Merge pull request #129 from zainfathoni/master

Fix view permission checking in order query
phillystafford · Dec 7, 2018 · 1364d73 · 1364d73
2 parents 44a7fbe + 85438f8
commit 1364d73
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/finished-application/backend/src/resolvers/Query.js b/finished-application/backend/src/resolvers/Query.js
@@ -44,7 +44,7 @@ const Query = {
     // 3. Check if the have the permissions to see this order
     const ownsOrder = order.user.id === ctx.request.userId;
     const hasPermissionToSeeOrder = ctx.request.user.permissions.includes('ADMIN');
-    if (!ownsOrder || !hasPermission) {
+    if (!ownsOrder && !hasPermissionToSeeOrder) {
       throw new Error('You cant see this buddd');
     }
     // 4. Return the order

diff --git a/stepped-solutions/53/backend/src/resolvers/Query.js b/stepped-solutions/53/backend/src/resolvers/Query.js
@@ -44,7 +44,7 @@ const Query = {
     // 3. Check if the have the permissions to see this order
     const ownsOrder = order.user.id === ctx.request.userId;
     const hasPermissionToSeeOrder = ctx.request.user.permissions.includes('ADMIN');
-    if (!ownsOrder || !hasPermission) {
+    if (!ownsOrder && !hasPermissionToSeeOrder) {
       throw new Error('You cant see this buddd');
     }
     // 4. Return the order

diff --git a/stepped-solutions/54/backend/src/resolvers/Query.js b/stepped-solutions/54/backend/src/resolvers/Query.js
@@ -44,7 +44,7 @@ const Query = {
     // 3. Check if the have the permissions to see this order
     const ownsOrder = order.user.id === ctx.request.userId;
     const hasPermissionToSeeOrder = ctx.request.user.permissions.includes('ADMIN');
-    if (!ownsOrder || !hasPermission) {
+    if (!ownsOrder && !hasPermissionToSeeOrder) {
       throw new Error('You cant see this buddd');
     }
     // 4. Return the order