diff --git a/packages/trpc/server/routers/viewer/bookings/get.handler.ts b/packages/trpc/server/routers/viewer/bookings/get.handler.ts index 34c5bbeb32977d..8974e1183ab9b7 100644 --- a/packages/trpc/server/routers/viewer/bookings/get.handler.ts +++ b/packages/trpc/server/routers/viewer/bookings/get.handler.ts @@ -151,10 +151,12 @@ export async function getBookings({ userIdsWhereUserIsAdminOrOwner.includes(userId) ); + const isCurrentUser = filters.userIds.length === 1 && user.id === filters.userIds[0]; + // Scope depends on `user.orgId`: // - Throw an error if trying to filter by usersIds that are not within your ORG // - Throw an error if trying to filter by usersIds that are not within your TEAM - if (!areUserIdsWithinUserOrgOrTeam) { + if (!areUserIdsWithinUserOrgOrTeam && !isCurrentUser) { throw new TRPCError({ code: "FORBIDDEN", message: "You do not have permissions to fetch bookings for specified userIds",