Only members of organisations should be allowed to create events for them

[akshatgarg12]

Describe the bug
Any user can create events for any organisation

To Reproduce
Steps to reproduce the behavior:

1. create a new organisation
2. login with a diff account
3. use create-event mutation without joining the org

Expected behavior

User should only be able to create events in the organisation if they are a member of it.

Actual behavior
Anyone can create events.

Additional details
The logic in the /resolvers/event_mutations/createEvent.js is to be changed to deal with this.

[uzaxirr]

Hey, I would love to work on this issue!!

My Approach:

• I would create a boolean function inside createEvent.js which looks up in models/User.js if user is a part of or has created the organization. If yes the function returns true or else false
• if the above function returns true only then the rest of the code inside createEvent.js would execute or else an auth error would throw-up

[palisadoes]

@sumitra19jha Is this still an issue with the API?

[sumitra19jha]

Yes, this issue still persist. It hasn't been updated

[palisadoes]

@uzair-ali10 please proceed

[uzaxirr]

@palisadoes
Yea Sure, On it!

[uzaxirr]

@palisadoes
Please Close this issue it is resolved via #337