fix(visual): check for creator board permission is wrong (#3212)

packages/auth/permissions/board-permissions.ts

@@ -23,21 +23,22 @@ export type BoardPermissionsProps = (
 
 export const constructBoardPermissions = (board: BoardPermissionsProps, session: Session | null) => {
   const creatorId = "creator" in board ? board.creator?.id : board.creatorId;
+  const isCreator = session !== null && session.user.id === creatorId;
 
   return {
     hasFullAccess:
-      session?.user.id === creatorId ||
+      isCreator ||
       board.userPermissions.some(({ permission }) => permission === "full") ||
       board.groupPermissions.some(({ permission }) => permission === "full") ||
       (session?.user.permissions.includes("board-full-all") ?? false),
     hasChangeAccess:
-      session?.user.id === creatorId ||
+      isCreator ||
       board.userPermissions.some(({ permission }) => permission === "modify" || permission === "full") ||
       board.groupPermissions.some(({ permission }) => permission === "modify" || permission === "full") ||
       (session?.user.permissions.includes("board-modify-all") ?? false) ||
       (session?.user.permissions.includes("board-full-all") ?? false),
     hasViewAccess:
-      session?.user.id === creatorId ||
+      isCreator ||
       board.userPermissions.length >= 1 ||
       board.groupPermissions.length >= 1 ||
       board.isPublic ||

packages/auth/permissions/test/board-permissions.spec.ts

@@ -286,4 +286,22 @@ describe("constructBoardPermissions", () => {
     expect(result.hasChangeAccess).toBe(false);
     expect(result.hasViewAccess).toBe(true);
   });
+  test("should return all false when creator is null and session is null", () => {
+    // Arrange
+    const board = {
+      creator: null,
+      userPermissions: [],
+      groupPermissions: [],
+      isPublic: false,
+    };
+    const session = null;
+
+    // Act
+    const result = constructBoardPermissions(board, session);
+
+    // Assert
+    expect(result.hasFullAccess).toBe(false);
+    expect(result.hasChangeAccess).toBe(false);
+    expect(result.hasViewAccess).toBe(false);
+  });
 });