NoMongo (fix): allow all organization admins to block users

src/graphql/types/Mutation/blockUser.ts

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { blockedUsersTable } from "~/src/drizzle/tables/blockedUsers";
 import { builder } from "~/src/graphql/builder";
 import { TalawaGraphQLError } from "~/src/utilities/TalawaGraphQLError";
+import { assertOrganizationAdmin } from "~/src/utilities/authorization";
 
 const mutationBlockUserArgumentsSchema = z.object({
 	organizationId: z.string().min(1, "Organization ID is required."),
@@ -44,45 +45,29 @@ builder.mutationField("blockUser", (t) =>
 
 			const currentUserId = ctx.currentClient.user.id;
 
-			const [
-				organization,
-				targetUser,
-				currentUserMembership,
-				targetUserMembership,
-				existingBlock,
-			] = await Promise.all([
-				ctx.drizzleClient.query.organizationsTable.findFirst({
-					where: (fields, operators) =>
-						operators.eq(fields.id, parsedArgs.organizationId),
-				}),
+			const [currentUser, existingOrganization] = await Promise.all([
 				ctx.drizzleClient.query.usersTable.findFirst({
-					where: (fields, operators) =>
-						operators.eq(fields.id, parsedArgs.userId),
-				}),
-				ctx.drizzleClient.query.organizationMembershipsTable.findFirst({
-					where: (fields, operators) =>
-						operators.and(
-							operators.eq(fields.memberId, currentUserId),
-							operators.eq(fields.organizationId, parsedArgs.organizationId),
-						),
-				}),
-				ctx.drizzleClient.query.organizationMembershipsTable.findFirst({
-					where: (fields, operators) =>
-						operators.and(
-							operators.eq(fields.memberId, parsedArgs.userId),
-							operators.eq(fields.organizationId, parsedArgs.organizationId),
-						),
+					columns: {
+						role: true,
+					},
+					where: (fields, operators) => operators.eq(fields.id, currentUserId),
 				}),
-				ctx.drizzleClient.query.blockedUsersTable.findFirst({
+				ctx.drizzleClient.query.organizationsTable.findFirst({
+					with: {
+						membershipsWhereOrganization: {
+							columns: {
+								role: true,
+							},
+							where: (fields, operators) =>
+								operators.eq(fields.memberId, currentUserId),
+						},
+					},
 					where: (fields, operators) =>
-						operators.and(
-							operators.eq(fields.userId, parsedArgs.userId),
-							operators.eq(fields.organizationId, parsedArgs.organizationId),
-						),
+						operators.eq(fields.id, parsedArgs.organizationId),
 				}),
 			]);
 
-			if (!organization) {
+			if (!existingOrganization) {
 				throw new TalawaGraphQLError({
 					extensions: {
 						code: "arguments_associated_resources_not_found",
@@ -95,6 +80,41 @@ builder.mutationField("blockUser", (t) =>
 				});
 			}
 
+			const currentUserOrganizationMembership =
+				existingOrganization.membershipsWhereOrganization[0];
+
+			assertOrganizationAdmin(
+				currentUser,
+				currentUserOrganizationMembership,
+				"You must be an admin of this organization to block users.",
+			);
+
+			const [targetUser, targetUserMembership, existingBlock] =
+				await Promise.all([
+					ctx.drizzleClient.query.usersTable.findFirst({
+						columns: {
+							id: true,
+							role: true,
+						},
+						where: (fields, operators) =>
+							operators.eq(fields.id, parsedArgs.userId),
+					}),
+					ctx.drizzleClient.query.organizationMembershipsTable.findFirst({
+						where: (fields, operators) =>
+							operators.and(
+								operators.eq(fields.memberId, parsedArgs.userId),
+								operators.eq(fields.organizationId, parsedArgs.organizationId),
+							),
+					}),
+					ctx.drizzleClient.query.blockedUsersTable.findFirst({
+						where: (fields, operators) =>
+							operators.and(
+								operators.eq(fields.userId, parsedArgs.userId),
+								operators.eq(fields.organizationId, parsedArgs.organizationId),
+							),
+					}),
+				]);
+
 			if (!targetUser) {
 				throw new TalawaGraphQLError({
 					extensions: {
@@ -108,19 +128,6 @@ builder.mutationField("blockUser", (t) =>
 				});
 			}
 
