From fba096f23dcd0502a1ba709235ca93c474c78797 Mon Sep 17 00:00:00 2001
From: Benny Joo <sldisek783@gmail.com>
Date: Fri, 26 Sep 2025 03:09:23 -0400
Subject: [PATCH] refactor: use permission service for team delete trpc
 endpoint (#24077)

* refactor: use permission service for team delete trpc endpoint

* add safety check

* throw forbidden

---------

Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
---
 .../routers/viewer/teams/delete.handler.ts    | 25 +++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/packages/trpc/server/routers/viewer/teams/delete.handler.ts b/packages/trpc/server/routers/viewer/teams/delete.handler.ts
index b5f278686a..b3ea0c3174 100644
--- a/packages/trpc/server/routers/viewer/teams/delete.handler.ts
+++ b/packages/trpc/server/routers/viewer/teams/delete.handler.ts
@@ -1,5 +1,7 @@
-import { isTeamOwner } from "@calcom/features/ee/teams/lib/queries";
+import { PermissionCheckService } from "@calcom/features/pbac/services/permission-check.service";
 import { TeamService } from "@calcom/lib/server/service/teamService";
+import { prisma } from "@calcom/prisma";
+import { MembershipRole } from "@calcom/prisma/enums";
 
 import { TRPCError } from "@trpc/server";
 
@@ -14,7 +16,26 @@ type DeleteOptions = {
 };
 
 export const deleteHandler = async ({ ctx, input }: DeleteOptions) => {
-  if (!(await isTeamOwner(ctx.user?.id, input.teamId))) throw new TRPCError({ code: "UNAUTHORIZED" });
+  const team = await prisma.team.findUnique({
+    where: {
+      id: input.teamId,
+    },
+    select: {
+      isOrganization: true,
+    },
+  });
+
+  if (!team) throw new TRPCError({ code: "NOT_FOUND" });
+
+  const permissionCheckService = new PermissionCheckService();
+  const hasPermission = await permissionCheckService.checkPermission({
+    userId: ctx.user.id,
+    teamId: input.teamId,
+    permission: team.isOrganization ? "organization.delete" : "team.delete",
+    fallbackRoles: [MembershipRole.OWNER],
+  });
+
+  if (!hasPermission) throw new TRPCError({ code: "FORBIDDEN" });
 
   return await TeamService.delete({ id: input.teamId });
 };