fix: share global schedules across org admins and owners

Global (dokploy-server) schedules were scoped to the creator's user ID,
making them invisible to other admins and owners in the same organization.
This was inconsistent with server and application schedules which are
org-scoped.

- schedule.list: admins/owners now see all dokploy-server schedules from
  every member in the org, not just their own
- schedule.update/delete/one/runManually: admins/owners can now manage
  dokploy-server schedules created by other org members

Author: Valentin FROMENT

apps/dokploy/server/api/routers/schedule.ts

@@ -1,5 +1,6 @@
 import { IS_CLOUD, removeScheduleJob, scheduleJob } from "@dokploy/server";
 import { db } from "@dokploy/server/db";
+import { member } from "@dokploy/server/db/schema";
 import { deployments } from "@dokploy/server/db/schema/deployment";
 import {
 	createScheduleSchema,
@@ -20,7 +21,7 @@ import {
 } from "@dokploy/server/services/schedule";
 import { findServerById } from "@dokploy/server/services/server";
 import { TRPCError } from "@trpc/server";
-import { asc, desc, eq } from "drizzle-orm";
+import { and, asc, desc, eq, inArray } from "drizzle-orm";
 import { z } from "zod";
 import { audit } from "@/server/api/utils/audit";
 import { removeJob, schedule } from "@/server/utils/backup";
@@ -163,16 +164,30 @@ export const scheduleRouter = createTRPCRouter({
 					}
 				}
 
+			if (
+				existingSchedule.scheduleType === "dokploy-server" &&
+				existingSchedule.userId &&
+				existingSchedule.userId !== ctx.user.id
+			) {
+				const currentMember = await findMemberByUserId(
+					ctx.user.id,
+					ctx.session.activeOrganizationId,
+				);
 				if (
-					existingSchedule.scheduleType === "dokploy-server" &&
-					existingSchedule.userId &&
-					existingSchedule.userId !== ctx.user.id
+					currentMember.role !== "owner" &&
+					currentMember.role !== "admin"
 				) {
 					throw new TRPCError({
 						code: "UNAUTHORIZED",
-						message: "You can only manage your own host-level schedules.",
+						message:
+							"You can only manage your own host-level schedules.",
 					});
 				}
+				await findMemberByUserId(
+					existingSchedule.userId,
+					ctx.session.activeOrganizationId,
+				);
+			}
 			}
 			const updatedSchedule = await updateSchedule(input);
 
@@ -262,10 +277,24 @@ export const scheduleRouter = createTRPCRouter({
 					scheduleItem.userId &&
 					scheduleItem.userId !== ctx.user.id
 				) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You can only manage your own host-level schedules.",
-					});
+					const currentMember = await findMemberByUserId(
+						ctx.user.id,
+						ctx.session.activeOrganizationId,
+					);
+					if (
+						currentMember.role !== "owner" &&
+						currentMember.role !== "admin"
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message:
+								"You can only manage your own host-level schedules.",
+						});
+					}
+					await findMemberByUserId(
+						scheduleItem.userId,
+						ctx.session.activeOrganizationId,
+					);
 				}
 			}
 			await deleteSchedule(input.scheduleId);
@@ -322,36 +351,51 @@ export const scheduleRouter = createTRPCRouter({
 						});
 					}
 				}
+			}
 
-				if (
-					input.scheduleType === "dokploy-server" &&
-					input.id !== ctx.user.id
-				) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You can only list your own host-level schedules.",
-					});
-				}
+		let listWhere;
+		if (input.scheduleType === "dokploy-server") {
+			const currentMember = await findMemberByUserId(
+				ctx.user.id,
+				ctx.session.activeOrganizationId,
+			);
+			if (
+				currentMember.role === "owner" ||
+				currentMember.role === "admin"
+			) {
+				const orgMembers = await db.query.member.findMany({
+					where: eq(member.organizationId, ctx.session.activeOrganizationId),
+					columns: { userId: true },
+				});
+				const userIds = orgMembers.map((m) => m.userId);
+				listWhere = and(
+					eq(schedules.scheduleType, "dokploy-server"),
+					inArray(schedules.userId, userIds),
+				);
+			} else {
+				listWhere = eq(schedules.userId, ctx.user.id);
 			}
+		} else {
 			const where = {
 				application: eq(schedules.applicationId, input.id),
 				compose: eq(schedules.composeId, input.id),
 				server: eq(schedules.serverId, input.id),
-				"dokploy-server": eq(schedules.userId, input.id),
 			};
-			return db.query.schedules.findMany({
-				where: where[input.scheduleType],
-				orderBy: [asc(schedules.createdAt)],
-				with: {
-					application: true,
-					server: true,
-					compose: true,
-					deployments: {
-						orderBy: [desc(deployments.createdAt)],
-					},
+			listWhere = where[input.scheduleType];
+		}
+		return db.query.schedules.findMany({
+			where: listWhere,
+			orderBy: [asc(schedules.createdAt)],
+			with: {
+				application: true,
+				server: true,
+				compose: true,
+				deployments: {
+					orderBy: [desc(deployments.createdAt)],
 				},
-			});
-		}),
+			},
+		});
+	}),
 
 	one: protectedProcedure
 		.input(z.object({ scheduleId: z.string() }))
@@ -382,10 +426,23 @@ export const scheduleRouter = createTRPCRouter({
 					schedule.userId &&
 					schedule.userId !== ctx.user.id
 				) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You don't have access to this schedule.",
-					});
+					const currentMember = await findMemberByUserId(
+						ctx.user.id,
+						ctx.session.activeOrganizationId,
+					);
+					if (
+						currentMember.role !== "owner" &&
+						currentMember.role !== "admin"
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message: "You don't have access to this schedule.",
+						});
+					}
+					await findMemberByUserId(
+						schedule.userId,
+						ctx.session.activeOrganizationId,
+					);
 				}
 			}
 			return schedule;
@@ -445,10 +502,24 @@ export const scheduleRouter = createTRPCRouter({
 					scheduleItem.userId &&
 					scheduleItem.userId !== ctx.user.id
 				) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You can only manage your own host-level schedules.",
-					});
+					const currentMember = await findMemberByUserId(
+						ctx.user.id,
+						ctx.session.activeOrganizationId,
+					);
+					if (
+						currentMember.role !== "owner" &&
+						currentMember.role !== "admin"
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message:
+								"You can only manage your own host-level schedules.",
+						});
+					}
+					await findMemberByUserId(
+						scheduleItem.userId,
+						ctx.session.activeOrganizationId,
+					);
 				}
 			}
 			try {