fix: locked users admin list and bypass query (calcom#17902)

Tiamat-Tech · Nov 28, 2024 · 249bcac · 249bcac
1 parent f2efd6d
commit 249bcac
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 6 deletions.
diff --git a/packages/prisma/extensions/exclude-locked-users.ts b/packages/prisma/extensions/exclude-locked-users.ts
@@ -25,6 +25,14 @@ export function excludeLockedUsersExtension() {
   });
 }
 
+function safeJSONStringify(x: any) {
+  try {
+    return JSON.stringify(x);
+  } catch {
+    return "";
+  }
+}
+
 async function excludeLockedUsers(
   args:
     | Prisma.UserFindUniqueArgs<InternalArgs & DefaultArgs>
@@ -35,8 +43,10 @@ async function excludeLockedUsers(
   query: <T>(args: T) => Promise<unknown>
 ) {
   args.where = args.where || {};
+  const whereString = safeJSONStringify(args.where);
+  const shouldIncludeLocked = whereString.includes('"locked":');
   // Unless explicitly specified, we exclude locked users
-  if (args.where.locked === undefined) {
+  if (!shouldIncludeLocked) {
     args.where.locked = false;
   }
   return query(args);

diff --git a/packages/trpc/server/routers/viewer/admin/listPaginated.handler.ts b/packages/trpc/server/routers/viewer/admin/listPaginated.handler.ts
@@ -17,9 +17,12 @@ const listPaginatedHandler = async ({ input }: GetOptions) => {
   const getTotalUsers = await prisma.user.count();
 
   let searchFilters: Prisma.UserWhereInput = {};
+  const bothLockedAndUnlockedWhere = { OR: [{ locked: false }, { locked: true }] };
 
   if (searchTerm) {
     searchFilters = {
+      // To bypass the excludeLockedUsersExtension
+      AND: bothLockedAndUnlockedWhere,
       OR: [
         {
           email: {
@@ -33,16 +36,15 @@ const listPaginatedHandler = async ({ input }: GetOptions) => {
         },
       ],
     };
+  } else {
+    // To bypass the excludeLockedUsersExtension
+    searchFilters = bothLockedAndUnlockedWhere;
   }
 
   const users = await prisma.user.findMany({
     cursor: cursor ? { id: cursor } : undefined,
     take: limit + 1, // We take +1 as itll be used for the next cursor
-    where: {
-      ...searchFilters,
-      // To bypass the excludeLockedUsersExtension
-      OR: [{ locked: false }, { locked: true }],
-    },
+    where: searchFilters,
     orderBy: {
       id: "asc",
     },