-			if (
-				!currentUserMembership ||
-				currentUserMembership.role !== "administrator"
-			) {
-				throw new TalawaGraphQLError({
-					extensions: {
-						code: "unauthorized_action",
-						message:
-							"You must be an admin of this organization to block users.",
-					},
-				});
-			}
-
 			if (existingBlock) {
 				throw new TalawaGraphQLError({
 					extensions: {

src/graphql/types/Mutation/unblockUser.ts

@@ -3,6 +3,7 @@
 import { blockedUsersTable } from "~/src/drizzle/tables/blockedUsers";
 import { builder } from "~/src/graphql/builder";
 import { TalawaGraphQLError } from "~/src/utilities/TalawaGraphQLError";
+import { assertOrganizationAdmin } from "~/src/utilities/authorization";
 
 const mutationUnblockUserArgumentsSchema = z.object({
 	organizationId: z.string().min(1, "Organization ID is required."),
@@ -45,33 +46,37 @@
 
 			const currentUserId = ctx.currentClient.user.id;
 
-			const [organization, targetUser, currentUserMembership, existingBlock] =
-				await Promise.all([
-					ctx.drizzleClient.query.organizationsTable.findFirst({
-						where: (fields, operators) =>
-							operators.eq(fields.id, parsedArgs.organizationId),
-					}),
-					ctx.drizzleClient.query.usersTable.findFirst({
-						where: (fields, operators) =>
-							operators.eq(fields.id, parsedArgs.userId),
-					}),
-					ctx.drizzleClient.query.organizationMembershipsTable.findFirst({
-						where: (fields, operators) =>
-							operators.and(
+			const [currentUser, existingOrganization] = await Promise.all([
+				ctx.drizzleClient.query.usersTable.findFirst({
+					columns: {
+						role: true,
+					},
+					where: (fields, operators) => operators.eq(fields.id, currentUserId),
+				}),
+				ctx.drizzleClient.query.organizationsTable.findFirst({
+					with: {
+						membershipsWhereOrganization: {
+							columns: {
+								role: true,
+							},
+							where: (fields, operators) =>
 								operators.eq(fields.memberId, currentUserId),
-								operators.eq(fields.organizationId, parsedArgs.organizationId),
-							),
-					}),
-					ctx.drizzleClient.query.blockedUsersTable.findFirst({
-						where: (fields, operators) =>
-							operators.and(
-								operators.eq(fields.userId, parsedArgs.userId),
-								operators.eq(fields.organizationId, parsedArgs.organizationId),
-							),
-					}),
-				]);
+						},
+					},
+					where: (fields, operators) =>
+						operators.eq(fields.id, parsedArgs.organizationId),
+				}),
+			]);
+
+			if (currentUser === undefined) {
+				throw new TalawaGraphQLError({
+					extensions: {
+						code: "unauthenticated",
+					},
+				});
+			}
 
-			if (!organization) {
+			if (existingOrganization === undefined) {
 				throw new TalawaGraphQLError({
 					extensions: {
 						code: "arguments_associated_resources_not_found",
@@ -84,6 +89,29 @@
 				});
 			}
 
+			const currentUserOrganizationMembership =
+				existingOrganization.membershipsWhereOrganization[0];
+
+			assertOrganizationAdmin(
+				currentUser,
+				currentUserOrganizationMembership,
+				"You must be an admin of this organization to unblock users.",
+			);
+
+			const [targetUser, existingBlock] = await Promise.all([
+				ctx.drizzleClient.query.usersTable.findFirst({
+					where: (fields, operators) =>
+						operators.eq(fields.id, parsedArgs.userId),
+				}),
+				ctx.drizzleClient.query.blockedUsersTable.findFirst({
+					where: (fields, operators) =>
+						operators.and(
+							operators.eq(fields.userId, parsedArgs.userId),
+							operators.eq(fields.organizationId, parsedArgs.organizationId),
+						),
+				}),
+			]);
+
 			if (!targetUser) {
 				throw new TalawaGraphQLError({
 					extensions: {
@@ -97,19 +125,6 @@
 				});
 			}
 
-			if (
-				!currentUserMembership ||
-				currentUserMembership.role !== "administrator"
-			) {
-				throw new TalawaGraphQLError({
-					extensions: {
-						code: "unauthorized_action",
-						message:
-							"You must be an admin of this organization to unblock users.",
-					},
-				});
-			}
-
 			if (!existingBlock) {
 				throw new TalawaGraphQLError({
 					extensions: {

src/utilities/authorization.ts

@@ -0,0 +1,23 @@
+import { TalawaGraphQLError } from "./TalawaGraphQLError";
+
+interface HasRole {
+	role?: string | null;
+}
+
+export const assertOrganizationAdmin = (
+	currentUser: HasRole | undefined,
+	membership: HasRole | undefined,
+	errorMessage: string,
+): void => {
+	if (
+		currentUser?.role !== "administrator" &&
+		membership?.role !== "administrator"
+	) {
+		throw new TalawaGraphQLError({
+			extensions: {
+				code: "unauthorized_action",
+				message: errorMessage,
+			},
+		});
+	}
+};