namenlos/three60
1
0
Fork 0
Code Issues 12 Pull requests Projects Releases Packages Wiki Activity Actions

fix broken permissions check for shared surveys

Browse source 
Closes #20
This commit is contained in:
Markus Brueckner 2025-02-17 09:04:24 +01:00
parent 76cf79158e
commit 457249c4e3
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/db/survey.ts
View file

@ -170,7 +170,14 @@ export async function addSkill(surveyId: number, title: string, description: str
/// Check whether a given user has at least the given access level to the given survey. This is based on a database query and doesn't need the survey object already to be loaded /// Check whether a given user has at least the given access level to the given survey. This is based on a database query and doesn't need the survey object already to be loaded
export async function hasAccess(surveyId: number, userId: number, accessLevel: AccessLevel): Promise<boolean> { export async function hasAccess(surveyId: number, userId: number, accessLevel: AccessLevel): Promise<boolean> {
const result = await db.select().from(surveyPermissionsTable).where(and(eq(surveyPermissionsTable.surveyId, surveyId), eq(surveyPermissionsTable.user, userId), gte(surveyPermissionsTable.access, accessLevel))); const result = await db.select().from(surveyPermissionsTable).where(
and(
eq(surveyPermissionsTable.surveyId, surveyId),
or(
eq(surveyPermissionsTable.user, userId),
isNull(surveyPermissionsTable.user)
),
gte(surveyPermissionsTable.access, accessLevel)));
return result.length > 0; return result.length > 0;
} }