wip

packages/trpc/src/routers/dashboard.ts

@@ -1,9 +1,16 @@
 import { PrismaError } from 'prisma-error-enum';
 import { z } from 'zod';
 
-import { db, getDashboardsByProjectId, getId } from '@openpanel/db';
+import {
+  db,
+  getDashboardsByProjectId,
+  getId,
+  getProjectById,
+} from '@openpanel/db';
 import type { Prisma } from '@openpanel/db';
 
+import { getProjectAccess } from '../access';
+import { TRPCAccessError, TRPCNotFoundError } from '../errors';
 import { createTRPCRouter, protectedProcedure } from '../trpc';
 
 export const dashboardRouter = createTRPCRouter({
@@ -13,7 +20,7 @@ export const dashboardRouter = createTRPCRouter({
         projectId: z.string(),
       })
     )
-    .query(async ({ input }) => {
+    .query(({ input }) => {
       return getDashboardsByProjectId(input.projectId);
     }),
   create: protectedProcedure
@@ -21,17 +28,31 @@ export const dashboardRouter = createTRPCRouter({
       z.object({
         name: z.string(),
         projectId: z.string(),
-        organizationSlug: z.string(),
       })
     )
-    .mutation(async ({ input: { organizationSlug, projectId, name } }) => {
+    .mutation(async ({ input, ctx }) => {
+      const access = await getProjectAccess({
+        projectId: input.projectId,
+        userId: ctx.session.userId,
+      });
+
+      if (!access) {
+        throw TRPCAccessError('You do not have access to this project');
+      }
+
+      const project = await getProjectById(input.projectId);
+
+      if (!project) {
+        throw TRPCNotFoundError('Project not found');
+      }
+
       return db.dashboard.create({
         data: {
-          id: await getId('dashboard', name),
-          projectId: projectId,
-          organizationSlug: organizationSlug,
-          organizationId: organizationSlug,
-          name,
+          id: await getId('dashboard', input.name),
+          projectId: input.projectId,
+          organizationSlug: project.organizationId!,
+          organizationId: project.organizationId,
+          name: input.name,
         },
       });
     }),
@@ -42,7 +63,22 @@ export const dashboardRouter = createTRPCRouter({
         name: z.string(),
       })
     )
-    .mutation(({ input }) => {
+    .mutation(async ({ input, ctx }) => {
+      const dashboard = await db.dashboard.findUniqueOrThrow({
+        where: {
+          id: input.id,
+        },
+      });
+
+      const access = await getProjectAccess({
+        projectId: dashboard.projectId,
+        userId: ctx.session.userId,
+      });
+
+      if (!access) {
+        throw TRPCAccessError('You do not have access to this dashboard');
+      }
+
       return db.dashboard.update({
         where: {
           id: input.id,
@@ -59,18 +95,33 @@ export const dashboardRouter = createTRPCRouter({
         forceDelete: z.boolean().optional(),
       })
     )
-    .mutation(async ({ input: { id, forceDelete } }) => {
+    .mutation(async ({ input, ctx }) => {
+      const dashboard = await db.dashboard.findUniqueOrThrow({
+        where: {
+          id: input.id,
+        },
+      });
+
+      const access = await getProjectAccess({
+        projectId: dashboard.projectId,
+        userId: ctx.session.userId,
+      });
+
+      if (!access) {
+        throw TRPCAccessError('You do not have access to this dashboard');
+      }
+
       try {
-        if (forceDelete) {
+        if (input.forceDelete) {
           await db.report.deleteMany({
             where: {
-              dashboardId: id,
+              dashboardId: input.id,
             },
           });
         }
         await db.dashboard.delete({
           where: {
-            id,
+            id: input.id,
           },
         });
       } catch (e) {