fix issue

apps/edr-freight-api/src/modules/rule-engine/services/priority-rule-change-requests.service.ts

@@ -5,6 +5,7 @@ import {
 import {
   BadRequestException,
   ConflictException,
+  ForbiddenException,
   Injectable,
   Logger,
   NotFoundException,
@@ -82,6 +83,15 @@ export class PriorityRuleChangeRequestsService {
   ): Promise<PriorityRuleChangeRequest> {
     const request = await this.findPending(id);
 
+    // Separation of duties: the requester cannot approve their own change.
+    // TODO: split approval into a distinct approver permission rather than
+    // relying on this id check.
+    if (userId && userId === request.requestedByUserId) {
+      throw new ForbiddenException(
+        'You cannot approve a change request you submitted',
+      );
+    }
+
     // Apply the change through the normal service so currency + range-collision
     // validation runs against the CURRENT rules; a stale request that now
     // collides fails here and stays PENDING for the approver to see the error.