From 7960a4cea11d839f5a0d1889e98bb949c11b68fa Mon Sep 17 00:00:00 2001
From: Meier Lukas <meierschlumpf@gmail.com>
Date: Tue, 21 Jan 2025 10:59:04 +0100
Subject: [PATCH] fix: unable to change home board in user preferences (#2011)

---
 packages/api/src/router/user.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/packages/api/src/router/user.ts b/packages/api/src/router/user.ts
index 0309fae64..2b23f7256 100644
--- a/packages/api/src/router/user.ts
+++ b/packages/api/src/router/user.ts
@@ -404,7 +404,13 @@ export const userRouter = createTRPCRouter({
         });
       }
 
-      await throwIfActionForbiddenAsync(ctx, eq(boards.id, input.userId), "view");
+      // Only allow user to select boards they have access to
+      if (input.homeBoardId) {
+        await throwIfActionForbiddenAsync(ctx, eq(boards.id, input.homeBoardId), "view");
+      }
+      if (input.mobileHomeBoardId) {
+        await throwIfActionForbiddenAsync(ctx, eq(boards.id, input.mobileHomeBoardId), "view");
+      }
 
       await ctx.db
         .update(users)