groot/automatisch
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(mutations/update-flow-status): correct permission check

Browse Source
This commit is contained in:
Ali BARIN
2023-08-22 14:09:28 +00:00
parent 525b2baf06
commit b9352ccc06
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
packages/backend/src/graphql/mutations/update-flow-status.ts
View File

@@ -1,3 +1,4 @@
import Flow from '../../models/flow';
import Context from '../../types/express/context'; import Context from '../../types/express/context';
import flowQueue from '../../queues/flow'; import flowQueue from '../../queues/flow';
import { REMOVE_AFTER_30_DAYS_OR_150_JOBS, REMOVE_AFTER_7_DAYS_OR_50_JOBS } from '../../helpers/remove-job-configuration'; import { REMOVE_AFTER_30_DAYS_OR_150_JOBS, REMOVE_AFTER_7_DAYS_OR_50_JOBS } from '../../helpers/remove-job-configuration';
@@ -18,10 +19,14 @@ const updateFlowStatus = async (
params: Params, params: Params,
context: Context context: Context
) => { ) => {
context.currentUser.can('publish', 'Flow'); const conditions = context.currentUser.can('publish', 'Flow');
const isCreator = conditions.isCreator;
const allFlows = Flow.query();
const userFlows = context.currentUser.$relatedQuery('flows');
const baseQuery = isCreator ? userFlows : allFlows;
let flow = await context.currentUser let flow = await baseQuery
.$relatedQuery('flows') .clone()
.findOne({ .findOne({
id: params.input.id, id: params.input.id,
}) })