LaLeV/wacrm
1
0
Fork 0
mirror of https://github.com/Luchexx/wacrm.git synced 2026-11-02 09:19:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(templates): scope template picker to account, not user

Browse Source 
The inbox/contact TemplatePicker fetched approved templates filtered by
`user_id = current user`, so in a shared account a teammate only saw
templates they personally created — others' approved templates were
hidden, leaving them unable to send those templates.

message_templates is account-owned and its RLS SELECT policy already
scopes rows to account members (is_account_member, migration 017), so
the user_id filter was both redundant and over-restrictive. Drop it and
rely on RLS, matching the broadcast template picker.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Arnas Donauskas 2026-06-29 17:33:41 +03:00
parent 30cc7a6ab2
commit 3110932d78
No known key found for this signature in database
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/components/inbox/template-picker.tsx
View File

@ -104,10 +104,13 @@ export function TemplatePicker({
return; return;
} }
// Scope by RLS (message_templates_select → is_account_member), NOT by
// user_id. Templates are account-owned, so filtering on the caller's
// user_id hid templates that a teammate created — leaving them unable
// to send approved templates in a shared account.
const { data, error } = await supabase const { data, error } = await supabase
.from("message_templates") .from("message_templates")
.select("*") .select("*")
.eq("user_id", user.id)
.eq("status", "APPROVED") .eq("status", "APPROVED")
.order("created_at", { ascending: false }); .order("created_at", { ascending: false });