fix: invalid folder queries (#1898)

Currently the majority of folder mutations only work if the user is the
owner of the folder.

packages/lib/server-only/document/create-document.ts

@@ -16,6 +16,7 @@ import { prefixedId } from '../../universal/id';
 import { getFileServerSide } from '../../universal/upload/get-file.server';
 import { putPdfFileServerSide } from '../../universal/upload/put-file.server';
 import { determineDocumentVisibility } from '../../utils/document-visibility';
+import { buildTeamWhereQuery } from '../../utils/teams';
 import { getTeamById } from '../team/get-team';
 import { getTeamSettings } from '../team/get-team-settings';
 import { triggerWebhook } from '../webhooks/trigger/trigger-webhook';
@@ -58,8 +59,10 @@ export const createDocument = async ({
     const folder = await prisma.folder.findFirst({
       where: {
         id: folderId,
-        userId,
-        teamId,
+        team: buildTeamWhereQuery({
+          teamId,
+          userId,
+        }),
       },
       select: {
         visibility: true,

packages/lib/server-only/field/delete-field.ts

@@ -26,7 +26,6 @@ export const deleteField = async ({
       id: fieldId,
       document: {
         id: documentId,
-        userId,
         team: buildTeamWhereQuery({ teamId, userId }),
       },
     },

packages/lib/server-only/field/update-field.ts

@@ -48,7 +48,6 @@ export const updateField = async ({
       id: fieldId,
       document: {
         id: documentId,
-        userId,
         team: buildTeamWhereQuery({ teamId, userId }),
       },
     },

packages/lib/server-only/folder/delete-folder.ts

@@ -4,6 +4,7 @@ import { match } from 'ts-pattern';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { prisma } from '@documenso/prisma';
 
+import { buildTeamWhereQuery } from '../../utils/teams';
 import { getTeamById } from '../team/get-team';
 
 export interface DeleteFolderOptions {
@@ -18,8 +19,10 @@ export const deleteFolder = async ({ userId, teamId, folderId }: DeleteFolderOpt
   const folder = await prisma.folder.findFirst({
     where: {
       id: folderId,
-      userId,
-      teamId,
+      team: buildTeamWhereQuery({
+        teamId,
+        userId,
+      }),
     },
     include: {
       documents: true,

packages/lib/server-only/folder/move-folder.ts

@@ -2,6 +2,8 @@ import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import type { ApiRequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
 import { prisma } from '@documenso/prisma';
 
+import { buildTeamWhereQuery } from '../../utils/teams';
+
 export interface MoveFolderOptions {
   userId: number;
   teamId?: number;
@@ -15,8 +17,10 @@ export const moveFolder = async ({ userId, teamId, folderId, parentId }: MoveFol
     const folder = await tx.folder.findFirst({
       where: {
         id: folderId,
-        userId,
-        teamId,
+        team: buildTeamWhereQuery({
+          teamId,
+          userId,
+        }),
       },
     });
 

packages/lib/server-only/folder/move-template-to-folder.ts

@@ -2,6 +2,8 @@ import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { FolderType } from '@documenso/lib/types/folder-type';
 import { prisma } from '@documenso/prisma';
 
+import { buildTeamWhereQuery } from '../../utils/teams';
+
 export interface MoveTemplateToFolderOptions {
   userId: number;
   teamId?: number;
@@ -15,45 +17,47 @@ export const moveTemplateToFolder = async ({
   templateId,
   folderId,
 }: MoveTemplateToFolderOptions) => {
-  return await prisma.$transaction(async (tx) => {
-    const template = await tx.template.findFirst({
-      where: {
-        id: templateId,
-        userId,
+  const template = await prisma.template.findFirst({
+    where: {
+      id: templateId,
+      team: buildTeamWhereQuery({
         teamId,
-      },
+        userId,
+      }),
+    },
+  });
+
+  if (!template) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Template not found',
     });
+  }
 
-    if (!template) {
-      throw new AppError(AppErrorCode.NOT_FOUND, {
-        message: 'Template not found',
-      });
-    }
-
-    if (folderId !== null) {
-      const folder = await tx.folder.findFirst({
-        where: {
-          id: folderId,
-          userId,
-          teamId,
-          type: FolderType.TEMPLATE,
-        },
-      });
-
-      if (!folder) {
-        throw new AppError(AppErrorCode.NOT_FOUND, {
-          message: 'Folder not found',
-        });
-      }
-    }
-
-    return await tx.template.update({
+  if (folderId !== null) {
+    const folder = await prisma.folder.findFirst({
       where: {
-        id: templateId,
-      },
-      data: {
-        folderId,
+        id: folderId,
+        team: buildTeamWhereQuery({
+          teamId,
+          userId,
+        }),
+        type: FolderType.TEMPLATE,
       },
     });
+
+    if (!folder) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Folder not found',
+      });
+    }
+  }
+
+  return await prisma.template.update({
+    where: {
+      id: templateId,
+    },
+    data: {
+      folderId,
+    },
   });
 };

