fix: do not use auth when loading admin user (profile)

webiny · Jan 18, 2024 · 56afdd8 · 56afdd8
1 parent 03e8e42
commit 56afdd8
Showing 1 changed file with 17 additions and 13 deletions.
diff --git a/packages/api-admin-users/src/graphql/user.gql.ts b/packages/api-admin-users/src/graphql/user.gql.ts
@@ -70,8 +70,10 @@ export default (params: CreateUserGraphQlPluginsParams) => {
             resolvers: {
                 AdminUserIdentity: {
                     async profile(identity, _, context) {
-                        const adminUser = await context.adminUsers.getUser({
-                            where: { id: identity.id }
+                        const adminUser = await context.security.withoutAuthorization(async () => {
+                            return context.adminUsers.getUser({
+                                where: { id: identity.id }
+                            });
                         });
 
                         if (adminUser) {
@@ -82,17 +84,19 @@ export default (params: CreateUserGraphQlPluginsParams) => {
                         // a "parent" tenant user, so naturally, his user profile lives in his original tenant.
                         const tenant = context.tenancy.getCurrentTenant();
 
-                        return await context.adminUsers.getUser({
-                            where: {
-                                id: identity.id,
-                                /**
-                                 * TODO @ts-refactor @pavel
-                                 * What happens if tenant has no parent?
-                                 * Or is the getUser.where.tenant optional parameter? In that case, remove comments and make tenant param optional
-                                 */
-                                // @ts-ignore
-                                tenant: tenant.parent
-                            }
+                        return context.security.withoutAuthorization(async () => {
+                            return context.adminUsers.getUser({
+                                where: {
+                                    id: identity.id,
+                                    /**
+                                     * TODO @ts-refactor @pavel
+                                     * What happens if tenant has no parent?
+                                     * Or is the getUser.where.tenant optional parameter? In that case, remove comments and make tenant param optional
+                                     */
+                                    // @ts-ignore
+                                    tenant: tenant.parent
+                                }
+                            });
                         });
                     },
                     __isTypeOf(obj: SecurityIdentity) {