feat(organization): add user membership verification for organization queries

- Implemented a check to verify if the user is a member of the organization before allowing access to organization data.
- Added error handling to return a FORBIDDEN response if the user is not a member.
This commit is contained in:
Mauricio Siu
2025-12-08 00:05:55 -06:00
parent e666cfb374
commit c42e859215

View File

@@ -80,7 +80,22 @@ export const organizationRouter = createTRPCRouter({
organizationId: z.string(),
}),
)
.query(async ({ input }) => {
.query(async ({ ctx, input }) => {
// Verify user is a member of this organization
const userMember = await db.query.member.findFirst({
where: and(
eq(member.organizationId, input.organizationId),
eq(member.userId, ctx.user.id),
),
});
if (!userMember) {
throw new TRPCError({
code: "FORBIDDEN",
message: "You are not a member of this organization",
});
}
return await db.query.organization.findFirst({
where: eq(organization.id, input.organizationId),
});