Merge pull request #129 from zainfathoni/mastermaster

Fix view permission checking in order query

1 files changed, 1 insertions, 1 deletions

diff --git a/finished-application/backend/src/resolvers/Query.js b/finished-application/backend/src/resolvers/Query.js
index 22a6414..3ee1118 100644
--- a/finished-application/backend/src/resolvers/Query.js
+++ b/finished-application/backend/src/resolvers/Query.js
@@ -44,7 +44,7 @@ const Query = {
     // 3. Check if the have the permissions to see this order
     const ownsOrder = order.user.id === ctx.request.userId;
     const hasPermissionToSeeOrder = ctx.request.user.permissions.includes('ADMIN');
-    if (!ownsOrder || !hasPermission) {
+    if (!ownsOrder && !hasPermissionToSeeOrder) {
       throw new Error('You cant see this buddd');
     }
     // 4. Return the order