diff --git a/server/commands/documentLoader.ts b/server/commands/documentLoader.ts index a92cf1760..b0ecd609a 100644 --- a/server/commands/documentLoader.ts +++ b/server/commands/documentLoader.ts @@ -64,7 +64,7 @@ export default async function loadDocument({ ], }); - if (!share || share.document.archivedAt) { + if (!share || share.document?.archivedAt) { throw InvalidRequestError("Document could not be found for shareId"); } @@ -133,16 +133,18 @@ export default async function loadDocument({ // If we're attempting to load a document that isn't the document originally // shared then includeChildDocuments must be enabled and the document must // still be active and nested within the shared document - if (share.document.id !== document.id) { + if (share.documentId !== document.id) { if (!share.includeChildDocuments) { throw AuthorizationError(); } - const childDocumentIds = await share.document.getChildDocumentIds({ - archivedAt: { - [Op.is]: null, - }, - }); + const childDocumentIds = + (await share.document?.getChildDocumentIds({ + archivedAt: { + [Op.is]: null, + }, + })) ?? []; + if (!childDocumentIds.includes(document.id)) { throw AuthorizationError(); } diff --git a/server/models/Share.ts b/server/models/Share.ts index 463e025b6..1db4bd0ab 100644 --- a/server/models/Share.ts +++ b/server/models/Share.ts @@ -113,7 +113,7 @@ class Share extends IdModel { teamId: string; @BelongsTo(() => Document, "documentId") - document: Document; + document: Document | null; @ForeignKey(() => Document) @Column(DataType.UUID) diff --git a/server/presenters/share.ts b/server/presenters/share.ts index d54e6da74..444d28dc1 100644 --- a/server/presenters/share.ts +++ b/server/presenters/share.ts @@ -5,8 +5,8 @@ export default function present(share: Share, isAdmin = false) { const data = { id: share.id, documentId: share.documentId, - documentTitle: share.document.title, - documentUrl: share.document.url, + documentTitle: share.document?.title, + documentUrl: share.document?.url, published: share.published, url: `${share.team.url}/share/${share.id}`, createdBy: presentUser(share.user),