fix: invalid folder queries (#1898)

Currently the majority of folder mutations only work if the user is the
owner of the folder.
This commit is contained in:
David Nguyen
2025-07-16 14:37:55 +10:00
committed by GitHub
parent e5aaa17545
commit 32a5d33a16
20 changed files with 139 additions and 146 deletions
@@ -4,6 +4,7 @@ import { match } from 'ts-pattern';
import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
import { prisma } from '@documenso/prisma';
import { buildTeamWhereQuery } from '../../utils/teams';
import { getTeamById } from '../team/get-team';
export interface DeleteFolderOptions {
@@ -18,8 +19,10 @@ export const deleteFolder = async ({ userId, teamId, folderId }: DeleteFolderOpt
const folder = await prisma.folder.findFirst({
where: {
id: folderId,
userId,
teamId,
team: buildTeamWhereQuery({
teamId,
userId,
}),
},
include: {
documents: true,