Fix permissions

server/src/ability/ability.factory.ts

@@ -75,6 +75,7 @@ export class AbilityFactory {
     // CommentThread
     can(AbilityAction.Read, 'CommentThread', { workspaceId: workspace.id });
     can(AbilityAction.Create, 'CommentThread');
+    can(AbilityAction.Update, 'CommentThread', { workspaceId: workspace.id });
 
     // Comment
     can(AbilityAction.Read, 'Comment', { workspaceId: workspace.id });

server/src/core/company/company.resolver.ts

@@ -46,10 +46,11 @@ export class CompanyResolver {
   ): Promise<Partial<Company>[]> {
     return this.companyService.findMany({
       ...args,
-      where: {
+      where: args.where
-        ...args.where,
+        ? {
-        AND: [accessibleBy(ability).Company],
+            AND: [args.where, accessibleBy(ability).Company],
-      },
+          }
+        : accessibleBy(ability).Company,
       select: prismaSelect.value,
     });
   }

server/src/core/person/person.resolver.ts

@@ -48,10 +48,11 @@ export class PersonResolver {
   ): Promise<Partial<Person>[]> {
     return this.personService.findMany({
       ...args,
-      where: {
+      where: args.where
-        ...args.where,
+        ? {
-        AND: [accessibleBy(ability).Person],
+            AND: [args.where, accessibleBy(ability).Person],
-      },
+          }
+        : accessibleBy(ability).Person,
       select: prismaSelect.value,
     });
   }

server/src/core/pipeline/resolvers/pipeline-progress.resolver.ts

@@ -45,11 +45,11 @@ export class PipelineProgressResolver {
   ): Promise<Partial<PipelineProgress>[]> {
     return this.pipelineProgressService.findMany({
       ...args,
-      where: {
+      where: args.where
-        ...args.where,
+        ? {
-        AND: [accessibleBy(ability).PipelineProgress],
+            AND: [args.where, accessibleBy(ability).PipelineProgress],
-      },
+          }
-      select: prismaSelect.value,
+        : accessibleBy(ability).PipelineProgress,
     });
   }
 

server/src/core/pipeline/resolvers/pipeline-stage.resolver.ts

@@ -31,10 +31,11 @@ export class PipelineStageResolver {
   ): Promise<Partial<PipelineStage>[]> {
     return this.pipelineStageService.findMany({
       ...args,
-      where: {
+      where: args.where
-        ...args.where,
+        ? {
-        AND: [accessibleBy(ability).PipelineStage],
+            AND: [args.where, accessibleBy(ability).PipelineStage],
-      },
+          }
+        : accessibleBy(ability).PipelineStage,
       select: prismaSelect.value,
     });
   }

server/src/core/pipeline/resolvers/pipeline.resolver.ts

@@ -31,10 +31,11 @@ export class PipelineResolver {
   ): Promise<Partial<Pipeline>[]> {
     return this.pipelineService.findMany({
       ...args,
-      where: {
+      where: args.where
-        ...args.where,
+        ? {
-        AND: [accessibleBy(ability).Pipeline],
+            AND: [args.where, accessibleBy(ability).Pipeline],
-      },
+          }
+        : accessibleBy(ability).Pipeline,
       select: prismaSelect.value,
     });
   }

server/src/core/user/user.resolver.ts

@@ -38,10 +38,11 @@ export class UserResolver {
   ): Promise<Partial<User>[]> {
     return await this.userService.findMany({
       ...args,
-      where: {
+      where: args.where
-        ...args.where,
+        ? {
-        AND: [accessibleBy(ability).User],
+            AND: [args.where, accessibleBy(ability).User],
-      },
+          }
+        : accessibleBy(ability).User,
       select: prismaSelect.value,
     });
   }