fix: invalid folder queries (#1898)

Currently the majority of folder mutations only work if the user is the
owner of the folder.

packages/lib/server-only/folder/delete-folder.ts

@@ -4,6 +4,7 @@ import { match } from 'ts-pattern';
 import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { prisma } from '@documenso/prisma';
 
+import { buildTeamWhereQuery } from '../../utils/teams';
 import { getTeamById } from '../team/get-team';
 
 export interface DeleteFolderOptions {
@@ -18,8 +19,10 @@ export const deleteFolder = async ({ userId, teamId, folderId }: DeleteFolderOpt
   const folder = await prisma.folder.findFirst({
     where: {
       id: folderId,
-      userId,
-      teamId,
+      team: buildTeamWhereQuery({
+        teamId,
+        userId,
+      }),
     },
     include: {
       documents: true,

packages/lib/server-only/folder/move-folder.ts

@@ -2,6 +2,8 @@ import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import type { ApiRequestMetadata } from '@documenso/lib/universal/extract-request-metadata';
 import { prisma } from '@documenso/prisma';
 
+import { buildTeamWhereQuery } from '../../utils/teams';
+
 export interface MoveFolderOptions {
   userId: number;
   teamId?: number;
@@ -15,8 +17,10 @@ export const moveFolder = async ({ userId, teamId, folderId, parentId }: MoveFol
     const folder = await tx.folder.findFirst({
       where: {
         id: folderId,
-        userId,
-        teamId,
+        team: buildTeamWhereQuery({
+          teamId,
+          userId,
+        }),
       },
     });
 

packages/lib/server-only/folder/move-template-to-folder.ts

@@ -2,6 +2,8 @@ import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { FolderType } from '@documenso/lib/types/folder-type';
 import { prisma } from '@documenso/prisma';
 
+import { buildTeamWhereQuery } from '../../utils/teams';
+
 export interface MoveTemplateToFolderOptions {
   userId: number;
   teamId?: number;
@@ -15,45 +17,47 @@ export const moveTemplateToFolder = async ({
   templateId,
   folderId,
 }: MoveTemplateToFolderOptions) => {
-  return await prisma.$transaction(async (tx) => {
-    const template = await tx.template.findFirst({
-      where: {
-        id: templateId,
-        userId,
+  const template = await prisma.template.findFirst({
+    where: {
+      id: templateId,
+      team: buildTeamWhereQuery({
         teamId,
-      },
+        userId,
+      }),
+    },
+  });
+
+  if (!template) {
+    throw new AppError(AppErrorCode.NOT_FOUND, {
+      message: 'Template not found',
     });
+  }
 
-    if (!template) {
-      throw new AppError(AppErrorCode.NOT_FOUND, {
-        message: 'Template not found',
-      });
-    }
-
-    if (folderId !== null) {
-      const folder = await tx.folder.findFirst({
-        where: {
-          id: folderId,
-          userId,
-          teamId,
-          type: FolderType.TEMPLATE,
-        },
-      });
-
-      if (!folder) {
-        throw new AppError(AppErrorCode.NOT_FOUND, {
-          message: 'Folder not found',
-        });
-      }
-    }
-
-    return await tx.template.update({
+  if (folderId !== null) {
+    const folder = await prisma.folder.findFirst({
       where: {
-        id: templateId,
-      },
-      data: {
-        folderId,
+        id: folderId,
+        team: buildTeamWhereQuery({
+          teamId,
+          userId,
+        }),
+        type: FolderType.TEMPLATE,
       },
     });
+
+    if (!folder) {
+      throw new AppError(AppErrorCode.NOT_FOUND, {
+        message: 'Folder not found',
+      });
+    }
+  }
+
+  return await prisma.template.update({
+    where: {
+      id: templateId,
+    },
+    data: {
+      folderId,
+    },
   });
 };

packages/lib/server-only/folder/pin-folder.ts

@@ -2,6 +2,7 @@ import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { prisma } from '@documenso/prisma';
 
 import type { TFolderType } from '../../types/folder-type';
+import { buildTeamWhereQuery } from '../../utils/teams';
 
 export interface PinFolderOptions {
   userId: number;
@@ -14,8 +15,10 @@ export const pinFolder = async ({ userId, teamId, folderId, type }: PinFolderOpt
   const folder = await prisma.folder.findFirst({
     where: {
       id: folderId,
-      userId,
-      teamId,
+      team: buildTeamWhereQuery({
+        teamId,
+        userId,
+      }),
       type,
     },
   });

packages/lib/server-only/folder/unpin-folder.ts

@@ -2,6 +2,7 @@ import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
 import { prisma } from '@documenso/prisma';
 
 import type { TFolderType } from '../../types/folder-type';
+import { buildTeamWhereQuery } from '../../utils/teams';
 
 export interface UnpinFolderOptions {
   userId: number;
@@ -14,8 +15,10 @@ export const unpinFolder = async ({ userId, teamId, folderId, type }: UnpinFolde
   const folder = await prisma.folder.findFirst({
     where: {
       id: folderId,
-      userId,
-      teamId,
+      team: buildTeamWhereQuery({
+        teamId,
+        userId,
+      }),
       type,
     },
   });

packages/lib/server-only/folder/update-folder.ts

@@ -4,6 +4,7 @@ import { DocumentVisibility } from '@documenso/prisma/generated/types';
 
 import type { TFolderType } from '../../types/folder-type';
 import { FolderType } from '../../types/folder-type';
+import { buildTeamWhereQuery } from '../../utils/teams';
 
 export interface UpdateFolderOptions {
   userId: number;
@@ -25,8 +26,10 @@ export const updateFolder = async ({
   const folder = await prisma.folder.findFirst({
     where: {
       id: folderId,
-      userId,
-      teamId,
+      team: buildTeamWhereQuery({
+        teamId,
+        userId,
+      }),
       type,
     },
   });