refactor: use permission service for team delete trpc endpoint (#24077)

* refactor: use permission service for team delete trpc endpoint

* add safety check

* throw forbidden

---------

Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
This commit is contained in:
Benny Joo
2025-09-26 08:09:23 +01:00
committed by GitHub
co-authored by Morgan
parent 7d5a3391f1
commit fba096f23d
@@ -1,5 +1,7 @@
import { isTeamOwner } from "@calcom/features/ee/teams/lib/queries";
import { PermissionCheckService } from "@calcom/features/pbac/services/permission-check.service";
import { TeamService } from "@calcom/lib/server/service/teamService";
import { prisma } from "@calcom/prisma";
import { MembershipRole } from "@calcom/prisma/enums";
import { TRPCError } from "@trpc/server";
@@ -14,7 +16,26 @@ type DeleteOptions = {
};
export const deleteHandler = async ({ ctx, input }: DeleteOptions) => {
if (!(await isTeamOwner(ctx.user?.id, input.teamId))) throw new TRPCError({ code: "UNAUTHORIZED" });
const team = await prisma.team.findUnique({
where: {
id: input.teamId,
},
select: {
isOrganization: true,
},
});
if (!team) throw new TRPCError({ code: "NOT_FOUND" });
const permissionCheckService = new PermissionCheckService();
const hasPermission = await permissionCheckService.checkPermission({
userId: ctx.user.id,
teamId: input.teamId,
permission: team.isOrganization ? "organization.delete" : "team.delete",
fallbackRoles: [MembershipRole.OWNER],
});
if (!hasPermission) throw new TRPCError({ code: "FORBIDDEN" });
return await TeamService.delete({ id: input.teamId });
};