fix(assets): migrate tenant only if user is admin

kuzzleio · Sep 28, 2023 · c24f942 · c24f942
1 parent 4e4eed9
commit c24f942
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/lib/modules/asset/AssetService.ts b/lib/modules/asset/AssetService.ts
@@ -283,6 +283,12 @@ export class AssetService {
     return lock(`engine:${engineId}:${newEngineId}`, async () => {
       const recovery = new RecoveryQueue();
 
+      if (user.profileIds.includes("admin")) {
+        throw new BadRequestError(
+          `User ${user._id} is not authorized to migrate assets`
+        );
+      }
+
       try {
         // check if tenant destination of the the same group
         const engine = await this.getEngine(engineId);