diff --git a/lib/helpers/verifyApiKey.ts b/lib/helpers/verifyApiKey.ts index ec6aaf1179..8c11cdb492 100644 --- a/lib/helpers/verifyApiKey.ts +++ b/lib/helpers/verifyApiKey.ts @@ -34,7 +34,7 @@ export const verifyApiKey: NextMiddleware = async (req, res, next) => { /* We save the user id in the request for later use */ req.userId = apiKey.userId; /* We save the isAdmin boolean here for later use */ - req.isAdmin = await isAdminGuard(req.userId); + req.isAdmin = await isAdminGuard(req.userId, prisma); await next(); }; diff --git a/lib/utils/isAdmin.ts b/lib/utils/isAdmin.ts index 64af37367f..aab1454b62 100644 --- a/lib/utils/isAdmin.ts +++ b/lib/utils/isAdmin.ts @@ -1,8 +1,6 @@ -import { UserPermissionRole } from "@prisma/client"; +import { PrismaClient, UserPermissionRole } from "@prisma/client"; -import prisma from "@calcom/prisma"; - -export const isAdminGuard = async (userId: number) => { +export const isAdminGuard = async (userId: number, prisma: PrismaClient) => { const user = await prisma.user.findUnique({ where: { id: userId } }); return user?.role === UserPermissionRole.ADMIN; }; diff --git a/lib/utils/webhookSubscriptions.ts b/lib/utils/webhookSubscriptions.ts index bdf9d95576..e53b15e7c5 100644 --- a/lib/utils/webhookSubscriptions.ts +++ b/lib/utils/webhookSubscriptions.ts @@ -7,7 +7,7 @@ export type GetSubscriberOptions = { eventTypeId: number; triggerEvent: WebhookTriggerEvents; }; - +/** @note will this not work with custom prisma? since we're importing prisma directly and not passing it from request here **/ const getWebhooks = async (options: GetSubscriberOptions) => { const { userId, eventTypeId } = options; const allWebhooks = await prisma.webhook.findMany({ diff --git a/pages/api/users/[userId]/_delete.ts b/pages/api/users/[userId]/_delete.ts index c2d8d5db29..ac15975931 100644 --- a/pages/api/users/[userId]/_delete.ts +++ b/pages/api/users/[userId]/_delete.ts @@ -33,7 +33,7 @@ import { schemaQueryUserId } from "@lib/validations/shared/queryUserId"; */ export async function deleteHandler(req: NextApiRequest) { const query = schemaQueryUserId.parse(req.query); - const isAdmin = await isAdminGuard(req.userId); + const isAdmin = await isAdminGuard(req.userId, req.prisma); // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user if (!isAdmin && query.userId !== req.userId) throw new HttpError({ statusCode: 401, message: "Unauthorized" }); diff --git a/pages/api/users/[userId]/_get.ts b/pages/api/users/[userId]/_get.ts index 5c76c4e315..2fda8ddc91 100644 --- a/pages/api/users/[userId]/_get.ts +++ b/pages/api/users/[userId]/_get.ts @@ -34,7 +34,7 @@ import { schemaUserReadPublic } from "@lib/validations/user"; */ export async function getHandler(req: NextApiRequest) { const query = schemaQueryUserId.parse(req.query); - const isAdmin = await isAdminGuard(req.userId); + const isAdmin = await isAdminGuard(req.userId, req.prisma); // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user if (!isAdmin && query.userId !== req.userId) throw new HttpError({ statusCode: 401, message: "Unauthorized" }); diff --git a/pages/api/users/[userId]/_patch.ts b/pages/api/users/[userId]/_patch.ts index 9f32e920c4..58efa5773b 100644 --- a/pages/api/users/[userId]/_patch.ts +++ b/pages/api/users/[userId]/_patch.ts @@ -55,7 +55,7 @@ import { schemaUserEditBodyParams, schemaUserReadPublic } from "@lib/validations */ export async function patchHandler(req: NextApiRequest) { const query = schemaQueryUserId.parse(req.query); - const isAdmin = await isAdminGuard(req.userId); + const isAdmin = await isAdminGuard(req.userId, req.prisma); // Here we only check for ownership of the user if the user is not admin, otherwise we let ADMIN's edit any user if (!isAdmin && query.userId !== req.userId) throw new HttpError({ statusCode: 401, message: "Unauthorized" }); diff --git a/pages/api/users/_get.ts b/pages/api/users/_get.ts index 4c4aadaecd..7f90ba8a27 100644 --- a/pages/api/users/_get.ts +++ b/pages/api/users/_get.ts @@ -24,8 +24,8 @@ import { Prisma } from ".prisma/client"; * 404: * description: No users were found */ -async function getHandler({ userId }: NextApiRequest) { - const isAdmin = await isAdminGuard(userId); +async function getHandler({ userId, prisma }: NextApiRequest) { + const isAdmin = await isAdminGuard(userId, prisma); const where: Prisma.UserWhereInput = {}; // If user is not ADMIN, return only his data. if (!isAdmin) where.id = userId; diff --git a/pages/api/users/_post.ts b/pages/api/users/_post.ts index 908a9c4bcc..2217c49127 100644 --- a/pages/api/users/_post.ts +++ b/pages/api/users/_post.ts @@ -8,7 +8,7 @@ import { isAdminGuard } from "@lib/utils/isAdmin"; import { schemaUserCreateBodyParams } from "@lib/validations/user"; async function postHandler(req: NextApiRequest) { - const isAdmin = await isAdminGuard(req.userId); + const isAdmin = await isAdminGuard(req.userId, req.prisma); // If user is not ADMIN, return unauthorized. if (!isAdmin) throw new HttpError({ statusCode: 401, message: "You are not authorized" }); const data = schemaUserCreateBodyParams.parse(req.body);