From 8f48ecafec397cf0786c59a90f9e80516617c205 Mon Sep 17 00:00:00 2001
From: Joe Au-Yeung <65426560+joeauyeung@users.noreply.github.com>
Date: Tue, 13 Dec 2022 12:44:53 -0500
Subject: [PATCH] Misc fixes (#5988)

* Address reports

* Clean up

* remove activeOn in where

Co-authored-by: Peer Richelsen <peeroke@gmail.com>
Co-authored-by: CarinaWolli <wollencarina@gmail.com>
Co-authored-by: Bailey Pumfleet <bailey@pumfleet.co.uk>
---
 .../trpc/server/routers/viewer/eventTypes.tsx | 21 ++++++++++++---
 .../trpc/server/routers/viewer/workflows.tsx  | 26 +++++++++++++++++++
 2 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/packages/trpc/server/routers/viewer/eventTypes.tsx b/packages/trpc/server/routers/viewer/eventTypes.tsx
index 95838c762f..7068af435c 100644
--- a/packages/trpc/server/routers/viewer/eventTypes.tsx
+++ b/packages/trpc/server/routers/viewer/eventTypes.tsx
@@ -456,8 +456,14 @@ export const eventTypesRouter = router({
       users,
       id,
       hashedLink,
+      // Extract this from the input so it doesn't get saved in the db
+      // eslint-disable-next-line
+      userId,
+      // eslint-disable-next-line
+      teamId,
       ...rest
     } = input;
+
     const data: Prisma.EventTypeUpdateInput = {
       ...rest,
       metadata: rest.metadata === null ? Prisma.DbNull : rest.metadata,
@@ -500,11 +506,20 @@ export const eventTypesRouter = router({
     }
 
     if (schedule) {
-      data.schedule = {
-        connect: {
+      // Check that the schedule belongs to the user
+      const userScheduleQuery = await ctx.prisma.schedule.findFirst({
+        where: {
+          userId: ctx.user.id,
           id: schedule,
         },
-      };
+      });
+      if (userScheduleQuery) {
+        data.schedule = {
+          connect: {
+            id: schedule,
+          },
+        };
+      }
     }
 
     if (users) {
diff --git a/packages/trpc/server/routers/viewer/workflows.tsx b/packages/trpc/server/routers/viewer/workflows.tsx
index 47b87bd94c..295afe17ac 100644
--- a/packages/trpc/server/routers/viewer/workflows.tsx
+++ b/packages/trpc/server/routers/viewer/workflows.tsx
@@ -926,6 +926,32 @@ export const workflowsRouter = router({
     .mutation(async ({ ctx, input }) => {
       const { eventTypeId, workflowId } = input;
 
+      // Check that workflow & event type belong to the user
+      const userEventType = await ctx.prisma.eventType.findFirst({
+        where: {
+          id: eventTypeId,
+          users: {
+            some: {
+              id: ctx.user.id,
+            },
+          },
+        },
+      });
+
+      if (!userEventType)
+        throw new TRPCError({ code: "UNAUTHORIZED", message: "This event type does not belong to the user" });
+
+      // Check that the workflow belongs to the user
+      const eventTypeWorkflow = await ctx.prisma.workflow.findFirst({
+        where: {
+          id: workflowId,
+          userId: ctx.user.id,
+        },
+      });
+
+      if (!eventTypeWorkflow)
+        throw new TRPCError({ code: "UNAUTHORIZED", message: "This event type does not belong to the user" });
+
       // NOTE: This was unused
       // const eventType = await ctx.prisma.eventType.findFirst({
       //   where: {