diff --git a/src/controllers/01-branch-user-controller.ts b/src/controllers/01-branch-user-controller.ts index c1ad85e..7e92692 100644 --- a/src/controllers/01-branch-user-controller.ts +++ b/src/controllers/01-branch-user-controller.ts @@ -280,25 +280,12 @@ export class BranchUserController extends Controller { @Path() userId: string, ) { const branch = await prisma.branch.findUnique({ - include: { - user: { - where: { userId: req.user.sub }, - }, - }, + include: branchRelationPermInclude(req.user), where: { id: branchId }, }); - if ( - !globalAllow(req.user) && - branch?.createdByUserId !== req.user.sub && - !branch?.user.find((v) => v.userId === req.user.sub) - ) { - throw new HttpError( - HttpStatus.FORBIDDEN, - "You do not have permission to perform this action.", - "noPermission", - ); - } + await permissionCheck(req.user, branch); + await prisma.branchUser.deleteMany({ where: { branchId, userId }, });