fix: fixes authorization checks for update product server action

[pandeymangg]

What does this PR do?

Adds authorization checks in the update product server action allowing only owner, admin and editor to update a product

Fixes # (issue)

How should this be tested?

• Make the api call to update product service from a viewer or developer account
• It should fail

Checklist

Required

• Filled out the "How to test" section in this PR
• Read How we Code at Formbricks
• Self-reviewed my own code
• Commented on my code in hard-to-understand bits
• Ran pnpm build
• Checked for warnings, there are none
• Removed all console.logs
• Merged the latest changes from main onto my branch with git pull origin main
• My changes don't cause any responsiveness issues

Appreciated

• If a UI change was made: Added a screen recording or screenshots to this PR
• Updated the Formbricks Docs if changes were necessary

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

2 Ignored Deployments

Name	Status	Preview	Comments	Updated (UTC)
formbricks-cloud	⬜️ Ignored (Inspect)	Visit Preview		Mar 13, 2024 1:00pm
formbricks-com	⬜️ Ignored (Inspect)	Visit Preview		Mar 13, 2024 1:00pm

[github-actions]

Thank you for following the naming conventions for pull request titles! 🙏

[review-agent-prime]

apps/web/app/(app)/environments/[environmentId]/settings/product/actions.ts

Instead of making two separate calls to get the team and then the membership, you could create a new function that gets the membership by the environmentId and userId directly. This would reduce the number of database calls and improve the performance of the code.
Create Issue
See the diff
Checkout the fix

    const membership = await getMembershipByEnvironmentIdUserId(environmentId, session.user.id);

    if (!membership) {
      throw new AuthorizationError("Not authorized");
    }

    if (membership.role === "viewer" || membership.role === "developer") {
      throw new AuthorizationError("You are not allowed to update products.");
    }

git fetch origin && git checkout -b ReviewBot/Impro-f2yn762 origin/ReviewBot/Impro-f2yn762

Instead of using multiple if statements to check the role of the user, you could use a switch statement. This would make the code more readable and easier to maintain.
Create Issue
See the diff
Checkout the fix

    switch (membership.role) {
      case "viewer":
      case "developer":
        throw new AuthorizationError("You are not allowed to update products.");
      default:
        const updatedProduct = await updateProduct(productId, data);
        return updatedProduct;
    }

git fetch origin && git checkout -b ReviewBot/Impro-i10vsvd origin/ReviewBot/Impro-i10vsvd

[review-agent-prime]

Reducing the number of database calls by creating a new function that gets the membership by the environmentId and userId directly.

Suggested change

	const team = await getTeamByEnvironmentId(environmentId);
	const membership = team ? await getMembershipByUserIdTeamId(session.user.id, team.id) : null;
	if (!membership) {
	throw new AuthorizationError("Not authorized");
	}
	if (membership.role === "viewer" || membership.role === "developer") {
	throw new AuthorizationError("You are not allowed to update products.");
	}
	const membership = await getMembershipByEnvironmentIdUserId(environmentId, session.user.id);
	if (!membership) {
	throw new AuthorizationError("Not authorized");
	}
	if (membership.role === "viewer" || membership.role === "developer") {
	throw new AuthorizationError("You are not allowed to update products.");
	}

[review-agent-prime]

Replaced the multiple if statements with a switch statement for better readability and maintainability.

Suggested change

	if (membership.role === "viewer" || membership.role === "developer") {
	throw new AuthorizationError("You are not allowed to update products.");
	}
	const updatedProduct = await updateProduct(productId, data);
	return updatedProduct;
	switch (membership.role) {
	case "viewer":
	case "developer":
	throw new AuthorizationError("You are not allowed to update products.");
	default:
	const updatedProduct = await updateProduct(productId, data);
	return updatedProduct;
	}

[mattinannt]

@pandeymangg thanks for fixing this and the quick turnaround! 💪