js/docmost
1
0
Fork 0
mirror of https://github.com/docmost/docmost synced 2025-03-28 21:13:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

prevent admin role from managing owner role (backend)

Browse Source
This commit is contained in:
Philipinho 2024-07-22 16:16:33 +01:00
parent 109dbdbe02
commit b4bc184cb3
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
apps/server/src/core/workspace/services/workspace.service.ts
View File

@ -1,5 +1,6 @@
import {
BadRequestException,
ForbiddenException,
Injectable,
NotFoundException,
} from '@nestjs/common';
@ -217,11 +218,21 @@ export class WorkspaceService {
) {
const user = await this.userRepo.findById(userRoleDto.userId, workspaceId);
const newRole = userRoleDto.role.toLowerCase();
if (!user) {
throw new BadRequestException('Workspace member not found');
}
if (user.role === userRoleDto.role) {
// prevent ADMIN from managing OWNER role
if (
(authUser.role === UserRole.ADMIN && newRole === UserRole.OWNER) ||
(authUser.role === UserRole.ADMIN && user.role === UserRole.OWNER)
) {
throw new ForbiddenException();
}
if (user.role === newRole) {
return user;
}
@ -238,7 +249,7 @@ export class WorkspaceService {
await this.userRepo.updateUser(
{
role: userRoleDto.role,
role: newRole,
},
user.id,
workspaceId,