diff --git a/server/policies/userMembership.ts b/server/policies/userMembership.ts index 855cf49b6e..a50d30b54e 100644 --- a/server/policies/userMembership.ts +++ b/server/policies/userMembership.ts @@ -1,11 +1,10 @@ import { User, UserMembership } from "@server/models"; import { allow } from "./cancan"; -import { isOwner, or } from "./utils"; +import { and, isOwner, isTeamModel, or } from "./utils"; allow(User, ["update", "delete"], UserMembership, (actor, membership) => - or( - // - isOwner(actor, membership), - actor.isAdmin + and( + isTeamModel(actor, membership?.user), + or(isOwner(actor, membership), actor.isAdmin) ) ); diff --git a/server/routes/api/userMemberships/userMemberships.ts b/server/routes/api/userMemberships/userMemberships.ts index 48fefd33f1..0dc7ab2997 100644 --- a/server/routes/api/userMemberships/userMemberships.ts +++ b/server/routes/api/userMemberships/userMemberships.ts @@ -24,7 +24,7 @@ router.post( async (ctx: APIContext) => { const { user } = ctx.state.auth; - const memberships = await UserMembership.findAll({ + const memberships = await UserMembership.scope("withUser").findAll({ where: { userId: user.id, documentId: { @@ -72,9 +72,12 @@ router.post( const { transaction } = ctx.state; const { user } = ctx.state.auth; - const membership = await UserMembership.findByPk(id, { + const membership = await UserMembership.scope("withUser").findByPk(id, { transaction, - lock: transaction.LOCK.UPDATE, + lock: { + level: transaction.LOCK.UPDATE, + of: UserMembership, + }, rejectOnEmpty: true, }); authorize(user, "update", membership); diff --git a/shared/i18n/locales/en_US/translation.json b/shared/i18n/locales/en_US/translation.json index 8ced4ace20..3120211f05 100644 --- a/shared/i18n/locales/en_US/translation.json +++ b/shared/i18n/locales/en_US/translation.json @@ -89,6 +89,8 @@ "Search in document": "Search in document", "Print": "Print", "Print document": "Print document", + "Present": "Present", + "Present document": "Present document", "Templatize": "Templatize", "Create template": "Create template", "Open random document": "Open random document", @@ -836,6 +838,9 @@ "This document will be permanently deleted in <2> unless restored.": "This document will be permanently deleted in <2> unless restored.", "Deleted by {{userName}}": "Deleted by {{userName}}", "Observing {{ userName }}": "Observing {{ userName }}", + "Previous slide": "Previous slide", + "Next slide": "Next slide", + "Toggle fullscreen": "Toggle fullscreen", "Backlinks": "Backlinks", "This document is large which may affect performance": "This document is large which may affect performance", "Are you sure about that? Deleting the {{ documentTitle }} document will delete all of its history.": "Are you sure about that? Deleting the {{ documentTitle }} document will delete all of its history.",