Updated the backend so the users list only returns the correct ones

src/pages/api/users/list.ts

@@ -4,6 +4,8 @@ import {app} from "@/firebase";
 import {getFirestore, collection, getDocs} from "firebase/firestore";
 import {withIronSessionApiRoute} from "iron-session/next";
 import {sessionOptions} from "@/lib/session";
+import {getGroupsForUser} from "@/utils/groups.be";
+import {uniq} from "lodash";
 
 const db = getFirestore(app);
 
@@ -16,11 +18,17 @@ async function handler(req: NextApiRequest, res: NextApiResponse) {
 	}
 
 	const snapshot = await getDocs(collection(db, "users"));
+	const users = snapshot.docs.map((doc) => ({
+		id: doc.id,
+		...doc.data(),
+	}));
 
-	res.status(200).json(
-		snapshot.docs.map((doc) => ({
-			id: doc.id,
-			...doc.data(),
-		})),
-	);
+	if (!req.session.user) return res.status(200).json(users);
+	if (req.session.user.type === "admin" || req.session.user.type === "developer") return res.status(200).json(users);
+
+	const adminGroups = await getGroupsForUser(req.session.user.id);
+	const groups = await Promise.all(adminGroups.flatMap((x) => x.participants).map(async (x) => await getGroupsForUser(x)));
+	const participants = uniq([...adminGroups.flatMap((x) => x.participants), ...groups.flat().flatMap((x) => x.participants)]);
+
+	res.status(200).json(users.filter((x) => participants.includes(x.id)));
 }