groot/automatisch
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: Allow permitted users to delete others steps

Browse Source
This commit is contained in:
Faruk AYDIN
2024-02-23 13:44:48 +01:00
parent 9a7cdf42e1
commit 24ad43d3e4
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
packages/backend/src/graphql/mutations/delete-step.js
View File

@@ -1,8 +1,13 @@
const deleteStep = async (_parent, params, context) => { import Step from '../../models/flow.js';
context.currentUser.can('update', 'Flow');
const step = await context.currentUser const deleteStep = async (_parent, params, context) => {
.$relatedQuery('steps') const conditions = context.currentUser.can('update', 'Flow');
const isCreator = conditions.isCreator;
const allSteps = Step.query();
const userSteps = context.currentUser.$relatedQuery('steps');
const baseQuery = isCreator ? userSteps : allSteps;
const step = await baseQuery
.withGraphFetched('flow') .withGraphFetched('flow')
.findOne({ .findOne({
'steps.id': params.input.id, 'steps.id': params.input.id,