fix: Allow permitted users to delete others steps

2024-02-23 13:44:48 +01:00
parent 9a7cdf42e1
commit 24ad43d3e4
1 changed files with 9 additions and 4 deletions
--- a/packages/backend/src/graphql/mutations/delete-step.js
+++ b/packages/backend/src/graphql/mutations/delete-step.js
@@ -1,8 +1,13 @@
-const deleteStep = async (_parent, params, context) => {
-  context.currentUser.can('update', 'Flow');
+import Step from '../../models/flow.js';

-  const step = await context.currentUser
-    .$relatedQuery('steps')
+const deleteStep = async (_parent, params, context) => {
+  const conditions = context.currentUser.can('update', 'Flow');
+  const isCreator = conditions.isCreator;
+  const allSteps = Step.query();
+  const userSteps = context.currentUser.$relatedQuery('steps');
+  const baseQuery = isCreator ? userSteps : allSteps;
+
+  const step = await baseQuery
    .withGraphFetched('flow')
    .findOne({
      'steps.id': params.input.id,