fix: enhance collaborator access check in DocumentSchema
- Updated the collaborator access check in the DocumentSchema to ensure that a user must have both writable and readable permissions to access a document. - Improved error handling by providing a more precise condition for user access, enhancing security and clarity in document collaboration.
This commit is contained in:
@@ -402,7 +402,7 @@ export class DocumentSchema extends PothosSchema {
|
|||||||
if (!document.isPublic) {
|
if (!document.isPublic) {
|
||||||
if (
|
if (
|
||||||
document.ownerId !== ctx.websocket?.me?.id &&
|
document.ownerId !== ctx.websocket?.me?.id &&
|
||||||
!document.collaborators.some((c) => c.userId === ctx.websocket?.me?.id && c.writable)
|
!document.collaborators.some((c) => c.userId === ctx.websocket?.me?.id && c.writable && c.readable)
|
||||||
)
|
)
|
||||||
throw new Error('User is not owner or collaborator of document')
|
throw new Error('User is not owner or collaborator of document')
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user