Misc fixes (#5988)

* Address reports

* Clean up

* remove activeOn in where

Co-authored-by: Peer Richelsen <peeroke@gmail.com>
Co-authored-by: CarinaWolli <wollencarina@gmail.com>
Co-authored-by: Bailey Pumfleet <bailey@pumfleet.co.uk>

packages/trpc/server/routers/viewer/eventTypes.tsx

@@ -456,8 +456,14 @@ export const eventTypesRouter = router({
       users,
       id,
       hashedLink,
+      // Extract this from the input so it doesn't get saved in the db
+      // eslint-disable-next-line
+      userId,
+      // eslint-disable-next-line
+      teamId,
       ...rest
     } = input;
+
     const data: Prisma.EventTypeUpdateInput = {
       ...rest,
       metadata: rest.metadata === null ? Prisma.DbNull : rest.metadata,
@@ -500,11 +506,20 @@ export const eventTypesRouter = router({
     }
 
     if (schedule) {
-      data.schedule = {
-        connect: {
+      // Check that the schedule belongs to the user
+      const userScheduleQuery = await ctx.prisma.schedule.findFirst({
+        where: {
+          userId: ctx.user.id,
           id: schedule,
         },
-      };
+      });
+      if (userScheduleQuery) {
+        data.schedule = {
+          connect: {
+            id: schedule,
+          },
+        };
+      }
     }
 
     if (users) {

packages/trpc/server/routers/viewer/workflows.tsx

@@ -926,6 +926,32 @@ export const workflowsRouter = router({
     .mutation(async ({ ctx, input }) => {
       const { eventTypeId, workflowId } = input;
 
+      // Check that workflow & event type belong to the user
+      const userEventType = await ctx.prisma.eventType.findFirst({
+        where: {
+          id: eventTypeId,
+          users: {
+            some: {
+              id: ctx.user.id,
+            },
+          },
+        },
+      });
+
+      if (!userEventType)
+        throw new TRPCError({ code: "UNAUTHORIZED", message: "This event type does not belong to the user" });
+
+      // Check that the workflow belongs to the user
+      const eventTypeWorkflow = await ctx.prisma.workflow.findFirst({
+        where: {
+          id: workflowId,
+          userId: ctx.user.id,
+        },
+      });
+
+      if (!eventTypeWorkflow)
+        throw new TRPCError({ code: "UNAUTHORIZED", message: "This event type does not belong to the user" });
+
       // NOTE: This was unused
       // const eventType = await ctx.prisma.eventType.findFirst({
       //   where: {