chamomind/jws-backend
chamomind/jws-backend
7
0
Fork 0
Code Issues Projects 1 Releases Packages 1 Wiki Activity Actions

fix: customer edit not consider related branch perm

Browse source
This commit is contained in:
Methapon Metanipat 2024-09-09 09:42:09 +07:00
parent a32ed2ea2c
commit 71a8a25cda
1 changed files with 30 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

40
src/controllers/03-customer-controller.ts
View file

@ -432,7 +432,15 @@ export class CustomerController extends Controller {
where: { id: customerId }, where: { id: customerId },
include: { include: {
registeredBranch: { registeredBranch: {
include: { user: { where: { userId: req.user.sub } } }, include: {
headOffice: {
include: {
branch: { where: { user: { some: { userId: req.user.sub } } } },
user: { where: { userId: req.user.sub } },
},
},
user: { where: { userId: req.user.sub } },
},
}, },
}, },
}); });
@ -441,15 +449,27 @@ export class CustomerController extends Controller {
throw new HttpError(HttpStatus.NOT_FOUND, "Customer cannot be found.", "customerNotFound"); throw new HttpError(HttpStatus.NOT_FOUND, "Customer cannot be found.", "customerNotFound");
} }
if ( if (!isSystem(req.user)) {
!globalAllow(req.user) && if (!globalAllow(req.user) && record.registeredBranch?.user.length === 0) {
(!record.registeredBranch || record.registeredBranch.user.length === 0) throw new HttpError(
) { HttpStatus.FORBIDDEN,
throw new HttpError( "You do not have permission to perform this action.",
HttpStatus.FORBIDDEN, "noPermission",
"You do not have permission to perform this action.", );
"noPermission", } else {
); if (
(record.registeredBranch?.user.length === 0 && !record.registeredBranch?.headOffice) ||
(record.registeredBranch?.headOffice &&
record.registeredBranch?.headOffice.user.length === 0 &&
record.registeredBranch?.headOffice.branch.length === 0)
) {
throw new HttpError(
HttpStatus.FORBIDDEN,
"You do not have permission to perform this action.",
"noPermission",
);
}
}
} }
if (record.status !== Status.CREATED) { if (record.status !== Status.CREATED) {