diff --git a/packages/backend/src/controllers/api/v1/flows/get-flows.js b/packages/backend/src/controllers/api/v1/flows/get-flows.js index e4951cce..98373ce5 100644 --- a/packages/backend/src/controllers/api/v1/flows/get-flows.js +++ b/packages/backend/src/controllers/api/v1/flows/get-flows.js @@ -3,8 +3,13 @@ import paginateRest from '../../../../helpers/pagination-rest.js'; export default async (request, response) => { await request.currentUser.hasFolderAccess(request.body.folderId); + const currentUserFolderIds = await request.currentUser.getFolderIds(); + + const flowsQuery = request.currentUser.getFlows( + flowParams(request), + currentUserFolderIds + ); - const flowsQuery = request.currentUser.getFlows(flowParams(request)); const flows = await paginateRest(flowsQuery, request.query.page); renderObject(response, flows); diff --git a/packages/backend/src/models/user.js b/packages/backend/src/models/user.js index 27bbe8b2..98af0fc3 100644 --- a/packages/backend/src/models/user.js +++ b/packages/backend/src/models/user.js @@ -525,7 +525,13 @@ class User extends Base { return true; } - getFlows({ folderId, name }) { + async getFolderIds() { + const folders = await this.$relatedQuery('folders').select('id'); + + return folders.map((folder) => folder.id); + } + + getFlows({ folderId, name }, ownedFolderIds) { return this.authorizedFlows .clone() .withGraphFetched({ @@ -537,7 +543,9 @@ class User extends Base { } if (folderId === 'null') { - builder.whereNull('flows.folder_id'); + builder + .whereNull('flows.folder_id') + .orWhereNotIn('flows.folder_id', ownedFolderIds); } else if (folderId) { builder.where('flows.folder_id', folderId); }