Fix missing authentication check for invite revocation (#1666)

* Fix missing authentication check for invite revocation

* Toast invite revocation error

api/resolvers/invite.js

@@ -1,7 +1,7 @@
 import { inviteSchema, validateSchema } from '@/lib/validate'
 import { msatsToSats } from '@/lib/format'
 import assertApiKeyNotPermitted from './apiKey'
-import { GqlAuthenticationError } from '@/lib/error'
+import { GqlAuthenticationError, GqlInputError } from '@/lib/error'
 
 export default {
   Query: {
@@ -46,10 +46,17 @@ export default {
         throw new GqlAuthenticationError()
       }
 
-      return await models.invite.update({
+      try {
-        where: { id },
+        return await models.invite.update({
-        data: { revoked: true }
+          where: { id, userId: me.id },
-      })
+          data: { revoked: true }
+        })
+      } catch (err) {
+        if (err.code === 'P2025') {
+          throw new GqlInputError('invite not found')
+        }
+        throw err
+      }
     }
   },
 

components/invite.js

@@ -2,6 +2,7 @@ import { CopyInput } from './form'
 import { gql, useMutation } from '@apollo/client'
 import { INVITE_FIELDS } from '@/fragments/invites'
 import styles from '@/styles/invites.module.css'
+import { useToast } from '@/components/toast'
 
 export default function Invite ({ invite, active }) {
   const [revokeInvite] = useMutation(
@@ -13,6 +14,7 @@ export default function Invite ({ invite, active }) {
         }
       }`
   )
+  const toaster = useToast()
 
   return (
     <div
@@ -33,7 +35,13 @@ export default function Invite ({ invite, active }) {
               <span> \ </span>
               <span
                 className={styles.revoke}
-                onClick={() => revokeInvite({ variables: { id: invite.id } })}
+                onClick={async () => {
+                  try {
+                    await revokeInvite({ variables: { id: invite.id } })
+                  } catch (err) {
+                    toaster.danger(err.message)
+                  }
+                }}
               >revoke
               </span>
             </>)