fix(delete): check permission...

flowergardn · Dec 16, 2023 · 74a3c85 · 74a3c85
1 parent 8582ebe
commit 74a3c85
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/src/server/api/routers/cards.ts b/src/server/api/routers/cards.ts
@@ -134,6 +134,18 @@ export const cardRouter = createTRPCRouter({
       }),
     )
     .mutation(async ({ ctx, input }) => {
+      const card = await ctx.db.cards.findUnique({
+        where: {
+          id: input.cardId,
+          creatorId: ctx.userId,
+        },
+      });
+
+      if (!card)
+        throw new TRPCError({
+          code: "NOT_FOUND",
+        });
+
       return await ctx.db.cards.delete({
         where: {
           id: input.cardId,