[WEB-2606] fix: project members should not be able to change other project member's roles

2025-08-07 19:59:33 +00:00 · 2024-10-09 14:48:08 +05:30
1 changed files with 4 additions and 2 deletions
--- a/web/core/components/project/settings/member-columns.tsx
+++ b/web/core/components/project/settings/member-columns.tsx
@@ -90,7 +90,7 @@ export const AccountTypeColumn: React.FC<AccountTypeProps> = observer((props) =>
  } = useForm();
  // store hooks
  const {
-    project: { updateMember },
+    project: { updateMember, getProjectMemberDetails },
    workspace: { getWorkspaceMemberDetails },
  } = useMember();
  const { data: currentUser } = useUser();
@@ -101,7 +101,9 @@ export const AccountTypeColumn: React.FC<AccountTypeProps> = observer((props) =>
  const isWorkspaceMember = [EUserPermissions.MEMBER].includes(
    Number(getWorkspaceMemberDetails(rowData.member.id)?.role) ?? EUserPermissions.GUEST
  );
-  const isRoleNonEditable = isCurrentUser || (isProjectAdminOrGuest && !isWorkspaceMember);
+  const isCurrentUserProjectMember = getProjectMemberDetails(currentUser?.id ?? "")?.role == EUserPermissions.MEMBER;
+  const isRoleNonEditable =
+    isCurrentUser || (isProjectAdminOrGuest && !isWorkspaceMember) || isCurrentUserProjectMember;

  const checkCurrentOptionWorkspaceRole = (value: string) => {
    const currentMemberWorkspaceRole = getWorkspaceMemberDetails(value)?.role as EUserPermissions | undefined;