mirror of
https://github.com/Luchexx/wacrm.git
synced 2026-11-02 09:19:51 +00:00
fix(templates): scope template picker to account, not user
The inbox/contact TemplatePicker fetched approved templates filtered by `user_id = current user`, so in a shared account a teammate only saw templates they personally created — others' approved templates were hidden, leaving them unable to send those templates. message_templates is account-owned and its RLS SELECT policy already scopes rows to account members (is_account_member, migration 017), so the user_id filter was both redundant and over-restrictive. Drop it and rely on RLS, matching the broadcast template picker. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
parent
30cc7a6ab2
commit
3110932d78
@ -104,10 +104,13 @@ export function TemplatePicker({
|
||||
return;
|
||||
}
|
||||
|
||||
// Scope by RLS (message_templates_select → is_account_member), NOT by
|
||||
// user_id. Templates are account-owned, so filtering on the caller's
|
||||
// user_id hid templates that a teammate created — leaving them unable
|
||||
// to send approved templates in a shared account.
|
||||
const { data, error } = await supabase
|
||||
.from("message_templates")
|
||||
.select("*")
|
||||
.eq("user_id", user.id)
|
||||
.eq("status", "APPROVED")
|
||||
.order("created_at", { ascending: false });
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user