ -8,7 +8,7 @@ import { isAdminGuard } from "@lib/utils/isAdmin";
 import { schemaUserCreateBodyParams } from "@lib/validations/user";
 
 async function postHandler(req: NextApiRequest) {
-  const isAdmin = await isAdminGuard(req.userId);
+  const isAdmin = await isAdminGuard(req.userId, req.prisma);
   // If user is not ADMIN, return unauthorized.
   if (!isAdmin) throw new HttpError({ statusCode: 401, message: "You are not authorized" });
   const data = schemaUserCreateBodyParams.parse(req.body);