fix: mask recipient tokens for non-owners

2024-01-20 01:14:34 +00:00
parent 204388888d
commit 9c1e1f50a8
5 changed files with 68 additions and 10 deletions
--- a/packages/lib/server-only/document/update-document.ts
+++ b/packages/lib/server-only/document/update-document.ts
@@ -5,14 +5,16 @@ import type { Prisma } from '@prisma/client';
 import { prisma } from '@documenso/prisma';

 export type UpdateDocumentOptions = {
-  documentId: number;
  data: Prisma.DocumentUpdateInput;
+  userId: number;
+  documentId: number;
 };

-export const updateDocument = async ({ documentId, data }: UpdateDocumentOptions) => {
+export const updateDocument = async ({ documentId, userId, data }: UpdateDocumentOptions) => {
  return await prisma.document.update({
    where: {
      id: documentId,
+      userId,
    },
    data: {
      ...data,