diff --git a/backend/src/graphql/resolver/ContributionResolver.ts b/backend/src/graphql/resolver/ContributionResolver.ts index e75471c08..bdd8e74a4 100644 --- a/backend/src/graphql/resolver/ContributionResolver.ts +++ b/backend/src/graphql/resolver/ContributionResolver.ts @@ -35,11 +35,18 @@ export class ContributionResolver { @Authorized([RIGHTS.DELETE_CONTRIBUTION]) @Mutation(() => Boolean) - async adminDeleteContribution(@Arg('id', () => Int) id: number): Promise { + async adminDeleteContribution( + @Arg('id', () => Int) id: number, + @Ctx() context: Context, + ): Promise { + const user = getUser(context) const contribution = await Contribution.findOne(id) if (!contribution) { throw new Error('Contribution not found for given id.') } + if (contribution.userId !== user.id) { + throw new Error('Can not delete contribution of another user') + } const res = await contribution.softRemove() return !!res }