From e89503f00fd6b9c093d53faadd5a3d4d3eba333b Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com>
Date: Tue, 12 Mar 2024 15:44:23 +0100
Subject: [PATCH] Fix: Add missing actor auth method to permission checks

---
 .../src/services/project/project-service.ts   | 28 ++++++++++++++++---
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts
index 3ce487014..71703a50c 100644
--- a/backend/src/services/project/project-service.ts
+++ b/backend/src/services/project/project-service.ts
@@ -432,12 +432,20 @@ export const projectServiceFactory = ({
     return updatedProject;
   };
 
-  const upgradeProject = async ({ projectId, actor, actorId, actorAuthMethod, userPrivateKey }: TUpgradeProjectDTO) => {
+  const upgradeProject = async ({
+    projectId,
+    actor,
+    actorId,
+    actorAuthMethod,
+    actorOrgId,
+    userPrivateKey
+  }: TUpgradeProjectDTO) => {
     const { permission, hasRole } = await permissionService.getProjectPermission(
       actor,
       actorId,
       projectId,
-      actorAuthMethod
+      actorAuthMethod,
+      actorOrgId
     );
 
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Project);
@@ -462,8 +470,20 @@ export const projectServiceFactory = ({
     });
   };
 
-  const getProjectUpgradeStatus = async ({ projectId, actor, actorAuthMethod, actorId }: TProjectPermission) => {
-    const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorAuthMethod);
+  const getProjectUpgradeStatus = async ({
+    projectId,
+    actor,
+    actorAuthMethod,
+    actorOrgId,
+    actorId
+  }: TProjectPermission) => {
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
 
     const project = await projectDAL.findProjectById(projectId);