fix: admin property can't be set if OAuth2 user email doesn't match actual user's email

This commit is contained in:
Elias Schneider
2025-02-28 13:32:31 +01:00
parent b6d1720fe6
commit 1159d972a8

View File

@@ -63,7 +63,7 @@ export class OAuthService {
}, },
}); });
if (oauthUser) { if (oauthUser) {
await this.updateIsAdmin(user); await this.updateIsAdmin(oauthUser.userId, user.isAdmin);
const updatedUser = await this.prisma.user.findFirst({ const updatedUser = await this.prisma.user.findFirst({
where: { where: {
id: oauthUser.userId, id: oauthUser.userId,
@@ -170,7 +170,7 @@ export class OAuthService {
userId: existingUser.id, userId: existingUser.id,
}, },
}); });
await this.updateIsAdmin(user); await this.updateIsAdmin(existingUser.id, user.isAdmin);
return this.auth.generateToken(existingUser, { idToken: user.idToken }); return this.auth.generateToken(existingUser, { idToken: user.idToken });
} }
@@ -196,14 +196,13 @@ export class OAuthService {
return result; return result;
} }
private async updateIsAdmin(user: OAuthSignInDto) { private async updateIsAdmin(userId: string, isAdmin?: boolean) {
if ("isAdmin" in user)
await this.prisma.user.update({ await this.prisma.user.update({
where: { where: {
email: user.email, id: userId,
}, },
data: { data: {
isAdmin: user.isAdmin, isAdmin: isAdmin === true,
}, },
}); });
} }