chamomind/jws-backend
chamomind/jws-backend
7
0
Fork 0
Code Issues Projects 1 Releases Packages 1 Wiki Activity Actions

fix: customer edit not consider related branch perm

Browse source
This commit is contained in:
Methapon Metanipat 2024-09-09 09:42:09 +07:00
parent a32ed2ea2c
commit 71a8a25cda
1 changed files with 30 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

40
src/controllers/03-customer-controller.ts
View file

@ -432,7 +432,15 @@ export class CustomerController extends Controller {
where: { id: customerId },
include: {
registeredBranch: {
include: { user: { where: { userId: req.user.sub } } },
include: {
headOffice: {
include: {
branch: { where: { user: { some: { userId: req.user.sub } } } },
user: { where: { userId: req.user.sub } },
},
},
user: { where: { userId: req.user.sub } },
},
},
},
});
@ -441,15 +449,27 @@ export class CustomerController extends Controller {
throw new HttpError(HttpStatus.NOT_FOUND, "Customer cannot be found.", "customerNotFound");
}
if (
!globalAllow(req.user) &&
(!record.registeredBranch || record.registeredBranch.user.length === 0)
) {
throw new HttpError(
HttpStatus.FORBIDDEN,
"You do not have permission to perform this action.",
"noPermission",
);
if (!isSystem(req.user)) {
if (!globalAllow(req.user) && record.registeredBranch?.user.length === 0) {
throw new HttpError(
HttpStatus.FORBIDDEN,
"You do not have permission to perform this action.",
"noPermission",
);
} else {
if (
(record.registeredBranch?.user.length === 0 && !record.registeredBranch?.headOffice) ||
(record.registeredBranch?.headOffice &&
record.registeredBranch?.headOffice.user.length === 0 &&
record.registeredBranch?.headOffice.branch.length === 0)
) {
throw new HttpError(
HttpStatus.FORBIDDEN,
"You do not have permission to perform this action.",
"noPermission",
);
}
}
}
if (record.status !== Status.CREATED) {