From 85438f81b90481f9d23fe8afae6b3263a6819391 Mon Sep 17 00:00:00 2001
From: Zain Fathoni <zain.fathoni@gmail.com>
Date: Sat, 8 Dec 2018 00:59:22 +0800
Subject: Fix view permission checking in order query

---
 finished-application/backend/src/resolvers/Query.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'finished-application/backend/src/resolvers')

diff --git a/finished-application/backend/src/resolvers/Query.js b/finished-application/backend/src/resolvers/Query.js
index 22a6414..3ee1118 100644
--- a/finished-application/backend/src/resolvers/Query.js
+++ b/finished-application/backend/src/resolvers/Query.js
@@ -44,7 +44,7 @@ const Query = {
     // 3. Check if the have the permissions to see this order
     const ownsOrder = order.user.id === ctx.request.userId;
     const hasPermissionToSeeOrder = ctx.request.user.permissions.includes('ADMIN');
-    if (!ownsOrder || !hasPermission) {
+    if (!ownsOrder && !hasPermissionToSeeOrder) {
       throw new Error('You cant see this buddd');
     }
     // 4. Return the order
-- 
cgit v1.3