fix: Add route guard for /:team/members (#3151)

theopensystemslab · May 15, 2024 · 6193731 · 6193731
1 parent a4d0cd6
commit 6193731
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/editor.planx.uk/src/routes/teamMembers.tsx b/editor.planx.uk/src/routes/teamMembers.tsx
@@ -1,7 +1,7 @@
 import { Role, User } from "@opensystemslab/planx-core/types";
 import gql from "graphql-tag";
 import { groupBy } from "lodash";
-import { compose, mount, route, withData } from "navi";
+import { NotFoundError, compose, mount, route, withData } from "navi";
 import {
   TeamMember,
   TeamMembers,
@@ -22,7 +22,13 @@ const teamMembersRoutes = compose(
   })),
 
   mount({
-    "/": route(async () => {
+    "/": route(async (req) => {
+      const isAuthorised = useStore.getState().canUserEditTeam(req.params.team);
+      if (!isAuthorised)
+        throw new NotFoundError(
+          `User does not have access to ${req.originalUrl}`,
+        );
+
       const teamSlug = useStore.getState().teamSlug;
 
       const {