fix: only collectives user admins can be picked when editing expense

opencollective · Nov 15, 2024 · c7c58a4 · c7c58a4
1 parent 8328c49
commit c7c58a4
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 4 deletions.
diff --git a/components/expenses/ExpenseFormPayeeStep.js b/components/expenses/ExpenseFormPayeeStep.js
@@ -390,16 +390,23 @@ const ExpenseFormPayeeStep = ({
                     customOptionsPosition={CUSTOM_OPTIONS_POSITION.BOTTOM}
                     getDefaultOptions={build => values.payee && build(values.payee)}
                     disabled={disablePayee}
-                    invitable
+                    invitable={!editingExpense}
                     onInvite={onInvite}
                     LoggedInUser={loggedInAccount}
                     includeVendorsForHostId={collective.host?.legacyId || undefined}
                     addLoggedInUserAsAdmin
                     excludeAdminFields
                     searchQuery={expenseFormPayeeStepCollectivePickerSearchQuery}
-                    filterResults={collectives =>
-                      collectives.filter(c => c.type !== CollectiveType.VENDOR || c.hasPayoutMethod)
-                    }
+                    filterResults={collectives => {
+                      if (editingExpense) {
+                        return collectives.filter(c =>
+                          loggedInAccount.adminMemberships?.nodes.some(m =>
+                            [c.slug, c.host?.slug].includes(m.account.slug),
+                          ),
+                        );
+                      }
+                      return collectives.filter(c => c.type !== CollectiveType.VENDOR || c.hasPayoutMethod);
+                    }}
                     loading={loading}
                   />
                 )}

diff --git a/lib/graphql/v1/queries.js b/lib/graphql/v1/queries.js
@@ -395,6 +395,10 @@ export const expenseFormPayeeStepCollectivePickerSearchQuery = gqlV1/* GraphQL *
         isActive
         isArchived
         isHost
+        host {
+          id
+          slug
+        }
         payoutMethods {
           legacyId: id
           type