Skip to content

Commit c42e859

Browse files
committed
feat(organization): add user membership verification for organization queries
- Implemented a check to verify if the user is a member of the organization before allowing access to organization data. - Added error handling to return a FORBIDDEN response if the user is not a member.
1 parent e666cfb commit c42e859

File tree

1 file changed

+16
-1
lines changed

1 file changed

+16
-1
lines changed

apps/dokploy/server/api/routers/organization.ts

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,22 @@ export const organizationRouter = createTRPCRouter({
8080
organizationId: z.string(),
8181
}),
8282
)
83-
.query(async ({ input }) => {
83+
.query(async ({ ctx, input }) => {
84+
// Verify user is a member of this organization
85+
const userMember = await db.query.member.findFirst({
86+
where: and(
87+
eq(member.organizationId, input.organizationId),
88+
eq(member.userId, ctx.user.id),
89+
),
90+
});
91+
92+
if (!userMember) {
93+
throw new TRPCError({
94+
code: "FORBIDDEN",
95+
message: "You are not a member of this organization",
96+
});
97+
}
98+
8499
return await db.query.organization.findFirst({
85100
where: eq(organization.id, input.organizationId),
86101
});

0 commit comments

Comments
 (0)