diff --git a/apps/api/pages/api/event-types/[id]/_patch.ts b/apps/api/pages/api/event-types/[id]/_patch.ts index b341ef9253..2370bf88fa 100644 --- a/apps/api/pages/api/event-types/[id]/_patch.ts +++ b/apps/api/pages/api/event-types/[id]/_patch.ts @@ -213,16 +213,19 @@ export async function patchHandler(req: NextApiRequest) { ...parsedBody } = schemaEventTypeEditBodyParams.parse(body); - // validate children ownership + const validatedChildren = + parsedBody.teamId && parsedChildren + ? parsedChildren.filter((child) => isUserMemberOfTeam(parsedBody.teamId, child.userId)) + : []; const data: Prisma.EventTypeUpdateArgs["data"] = { ...parsedBody, bookingLimits: bookingLimits === null ? Prisma.DbNull : bookingLimits, durationLimits: durationLimits === null ? Prisma.DbNull : durationLimits, - ...(parsedChildren + ...(validatedChildren ? { children: { - connect: parsedChildren.map((child) => ({ id: child.id })), + connect: validatedChildren.map((child) => ({ id: child.id })), }, } : {}), diff --git a/apps/api/pages/api/event-types/_post.ts b/apps/api/pages/api/event-types/_post.ts index e458f94307..d290f6a3ef 100644 --- a/apps/api/pages/api/event-types/_post.ts +++ b/apps/api/pages/api/event-types/_post.ts @@ -273,7 +273,6 @@ async function postHandler(req: NextApiRequest) { ...parsedBody } = schemaEventTypeCreateBodyParams.parse(body || {}); - // validate that these child event type owners are members of parent const validatedChildren = parsedBody.teamId && parsedChildren ? parsedChildren.filter((child) => isUserMemberOfTeam(parsedBody.teamId, child.userId))