refactor: improve document access validation in DocumentSchema
- Enhanced authorization checks in DocumentSchema to ensure users must either be the document owner or a writable collaborator. - Consolidated validation logic for better readability and maintainability, improving error handling for unauthorized access.
This commit is contained in:
@@ -294,11 +294,12 @@ export class DocumentSchema extends PothosSchema {
|
||||
})
|
||||
if (!document) throw new Error('Document not found')
|
||||
if (
|
||||
!document.isPublic ||
|
||||
!document.collaborators.some((c) => c.userId === ctx.http?.me?.id && c.writable) ||
|
||||
!document.isPublic &&
|
||||
!document.collaborators.some((c) => c.userId === ctx.http?.me?.id && c.writable) &&
|
||||
document.ownerId !== ctx.http?.me?.id
|
||||
)
|
||||
) {
|
||||
throw new Error('User is not owner or collaborator of document')
|
||||
}
|
||||
return await this.prisma.document.update({
|
||||
...query,
|
||||
where: { id: args.documentId },
|
||||
|
||||
Reference in New Issue
Block a user