8000 fix: Allow organization admins to access subteams without direct membership by joeauyeung · Pull Request #24305 · calcom/cal.com · GitHub
[go: up one dir, main page]
Skip to content

fix: Allow organization admins to access subteams without direct membership #24305

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

fix: Allow organization admins to access subteams without direct membership #24305

wants to merge 1 commit into from
+87 −15

Conversation

joeauyeung
Copy link
Contributor

What does this PR do?

This PR fixes a permission inheritance issue where organization admins could not access subteams despite having admin privileges at the organization level.

Problem: The get.handler.ts only checked for direct team membership using MembershipRepository.findUniqueByUserIdAndTeamId(), which prevented org admins from accessing subteams they weren't explicitly added to as members.

Solution:

  • Added a fallback check using UserRepository.isAdminOfTeamOrParentOrg() when direct membership is not found
  • Organization admins now receive ADMIN role access to subteams without requiring direct membership
  • Updated test suite with comprehensive coverage and improved type safety

Key Changes:

  • Modified permission checking logic in packages/trpc/server/routers/viewer/teams/get.handler.ts
  • Added new test case for org admin subteam access
  • Replaced as any type casts with proper vi.mocked() usage

Mandatory Tasks (DO NOT REMOVE)

  • I have self-reviewed the code (A decent size PR without self-review might be rejected).
  • I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox. N/A - internal permission logic change
  • I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

Test Setup:

  1. Create an organization with subteams
  2. Add a user as organization admin (not direct member of subteam)
  3. Test accessing subteam settings/management as the org admin

Expected Behavior:

  • Organization admin should be able to access subteam without being directly added as member
  • Admin should have full permissions on the subteam (role: "ADMIN", accepted: true)

Verification:

  • Unit tests pass: TZ=UTC yarn test packages/trpc/server/routers/viewer/teams/get.handler.test.ts
  • Type checks pass: yarn type-check:ci --force

Human Review Checklist

⚠️ Critical Areas to Review:

  • Permission escalation: Verify that giving org admins full ADMIN role on subteams is the intended behavior
  • UI integration: Test actual subteam access through the Cal.com interface to ensure it works end-to-end
  • UserRepository method: Confirm isAdminOfTeamOrParentOrg() works correctly for your organization structure
  • Security implications: Check if this change conflicts with other permission systems in the codebase
  • Edge cases: Consider nested organizations, disabled teams, and other complex scenarios

Requested by: @joeauyeung
Link to Devin run: https://app.devin.ai/sessions/b23656890ad8435fb46ee43d14c3ebf1

@devin-ai-integration @joeauyeung
fix: Allow organization admins to access subteams without direct memb…
a3684f4 
…ership

This change fixes the permission inheritance mechanism so that organization
admins can access and manage subteams even when they are not direct members.

Previously, the get.handler.ts only checked for direct team membership using
MembershipRepository.findUniqueByUserIdAndTeamId(), which prevented org admins
from accessing subteams they weren't explicitly added to.

Changes:
- Modified get.handler.ts to check UserRepository.isAdminOfTeamOrParentOrg()
  when direct membership is not found
- Organization admins now receive ADMIN role for subteams they can access
- Added comprehensive test coverage for the new permission checking logic
- Updated existing test to verify org admin check is performed
- Fixed eslint warnings by using vi.mocked() instead of 'as any' type casts

This ensures consistent permission inheritance across the organization hierarchy.

Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>
@devin-ai-integration Devin.ai Integration
Copy link
Contributor

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR that start with 'DevinAI' or '@devin'.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment and CI monitoring

@keithwillcode keithwillcode added core area: core, team members only enterprise area: enterprise, audit log, organisation, SAML, SSO labels Oct 6, 2025
@coderabbitai coderabbitai
Copy link
Contributor
coderabbitai bot commented Oct 6, 2025

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch devin/org-admin-subteam-permissions-1759780678

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
core area: core, team members only enterprise area: enterprise, audit log, organisation, SAML, SSO size/L
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@joeauyeung @keithwillcode
0