fix(vacation): scope preview requests to owned resources

2026-03-30 12:07:26 +02:00
parent 6a6e98b5f7
commit c7434c968e
4 changed files with 180 additions and 0 deletions
@@ -266,6 +266,8 @@ export const vacationRouter = createTRPCRouter({
  previewRequest: protectedProcedure
    .input(PreviewVacationRequestSchema)
    .query(async ({ ctx, input }) => {
+      await assertCanReadVacationResource(ctx, input.resourceId);
+
      const holidayContext = await loadResourceHolidayContext(
        ctx.db,
        input.resourceId,