Merge remote-tracking branch 'origin/dev' into dev

src/components/hooks/queries/useFilterQuery.ts

@@ -10,7 +10,7 @@ export interface FilterQueryResult<T> {
   setParams: Dispatch<SetStateAction<T | SearchFilter>>;
 }
 
-export function useFilterQuery<T>({
+export function useFilterQuery<T = any>({
   queryKey,
   queryFn,
   ...options

src/lib/auth.ts

@@ -166,14 +166,14 @@ export async function canViewTeam({ user }: Auth, teamId: string) {
 }
 
 export async function canUpdateTeam({ user, grant }: Auth, teamId: string) {
-  if (cloudMode) {
-    return !!grant?.find(a => a === PERMISSIONS.teamUpdate);
-  }
-
   if (user.isAdmin) {
     return true;
   }
 
+  if (cloudMode) {
+    return !!grant?.find(a => a === PERMISSIONS.teamUpdate);
+  }
+
   const teamUser = await getTeamUser(teamId, user.id);
 
   return teamUser && hasPermission(teamUser.role, PERMISSIONS.teamUpdate);

src/pages/api/teams/[teamId]/users/[userId].ts

@@ -37,6 +37,16 @@ export default async (
 
   const { teamId, userId } = req.query;
 
+  if (req.method === 'GET') {
+    if (!(await canUpdateTeam(req.auth, teamId))) {
+      return unauthorized(res, 'You must be the owner of this team.');
+    }
+
+    const teamUser = await getTeamUser(teamId, userId);
+
+    return ok(res, teamUser);
+  }
+
   if (req.method === 'POST') {
     if (!(await canUpdateTeam(req.auth, teamId))) {
       return unauthorized(res, 'You must be the owner of this team.');