bugfix: create organization button is now hidden for none owner users.

backend/src/modules/auth/auth.controller.ts

@@ -126,7 +126,11 @@ export class AuthController {
   @ApiBearerAuth('JWT-auth')
   @ApiOperation({ summary: 'Create organization for current user' })
   async createOrganization(@Req() req, @Body() dto: CreateOrganizationDto) {
-    return this.authService.createOrganization(req.user.id, dto);
+    return this.authService.createOrganization(
+      req.user.id,
+      req.user.organizationId,
+      dto,
+    );
   }
 
   // =========================

backend/src/modules/auth/auth.service.ts

@@ -4,6 +4,7 @@ import {
   UnauthorizedException,
   BadRequestException,
   ConflictException,
+  ForbiddenException,
   InternalServerErrorException
 } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
@@ -270,7 +271,11 @@ export class AuthService {
     return this.login({ email, password } as any, validatedUser);
   }
 
-  async createOrganization(userId: string, dto: CreateOrganizationDto) {
+  async createOrganization(
+    userId: string,
+    currentOrganizationId: string | undefined,
+    dto: CreateOrganizationDto,
+  ) {
     const owner = await this.prisma.user.findUnique({
       where: { id: userId },
       select: { id: true },
@@ -280,6 +285,28 @@ export class AuthService {
       throw new UnauthorizedException('User not found');
     }
 
+    if (!currentOrganizationId) {
+      throw new ForbiddenException(
+        'Select an organization before creating a new one.',
+      );
+    }
+
+    const currentMembership = await this.prisma.membership.findUnique({
+      where: {
+        userId_organizationId: {
+          userId,
+          organizationId: currentOrganizationId,
+        },
+      },
+      select: { isOwner: true },
+    });
+
+    if (!currentMembership?.isOwner) {
+      throw new ForbiddenException(
+        'Only owners of the current organization can create new organizations.',
+      );
+    }
+
     const organization = await this.prisma.$transaction(async (tx) => {
       const createdOrganization = await tx.organization.create({
         data: {