diff --git a/packages/trpc/server/routers/loggedInViewer/outOfOffice.handler.ts b/packages/trpc/server/routers/loggedInViewer/outOfOffice.handler.ts index 78cbcb0d1f..2f1753feb9 100644 --- a/packages/trpc/server/routers/loggedInViewer/outOfOffice.handler.ts +++ b/packages/trpc/server/routers/loggedInViewer/outOfOffice.handler.ts @@ -50,6 +50,13 @@ export const outOfOfficeCreate = async ({ ctx, input }: TBookingRedirect) => { const user = await prisma.user.findUnique({ where: { id: input.toTeamUserId, + /** You can only create OOO for members of teams you belong to */ + teams: { + some: { + userId: ctx.user.id, + accepted: true, + }, + }, }, select: { id: true, @@ -194,28 +201,18 @@ export const outOfOfficeEntryDelete = async ({ ctx, input }: TBookingRedirectDel throw new TRPCError({ code: "BAD_REQUEST", message: "out_of_office_id_required" }); } - // Validate outOfOfficeEntry belongs to the user deleting it - const outOfOfficeEntry = await prisma.outOfOfficeEntry.findFirst({ - select: { - uuid: true, - userId: true, - }, + const deletedOutOfOfficeEntry = await prisma.outOfOfficeEntry.delete({ where: { uuid: input.outOfOfficeUid, + /** Validate outOfOfficeEntry belongs to the user deleting it */ userId: ctx.user.id, }, }); - if (!outOfOfficeEntry) { + if (!deletedOutOfOfficeEntry) { throw new TRPCError({ code: "NOT_FOUND", message: "booking_redirect_not_found" }); } - await prisma.outOfOfficeEntry.delete({ - where: { - uuid: input.outOfOfficeUid, - }, - }); - return {}; };