isaacs
04/18/2022, 5:56 PMprisma.create
? I'm looking for the equivalent of:
INSERT INTO membership(orgId, email, role)
SELECT orgId, @email as email, @role as role
FROM membership
WHERE orgId = @orgId
AND userId = @userId
AND (role = 'OWNER' OR (role = 'ADMIN' AND @role = 'USER'));
so you'd call it setting the userId
to the current user taking the action, and this would assert that it would only create if the user has permission to add new users at the requested role
(I know I can do prisma.findUnique
to get the membership role of the current user, and then do it in javascript, but i try to avoid TOCTOU as a general practice.)isaacs
04/18/2022, 8:50 PMNurul
04/20/2022, 10:08 AMisaacs
04/27/2022, 12:28 AM