packages/lib/server-only/folder/pin-folder.ts

@@ -2,6 +2,7 @@ import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { prisma } from '@documenso/prisma';
 
 import type { TFolderType } from '../../types/folder-type';
+import { buildTeamWhereQuery } from '../../utils/teams';
 
 export interface PinFolderOptions {
   userId: number;
@@ -14,8 +15,10 @@ export const pinFolder = async ({ userId, teamId, folderId, type }: PinFolderOpt
   const folder = await prisma.folder.findFirst({
     where: {
       id: folderId,
-      userId,
-      teamId,
+      team: buildTeamWhereQuery({
+        teamId,
+        userId,
+      }),
       type,
     },
   });

packages/lib/server-only/folder/unpin-folder.ts

@@ -2,6 +2,7 @@ import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { prisma } from '@documenso/prisma';
 
 import type { TFolderType } from '../../types/folder-type';
+import { buildTeamWhereQuery } from '../../utils/teams';
 
 export interface UnpinFolderOptions {
   userId: number;
@@ -14,8 +15,10 @@ export const unpinFolder = async ({ userId, teamId, folderId, type }: UnpinFolde
   const folder = await prisma.folder.findFirst({
     where: {
       id: folderId,
-      userId,
-      teamId,
+      team: buildTeamWhereQuery({
+        teamId,
+        userId,
+      }),
       type,
     },
   });

packages/lib/server-only/folder/update-folder.ts

@@ -4,6 +4,7 @@ import { DocumentVisibility } from '@documenso/prisma/generated/types';
 
 import type { TFolderType } from '../../types/folder-type';
 import { FolderType } from '../../types/folder-type';
+import { buildTeamWhereQuery } from '../../utils/teams';
 
 export interface UpdateFolderOptions {
   userId: number;
@@ -25,8 +26,10 @@ export const updateFolder = async ({
   const folder = await prisma.folder.findFirst({
     where: {
       id: folderId,
-      userId,
-      teamId,
+      team: buildTeamWhereQuery({
+        teamId,
+        userId,
+      }),
       type,
     },
   });

packages/lib/server-only/organisation/create-organisation-billing-portal.ts

@@ -1,47 +0,0 @@
-import { getPortalSession } from '@documenso/ee/server-only/stripe/get-portal-session';
-import { IS_BILLING_ENABLED } from '@documenso/lib/constants/app';
-import { TEAM_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/teams';
-import { prisma } from '@documenso/prisma';
-
-export type CreateTeamBillingPortalOptions = {
-  userId: number;
-  teamId: number;
-};
-
-export const createTeamBillingPortal = async ({
-  userId,
-  teamId,
-}: CreateTeamBillingPortalOptions) => {
-  if (!IS_BILLING_ENABLED()) {
-    throw new Error('Billing is not enabled');
-  }
-
-  const team = await prisma.team.findFirstOrThrow({
-    where: {
-      id: teamId,
-      members: {
-        some: {
-          userId,
-          role: {
-            in: TEAM_MEMBER_ROLE_PERMISSIONS_MAP['MANAGE_BILLING'],
-          },
-        },
-      },
-    },
-    include: {
-      subscription: true,
-    },
-  });
-
-  if (!team.subscription) {
-    throw new Error('Team has no subscription');
-  }
-
-  if (!team.customerId) {
-    throw new Error('Team has no customerId');
-  }
-
-  return getPortalSession({
-    customerId: team.customerId,
-  });
-};

packages/lib/server-only/webhooks/get-all-webhooks-by-event-trigger.ts

@@ -2,6 +2,8 @@ import type { WebhookTriggerEvents } from '@prisma/client';
 
 import { prisma } from '@documenso/prisma';
 
+import { buildTeamWhereQuery } from '../../utils/teams';
+
 export type GetAllWebhooksByEventTriggerOptions = {
   event: WebhookTriggerEvents;
   userId: number;
@@ -19,22 +21,10 @@ export const getAllWebhooksByEventTrigger = async ({
       eventTriggers: {
         has: event,
       },
-      team: {
-        id: teamId,
-        teamGroups: {
-          some: {
-            organisationGroup: {
-              organisationGroupMembers: {
-                some: {
-                  organisationMember: {
-                    userId,
-                  },
-                },
-              },
-            },
-          },
-        },
-      },
+      team: buildTeamWhereQuery({
+        teamId,
+        userId,
+      }),
     },
   });
 };