mirror of
https://github.com/sourcebot-dev/sourcebot.git
synced 2025-12-12 04:15:30 +00:00
enforce permitted user check even when no where clause
This commit is contained in:
parent
0bd545359e
commit
b939d1e420
1 changed files with 20 additions and 20 deletions
|
|
@ -27,10 +27,11 @@ export const userScopedPrismaClientExtension = (userId?: string) => {
|
||||||
query: {
|
query: {
|
||||||
...(env.EXPERIMENT_EE_PERMISSION_SYNC_ENABLED === 'true' && hasEntitlement('permission-syncing') ? {
|
...(env.EXPERIMENT_EE_PERMISSION_SYNC_ENABLED === 'true' && hasEntitlement('permission-syncing') ? {
|
||||||
repo: {
|
repo: {
|
||||||
$allOperations({ args, query }) {
|
async $allOperations({ args, query }) {
|
||||||
if ('where' in args) {
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||||
args.where = {
|
const argsWithWhere = args as any;
|
||||||
...args.where,
|
argsWithWhere.where = {
|
||||||
|
...(argsWithWhere.where || {}),
|
||||||
OR: [
|
OR: [
|
||||||
// Only include repos that are permitted to the user
|
// Only include repos that are permitted to the user
|
||||||
...(userId ? [
|
...(userId ? [
|
||||||
|
|
@ -48,7 +49,6 @@ export const userScopedPrismaClientExtension = (userId?: string) => {
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
}
|
|
||||||
|
|
||||||
return query(args);
|
return query(args);
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue