Fix removal of user leaking permissions to public user (#647)

hpi-swa-lab · Aug 22, 2024 · 329b01e · 329b01e
1 parent 8139bd5
commit 329b01e
Showing 1 changed file with 13 additions and 15 deletions.
diff --git a/projects/bp-strapi/src/api/parameterized-permission/services/custom-update.ts b/projects/bp-strapi/src/api/parameterized-permission/services/custom-update.ts
@@ -198,12 +198,6 @@ export const removeUser = async (id: string) => {
     return;
   }
 
-  await userQuery.delete({
-    where: {
-      id,
-    },
-  });
-
   const permissionQuery = strapi.db.query('api::parameterized-permission.parameterized-permission');
   // deleteMany currently doesn't support relational filters:
   // https://github.com/strapi/strapi/issues/11998
@@ -214,15 +208,19 @@ export const removeUser = async (id: string) => {
       },
     },
   });
-  await Promise.all(
-    permissionsToDelete.map(permission => {
-      permissionQuery.delete({
-        where: {
-          id: permission.id,
-        },
-      });
-    })
-  );
+  await permissionQuery.delete({
+    where: {
+      id: {
+        $in: permissionsToDelete.map(permission => permission.id),
+      },
+    },
+  });
+
+  await userQuery.delete({
+    where: {
+      id,
+    },
+  });
 
   return 1;
 };