fix issue

apps/edr-freight-api/src/modules/rule-engine/services/priority-rule-change-requests.service.ts

@@ -5,6 +5,7 @@ import {
 import {
   BadRequestException,
   ConflictException,
+  ForbiddenException,
   Injectable,
   Logger,
   NotFoundException,
@@ -82,6 +83,15 @@ export class PriorityRuleChangeRequestsService {
   ): Promise<PriorityRuleChangeRequest> {
     const request = await this.findPending(id);
 
+    // Separation of duties: the requester cannot approve their own change.
+    // TODO: split approval into a distinct approver permission rather than
+    // relying on this id check.
+    if (userId && userId === request.requestedByUserId) {
+      throw new ForbiddenException(
+        'You cannot approve a change request you submitted',
+      );
+    }
+
     // Apply the change through the normal service so currency + range-collision
     // validation runs against the CURRENT rules; a stale request that now
     // collides fails here and stays PENDING for the approver to see the error.

apps/edr-freight-api/src/modules/rule-engine/services/rates.service.ts

@@ -1,6 +1,7 @@
 import {
   BadRequestException,
   ConflictException,
+  ForbiddenException,
   Inject,
   Injectable,
   NotFoundException,
@@ -199,6 +200,12 @@ export class RatesService {
     if (rate.status !== 'PENDING_APPROVAL') {
       throw new BadRequestException('Only PENDING_APPROVAL rates can be approved');
     }
+    // Separation of duties: the proposer cannot approve their own rate.
+    // TODO: split approval into a distinct CEO/approver permission — a proposer
+    // who also holds the approve permission is still the wrong person to sign off.
+    if (approverUserId === rate.proposedByStaffId) {
+      throw new ForbiddenException('You cannot approve a rate you proposed');
+    }
     const updated = await this.repository.update(id, {
       status: 'LIVE',
       approvedByCeoId: approverUserId,