Workflow security fixes (#4996)

* security fix to not add even-types from other users

* throw unauthroized error if a step does not belong to workflow

Co-authored-by: CarinaWolli <wollencarina@gmail.com>

packages/trpc/server/routers/viewer/workflows.tsx

@@ -249,7 +249,12 @@ export const workflowsRouter = createProtectedRouter()
         },
       });
 
-      if (!userWorkflow || userWorkflow.userId !== user.id) throw new TRPCError({ code: "UNAUTHORIZED" });
+      if (
+        !userWorkflow ||
+        userWorkflow.userId !== user.id ||
+        steps.filter((step) => step.workflowId != id).length > 0
+      )
+        throw new TRPCError({ code: "UNAUTHORIZED" });
 
       const oldActiveOnEventTypes = await ctx.prisma.workflowsOnEventTypes.findMany({
         where: {
@@ -290,7 +295,7 @@ export const workflowsRouter = createProtectedRouter()
         if (
           newEventType &&
           newEventType.userId !== user.id &&
-          newEventType?.team?.members.filter((membership) => membership.userId === user.id).length === 0
+          !newEventType?.team?.members.filter((membership) => membership.userId === user.id).length
         ) {
           throw new TRPCError({ code: "UNAUTHORIZED" });
         }
@@ -644,11 +649,7 @@ export const workflowsRouter = createProtectedRouter()
       const addedSteps = steps.map((s) => {
         if (s.id <= 0) {
           const { id: stepId, ...stepToAdd } = s;
-          if (stepToAdd.workflowId === id) {
-            return stepToAdd;
-          } else {
-            throw new TRPCError({ code: "UNAUTHORIZED" });
-          }
+          return stepToAdd;
         }
       });