Update authorization check on removing members from team or from orga…

…nization Allow the acting user to decline team or organization invitations. Allow the acting user to leave team or organization.
raster-foundry · Dec 5, 2018 · 3820f0c · 3820f0c
1 parent 1d118f0
commit 3820f0c
Showing 1 changed file with 20 additions and 2 deletions.
diff --git a/app-backend/api/src/main/scala/platform/Routes.scala b/app-backend/api/src/main/scala/platform/Routes.scala
@@ -492,7 +492,16 @@ trait PlatformRoutes
                                  orgId: UUID,
                                  userId: String): Route = authenticate { user =>
     authorizeAsync {
-      OrganizationDao.userIsAdmin(user, orgId).transact(xa).unsafeToFuture
+      val authCheck = (
+        OrganizationDao.userIsAdmin(user, orgId),
+        (userId == user.id).pure[ConnectionIO]
+      ).tupled.map(
+        {
+          case (true, _) | (_, true) => true
+          case _                     => false
+        }
+      )
+      authCheck.transact(xa).unsafeToFuture
     } {
       complete {
         OrganizationDao
@@ -647,7 +656,16 @@ trait PlatformRoutes
                          teamId: UUID,
                          userId: String): Route = authenticate { user =>
     authorizeAsync {
-      TeamDao.userIsAdmin(user, teamId).transact(xa).unsafeToFuture
+      val authCheck = (
+        TeamDao.userIsAdmin(user, teamId),
+        (userId == user.id).pure[ConnectionIO]
+      ).tupled.map(
+        {
+          case (true, _) | (_, true) => true
+          case _                     => false
+        }
+      )
+      authCheck.transact(xa).unsafeToFuture
     } {
       complete {
         TeamDao